learningkijo / kql

Threat Hunting query in Microsoft 365 Defender, XDR. Provide out-of-the-box KQL hunting queries - App, Email, Identity and Endpoint.

Thank you for visiting @LearningKijo

I'm @LearningKijo, and my content will delve into three main topics: KQL, insightful out-of-the-box queries, and product & security research notes.

Repository

1. LearningKijo/KQL
2. LearningKijo/SecurityResearch-Note
3. LearningKijo/ProductResearch-Note
4. LearningKijo/MDEtester
5. LearningKijo/ResearchDev

Blog

• July 31 2023, AiTM & BEC threat hunting with KQL

Speaker

• November 6 2023, Microsoft 365 Defender Virtual Ninja Training
  • Advanced Hunting & Data visualization in Microsoft 365 Defender
• December 15 2023, Microsoft Security Insights
  • Microsoft Security Insights Show Episode 182 - Kijo
• May 21 2024, Threatscape
  • How To Simulate Threats and Attacks in Microsoft Defender XDR

Expertise & Language

# Kusto query language(KQL) - Advanced 
# Python - intermediate
# PowerShell - intermediate
# API, RestAPI
# Cyberattack - APT29, AiTM, Ransomeware
# Microsoft Security solution <Defenders> against cyberattack
# Incident Response, Automation, Threat Hunting
# Malware analysis
      - Statis analysis
      - Dynamic analysis
      
# Experience
let MicrosoftProducts = datatable(id: int, value: string)
[
      1, "Microsoft Defender for Endpoints", 
      2, "Microsoft Defender for Office 365", 
      3, "Microsoft Defender for Cloud Apps", 
      4, "Microsoft Defender for Identity", 
      5, "Microsoft 365 Defender", 
      6, "Microsoft Sentinel"
];
MicrosoftProducts
| project id, value

View my verified badges

Disclaimer

The views and opinions expressed herein are those of the author and do not necessarily reflect the views of company.

kql's Issues

M365D-AH-View

Add kql cheat

Would love to see our tool at the list of cheatsheet aswell! https://kqlcheat.byfortytwo.com/