Vulnerability Analysis

DE-TH-Aura : Detection Engineering And Threat Hunting By SecurityAura

DE-TH-Aura, an initiative by SecurityAura, focuses on enhancing detection engineering and threat hunting capabilities using KQL (Kusto Query Language).

This effort is primarily aimed at leveraging the Microsoft Defender XDR suite and logs ingested through Microsoft Sentinel, such as Windows Security Event Logs.

The project is hosted on a GitHub repository where SecurityAura shares queries developed from various sources, including day-to-day work experiences, tweets, blog posts, research articles, and personal ideas.

Key Features Of DE-TH-Aura

  • Query Development: The repository includes both basic and advanced KQL queries designed for detection and threat hunting. These queries are not static; they are expected to evolve over time as new techniques and edge cases are discovered.
  • Sources of Inspiration: Queries are inspired by diverse sources, ensuring a comprehensive approach to threat detection and hunting.
  • Collaborative Improvement: The project encourages collaboration and feedback. Queries can be improved upon by others, and SecurityAura plans to revisit and refine them based on new insights or optimizations.
  • Future Plans: There are plans to incorporate pseudo-code using Sigma in the future, expanding the project’s scope beyond KQL.

Tools And Functionality

  • KQL Queries: The core of DE-TH-Aura is its collection of KQL queries tailored for Microsoft Defender XDR and Microsoft Sentinel. These queries help in identifying potential threats and anomalies within system logs.
  • GitHub Repository: The project is hosted on GitHub, allowing for easy access and collaboration. The repository is structured using a template inspired by Bert-JanP’s Hunting-Queries-Detection-Rules.
  • Community Engagement: SecurityAura invites feedback and questions via social media platforms, fostering a community around the project.

As part of the initiative, SecurityAura has embarked on the #100DaysOfKQL challenge, where new queries are being developed and shared regularly.

This challenge aims to push the boundaries of what can be achieved with KQL in threat detection and hunting.

The queries from this challenge will be organized within the repository after its completion, further enriching the DE-TH-Aura project.

In summary, DE-TH-Aura is a dynamic project that leverages KQL to enhance threat detection and hunting capabilities, with a focus on continuous improvement and community engagement.

Varshini

Varshini is a Cyber Security expert in Threat Analysis, Vulnerability Assessment, and Research. Passionate about staying ahead of emerging Threats and Technologies.

Recent Posts

cp Command: Copy Files and Directories in Linux

The cp command, short for "copy," is the main Linux utility for duplicating files and directories. Whether…

7 days ago

Image OSINT

Introduction In digital investigations, images often hold more information than meets the eye. With the…

7 days ago

cat Command: Read and Combine File Contents in Linux

The cat command short for concatenate, It is a fast and versatile tool for viewing and merging…

7 days ago

Port In Networking

What is a Port? A port in networking acts like a gateway that directs data…

7 days ago

ls Command: List Directory Contents in Linux

The ls command is fundamental for anyone working with Linux. It’s used to display the files and…

1 week ago

pwd Command: Find Your Location in Linux

The pwd (Print Working Directory) command is essential for navigating the Linux filesystem. It instantly shows your…

1 week ago