Vulnerability Analysis

DE-TH-Aura : Detection Engineering And Threat Hunting By SecurityAura

DE-TH-Aura, an initiative by SecurityAura, focuses on enhancing detection engineering and threat hunting capabilities using KQL (Kusto Query Language).

This effort is primarily aimed at leveraging the Microsoft Defender XDR suite and logs ingested through Microsoft Sentinel, such as Windows Security Event Logs.

The project is hosted on a GitHub repository where SecurityAura shares queries developed from various sources, including day-to-day work experiences, tweets, blog posts, research articles, and personal ideas.

Key Features Of DE-TH-Aura

  • Query Development: The repository includes both basic and advanced KQL queries designed for detection and threat hunting. These queries are not static; they are expected to evolve over time as new techniques and edge cases are discovered.
  • Sources of Inspiration: Queries are inspired by diverse sources, ensuring a comprehensive approach to threat detection and hunting.
  • Collaborative Improvement: The project encourages collaboration and feedback. Queries can be improved upon by others, and SecurityAura plans to revisit and refine them based on new insights or optimizations.
  • Future Plans: There are plans to incorporate pseudo-code using Sigma in the future, expanding the project’s scope beyond KQL.

Tools And Functionality

  • KQL Queries: The core of DE-TH-Aura is its collection of KQL queries tailored for Microsoft Defender XDR and Microsoft Sentinel. These queries help in identifying potential threats and anomalies within system logs.
  • GitHub Repository: The project is hosted on GitHub, allowing for easy access and collaboration. The repository is structured using a template inspired by Bert-JanP’s Hunting-Queries-Detection-Rules.
  • Community Engagement: SecurityAura invites feedback and questions via social media platforms, fostering a community around the project.

As part of the initiative, SecurityAura has embarked on the #100DaysOfKQL challenge, where new queries are being developed and shared regularly.

This challenge aims to push the boundaries of what can be achieved with KQL in threat detection and hunting.

The queries from this challenge will be organized within the repository after its completion, further enriching the DE-TH-Aura project.

In summary, DE-TH-Aura is a dynamic project that leverages KQL to enhance threat detection and hunting capabilities, with a focus on continuous improvement and community engagement.

Varshini

Varshini is a Cyber Security expert in Threat Analysis, Vulnerability Assessment, and Research. Passionate about staying ahead of emerging Threats and Technologies.

Recent Posts

Pystinger : Bypass Firewall For Traffic Forwarding Using Webshell

Pystinger is a Python-based tool that enables SOCKS4 proxying and port mapping through webshells. It…

1 week ago

CVE-Search : A Tool To Perform Local Searches For Known Vulnerabilities

Introduction When it comes to cybersecurity, speed and privacy are critical. Public vulnerability databases like…

1 week ago

CVE-Search : A Tool To Perform Local Searches For Known Vulnerabilities

Introduction When it comes to cybersecurity, speed and privacy are critical. Public vulnerability databases like…

1 week ago

How to Bash Append to File: A Simple Guide for Beginners

If you are working with Linux or writing bash scripts, one of the most common…

1 week ago

Mastering the Bash Case Statement with Simple Examples

What is a bash case statement? A bash case statement is a way to control…

1 week ago

How to Check if a File Exists in Bash – Simply Explained

Why Do We Check Files in Bash? When writing a Bash script, you often work…

1 week ago