DE-TH-Aura : Detection Engineering And Threat Hunting By SecurityAura

DE-TH-Aura, an initiative by SecurityAura, focuses on enhancing detection engineering and threat hunting capabilities using KQL (Kusto Query Language).

This effort is primarily aimed at leveraging the Microsoft Defender XDR suite and logs ingested through Microsoft Sentinel, such as Windows Security Event Logs.

The project is hosted on a GitHub repository where SecurityAura shares queries developed from various sources, including day-to-day work experiences, tweets, blog posts, research articles, and personal ideas.

Key Features Of DE-TH-Aura

• Query Development: The repository includes both basic and advanced KQL queries designed for detection and threat hunting. These queries are not static; they are expected to evolve over time as new techniques and edge cases are discovered.
• Sources of Inspiration: Queries are inspired by diverse sources, ensuring a comprehensive approach to threat detection and hunting.
• Collaborative Improvement: The project encourages collaboration and feedback. Queries can be improved upon by others, and SecurityAura plans to revisit and refine them based on new insights or optimizations.
• Future Plans: There are plans to incorporate pseudo-code using Sigma in the future, expanding the project’s scope beyond KQL.

Tools And Functionality

• KQL Queries: The core of DE-TH-Aura is its collection of KQL queries tailored for Microsoft Defender XDR and Microsoft Sentinel. These queries help in identifying potential threats and anomalies within system logs.
• GitHub Repository: The project is hosted on GitHub, allowing for easy access and collaboration. The repository is structured using a template inspired by Bert-JanP’s Hunting-Queries-Detection-Rules.
• Community Engagement: SecurityAura invites feedback and questions via social media platforms, fostering a community around the project.

As part of the initiative, SecurityAura has embarked on the #100DaysOfKQL challenge, where new queries are being developed and shared regularly.

This challenge aims to push the boundaries of what can be achieved with KQL in threat detection and hunting.

The queries from this challenge will be organized within the repository after its completion, further enriching the DE-TH-Aura project.

In summary, DE-TH-Aura is a dynamic project that leverages KQL to enhance threat detection and hunting capabilities, with a focus on continuous improvement and community engagement.