Inspiration
The inspiration for this work is primary educating people on using Azure Sentinel at a practical way, which goes into multiple examples. Such as understanding the data sources, using KQL queries, and so on.
People often tend to forget the most relevant part, which is what kind of data they collect. This goes beyond understanding, where your data comes from, but it's about understanding the relevant data logs, that belongs to a specific technique. If you don't understand this, it could be incredible difficult to build your KQL queries based on the relevant techniques that you're might be looking for.
I've spoken with a few SOC Analysts about Azure Sentinel and what I've realize so far, is that people like the new shiny things, and that's understandable. What I really believe that should be done as well is to understand your data sources, and how you can map (for example) specific Windows Event logs to a technique.
What it does
My project is based on a blog post with a PDF at the end. It is a document that I've build together with public examples of techniques, that adversaries have been using in the wild. It describes a short story with some screenshots as an example. In matter of fact, every technique has a described example.
I believe that it's helpful to include a lot of examples, so people could learn it way better. Every technique includes an example, and it walks you through different steps on creating a KQL query to hunt for it.
This will avoid people copy & paste random KQL queries, but actually understanding how to do it by themselves.
How I built it
I've build a lab in Azure and started to play with the returned results. I started to simulate the techniques in my lab and I had a Microsoft Monitoring Agent sitting on top of every VM, that pushes all the logs to Log Analytics.
This helped me to query rapidly and understand how a much easier, how I could map specific Windows event logs to each other to create a more accurate queries for certain examples.
Everything that I've done has been documented and shared with the rest of the community.
Challenges I ran into
It took some time to include multiple images in my PDF, but I felt it was important to include as much as images, because that would help people learn it much easier.
Accomplishments that I'm proud of I've notice that a lot people had taken the time to look at my work and use it to learn from it. That's the main goal. Sharing things for free to educate others.
What I learned Understanding how you can use KQL to link different logs with each other to build a more accurate KQL queries for certain techniques.
What's next for Hunting TTPs with Azure Sentinel I'm planning to create workbooks in Azure Sentinel and share more things.
Log in or sign up for Devpost to join the conversation.