by @attackthesoc.com
A feed to pull in everything Microsoft KQL related (v.01) Feed config: https://github.com/AttacktheSOC/bluesky-files/blob/main/KQL-feed.json Microsoft Defender for Endpoint Sentinel Advanced Hunting
RootGuard Security Blocking device code flow? Check who’s using it first: SigninLogs | where TimeGenerated > ago(30d) | where AuthenticationProtocol =~ "deviceCode" or OriginalTransferMethod =~ "deviceCodeFlow" | summarize count() by UserPrincipalName, AppDisplayName
Rod Trent Still relevant. It's been a while since I've run numbers but Must Learn KQL stats are still impressive. mustlearnkql.com #MustLearnKQL