DOCSEARCHbyAlgolia
Submit Docs

Microsoft Sentinel Security Operations (SecOps)

repository·master·Indexed 42 days ago

https://github.com/eshlomo1/microsoft-sentinel-secops

A collection of security operations resources for Microsoft Sentinel, including KQL queries and PowerShell scripts for threat hunting and detection. Features IOCs for SolarWinds and ProxyLOGON, monitoring for Zerologon (CVE-2020-1472), VirusTotal dorks for leaked NVIDIA certificates, and the SOC Malware Investigator agent for triaging Microsoft Defender incidents.

Tokens
8K
Snippets
12
Records
33
Agent score
54%

What's inside Microsoft Sentinel SecOps

  3. Use SolarWinds Hack IOCs and KQL queries

    master

    This repository provides Indicators of Compromise (IOCs) and KQL queries related to the SolarWinds attack.

    Indicators of Compromise (IOCs)

    The repository contains the following types of indicators:

    • IP addresses
    • Domains
    • Hashes

    KQL Queries

    You can use the provided KQL queries for hunting and detection across the following platforms:

    • Azure Sentinel
    • Microsoft Defender for Endpoint
    • Microsoft 365 Defender (using Advanced Hunting)

  5. Optimize KQL queries for performance and budget

    master

    When investigating, adhere to these query performance rules to minimize resource consumption and latency:

    • Time Window: Start with the incident activity window (first activity time to last activity time), padded by ~1 hour. Default to 24 hours if the window is unknown.
    • Early Filtering: Always filter on TimeGenerated and a concrete identifier (e.g., IncidentId, DeviceName, SHA256, IP) as early as possible in the query.
    • Column Selection: Use project to limit returned columns.
    • Result Capping: Use take, top, or summarize to cap raw event pulls (e.g., take 50).
    • Table Limits: Do not query more than three supporting telemetry tables unless a lead justifies further expansion.

  7. Prepare for Incident Response (IR) using the Sentinel SOC framework

    master

    To prepare for incident response based on the Azure Sentinel SOC framework, you must establish the following foundational elements:

    • Asset Management: Maintain a list of ALL assets.
    • Baselines: Establish known good states for systems and networks.
    • Communication: Define a clear Communication Plan.
    • Event Scoping: Identify which Security Events are relevant and define their Thresholds.
    • Access Control: Document how to access Security Tools.
    • Automation: Create Playbooks for automated response.
    • Readiness: Plan regular exercises to test response capabilities.

  8. Execute the SOC Malware Investigator Workflow

    master

    The SOC Malware Investigator is a structured workflow designed to triage and investigate Microsoft Defender incidents. The workflow follows a strict sequence of responsibilities to ensure an auditable and evidence-based investigation.

    Core Workflow Steps

    1. Incident Triage: Accept a Microsoft Defender incident ID, resolve the correct Sentinel workspace, and retrieve all related alerts, entities, evidence, and investigation states. Use Sentinel data for triage and Defender only for response or missing critical fields.
    2. Malware & Alert Extraction: Identify malware names, families, file paths, and hash values (SHA256 preferred). Capture detection sources (e.g., AMSI, EDR, AV) and alert severity.
    3. Context Collection: Retrieve device context (FQDN, OS version, onboarding state, risk score) and user context (UPN, SID, logon type, privilege level).
    4. Advanced Hunting (Playbooks): Run targeted queries for specific threats:
      • Persistence: Check DeviceRegistryEvents, DeviceProcessEvents (scheduled tasks), and DeviceFileEvents (startup folders).
      • Lateral Movement: Check DeviceLogonEvents or IdentityLogonEvents for account activity across hosts.
      • C2/Beaconing: Check DeviceNetworkEvents for periodic connections or rare destinations.
      • Execution Chain: Reconstruct parent/child process trees via DeviceProcessEvents.
    5. Verdict Determination: Classify as True Positive, False Positive, or Benign True Positive with a confidence level (High/Medium/Low).
    6. Output Generation: Produce a structured report including a one-line verdict, an ASCII findings table, an analyst summary, and an evidence appendix (chain-of-custody).
    7. Write-Back & Response: Add comments/tags to the incident and, if permitted, execute endpoint response actions.

  9. Execute Endpoint Response Actions

    master

    If an investigation justifies response and the necessary permissions/tokens are present, the following actions can be requested for an MDE device:

    • isolate: Isolate the device from the network.
    • full AV scan: Trigger a full antivirus scan.
    • restrict app execution: Restrict application execution on the device.

    Requirements for Response

    • Device ID: An MDE device ID must be present in the incident.
    • Onboarding: The device must be confirmed as supported and onboarded.
    • Justification: Actions must be justified by the extracted evidence.
    • Permissions: The required token/role for the specific action must be verified.
    • Selection: If multiple endpoints are present, the analyst must select exactly one machine to act upon.

    Important: Isolation is reversible via a release action. Always report the returned machine action ID or request ID as evidence of success.

  10. Install required modules and website content

    master

    Before running the demos, ensure the following prerequisite modules and content are placed in the correct locations:

    1. Modules: Copy the Get-VMIP and WebVM modules (found in the \PreReq folder) to the PowerShell module path ($env:PSModulePath).
    2. Website Content: Copy the \PreReq\BakeryWebsite folder to the C: drive of the WebServers.

  11. Perform Advanced Hunting Playbooks

    master

    When core triage confirms a lead, use these specific hunting patterns to investigate deeper into the incident. Each playbook should be scoped to the specific host, account, or time window identified during triage.

    PlaybookTarget Data/TablesFocus Areas
    Persistence CheckDeviceRegistryEvents, DeviceProcessEvents, DeviceFileEventsRun keys, services, Image File Execution Options, scheduled tasks, startup-folder writes.
    Lateral Movement CheckDeviceLogonEvents, IdentityLogonEventsAccount activity across hosts, remote-service creation, PsExec/WMI/WinRM patterns.
    C2 / Beaconing CheckDeviceNetworkEventsRemoteIP/RemoteUrl patterns, periodic connection intervals, rare destinations, ThreatIntelligenceIndicator matches.
    Execution-chain CheckDeviceProcessEventsParent/child process tree reconstruction (parent, command line, initiating account).

    Note: Report each playbook result as either "no supporting evidence found" or the concrete events that support escalation.

  12. Execute Detection during an incident

    master

    During the detection phase of an incident, focus on the following activities to identify and understand the scope of an attack:

    • Information Gathering: Collect relevant data from across the environment.
    • Data Analysis: Analyze gathered data to identify anomalies.
    • Detection Engineering: Build detections to catch similar activity.
    • Analysis Depth: Determine the Root Cause Analysis, the depth and breadth of the attack, and the specific techniques used.
    • Indicators: Identify both Indicators of Compromise (IoC) and Indicators of Attack (IoA).