Detection engineering, threat hunting, malware analysis. One defender bit at a time.
Join for free →
Joined September 2015
- Tweets770
- Following345
- Followers2.1K
- Likes1.1K
Ayush Anand retweeted
My lab runs MDE and Elastic side by side, so I gave Claude Code a skill for each:
- mde-hunt: KQL on MDE + my ADX archive
- elastic-hunt: ES|QL on Elastic
One question, both stacks searched, one table back.
Most SOCs run one of these. Whichever is yours, want the skill? I can share it on GitHub.
ALT Lab report compares remote-access tools using MDE and Elastic over 120 days, listing commands, hosts, and detected tools. Results show discrepancies.
My lab runs MDE and Elastic side by side, so I gave Claude Code a skill for each:
- mde-hunt: KQL on MDE + my ADX archive
- elastic-hunt: ES|QL on Elastic
One question, both stacks searched, one table back.
Most SOCs run one of these. Whichever is yours, want the skill? I can share it on GitHub.
ALT Lab report compares remote-access tools using MDE and Elastic over 120 days, listing commands, hosts, and detected tools. Results show discrepancies.
Ayush Anand retweeted
Got tired of pasting KQL into the Defender portal, so I built an mde-hunt skill with Claude Code.
- I ask in plain English
- Claude writes the KQL
- a Python script runs it on live MDE (last 30 days) or my ADX archive (older)
First test: remote-access tools over 120 days. 3 hosts, one running AnyDesk renamed Invoice_Viewer.exe.
Interested? I can share it on GitHub.
Got tired of pasting KQL into the Defender portal, so I built an mde-hunt skill with Claude Code.
- I ask in plain English
- Claude writes the KQL
- a Python script runs it on live MDE (last 30 days) or my ADX archive (older)
First test: remote-access tools over 120 days. 3 hosts, one running AnyDesk renamed Invoice_Viewer.exe.
Interested? I can share it on GitHub.
Details about: MDE data past 30 days
xitter.cf/Securityinbits/status/…
Ayush Anand retweeted
I ran my detection lab in VMware on my laptop for a long time.
But I wanted Proxmox on bare metal, plus room for real monitoring. So I moved the lab to a Beelink SER10 MAX:
- 12 cores / 24 threads, 64 GB, 1 TB
- 11 VMs: DC, workstations, servers, Kali, router
- Elastic, MDE, Suricata and Velociraptor deployed
One of those VMs runs Claude, and it controls the rest of the lab.
ALT Beelink SER10 MAX mini PC on my desk
ALT Proxmox summary: VMs, CPU, memory, storage gauges
Ayush Anand retweeted
Two ScreenConnect implants on one host, 9 minutes apart. A signed cloud client to get in, then a self-hosted one on port 8041, pushed through the first, with the tray icon and banner turned off.
Ayush Anand (@Securityinbits) detonated it in a lab:
newsletter.securityinbits.co…
I ran my detection lab in VMware on my laptop for a long time.
But I wanted Proxmox on bare metal, plus room for real monitoring. So I moved the lab to a Beelink SER10 MAX:
- 12 cores / 24 threads, 64 GB, 1 TB
- 11 VMs: DC, workstations, servers, Kali, router
- Elastic, MDE, Suricata and Velociraptor deployed
One of those VMs runs Claude, and it controls the rest of the lab.
ALT Beelink SER10 MAX mini PC on my desk
ALT Proxmox summary: VMs, CPU, memory, storage gauges
Ayush Anand retweeted
AnyDesk is in 32 ransomware groups' toolsets in the Ransomware Tool Matrix, more than any other RMM. It's signed and legit, so the alert reads "probably IT" and gets closed.
Ayush Anand (@Securityinbits) ran it in a lab the way crews do:
newsletter.securityinbits.co…
Ayush Anand retweeted
Three network scanners show up across 45+ ransomware groups.
In my lab the scan had one shape: one process, 254 internal IPs, 5 ports, under 30 seconds.
Full walkthrough in Defender KQL + Elastic ES|QL, including how to tell an admin from an operator:
youtu.be/Iun8zko6EZk
There are plenty of LOLBin lists, but only one page indexes all of them.
lolol.farm indexes the community's Living-Off-the-Land research in one searchable page:
- 31 projects, 21 tags, 8 platforms
- LOLBAS, GTFOBins, LOLDrivers, LoFP and more
- filter by platform or focus area
Built by @br0k3ns0und. Bookmark it for your next triage.
lolol.farm/
Ayush Anand retweeted
INC Ransom dropped a renamed Vicarius vRx agent at C:\Program Files\7-Zip\HealthUpdater.exe and pointed a scheduled task at it.
vRx is legit patch management that can run PowerShell, Bash and Batch on managed hosts. That's remote access.
h/t Harlan Carvey @HuntressLabs
MDE Advanced Hunting only looks back 30 days.
For my lab I wanted to keep my own copy, so:
- Streaming API -> Azure Storage
- LightIngest -> free ADX cluster
- same KQL, now 162 days deep (587k events)
How do you keep MDE data past 30 days? Sentinel, data lake, ADX, or something better?
I've been working through @ZephrFish's Malwareless Adversary Emulation course (ZSEC) for a few months now. 7 modules in and it's excellent.
I've always wanted to learn the offensive side to be a better defender: see an attack from the other end, understand it start to finish, then defend against it properly.
Thanks for building this one, Andy.
lms.zsec.red/
Ayush Anand retweeted
If you don't have a strategy for handling unsanctioned RMM in your environment you're behind the 8-ball. Here's what I would do to start if you're doing nothing about this yet.
1. Download the full list of RMMs from LOLRMM lolrmm.io/api/rmm_tools.json
2. Remove the 1 or 2 you actually use
3. Upload the rest to your EDR and block them by hash
It's better than nothing to start out. Then, if you want to get more sophisticated, create a scheduled task in your favorite AI agent to monitor for changes. Then download the updates and block them in your EDR.
This is literally free and costs you nothing but a few tokens and some time.
Please do this!!
cloud.google.com/blog/topics…
Three network scanners show up across 45+ ransomware groups.
In my lab the scan had one shape: one process, 254 internal IPs, 5 ports, under 30 seconds.
Full walkthrough in Defender KQL + Elastic ES|QL, including how to tell an admin from an operator:
youtu.be/Iun8zko6EZk
Your ScreenConnect child-process rule keys on cmd.exe and powershell.exe. Mine did too. The operator never spawned either.
A real operator joined 4 min after install. What spawned:
ScreenConnect.ClientService.exe -> ScreenConnect.WindowsBackstageShell.exe
Backstage is the product's hidden shell. No desktop window, no cmd, no powershell.
Second tell: an MSI staged under C:\Windows\SystemTemp\ScreenConnect\\Temp\ and run via RunFile.
Both anchors and the queries are in the Article.
