CarissaDurko

DeviceFileEvents
| where FileName has_any("password", "credentials", "logins", "log in")
| where not(FileName endswith ".svg" or FileName endswith ".gif" or FileName endswith ".css" or FileName endswith ".png" or FileName endswith ".js" or FileName contains "Keeper" or FileName endswith ".dll" or FileName endswith ".sh" or FileName contains "reprompt"

CarissaDurko

UrlClickEvents
| where AccountUPN == "user@domain.com"
| project TimeStamp, Url, IsClickedThrough, UrlChain, Workload, DetectionMethods, ThreatTypes

CarissaDurko

IdentityLogonEvents
| where TimeStamp > ago(30d)
| where ActionType == "LogonFailed"
| where AccountDomain == "enterdomainhere.com"
| where FailureReason contains ("Locked")

CarissaDurko

@echo off
REM -----------------------------------------------
REM Uninstall-Tenable.bat
REM Stops the Tenable/Nessus service and uninstalls the MSI
REM -----------------------------------------------

REM 1) Stop the Tenable/Nessus service (adjust the name if needed)
set SERVICE="Tenable Nessus Agent"

REM 2) Define GUIDS if needed for hardcoding

CarissaDurko

$msiProductCodes = @(
    '{GUID}'
)

$paths = @(
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall",
    "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall"
)

foreach ($path in $paths) {

CarissaDurko

# Single MSI GUID to remove
$guid = '{GUID}'

# 1) Stop any Tenable/Nessus services so the MSI can uninstall cleanly
#    Adjust the service names as needed for your environment.
Get-Service -DisplayName '*Tenable*','*Nessus*' -ErrorAction SilentlyContinue |
    Stop-Service -Force -ErrorAction SilentlyContinue

# 2) Run the silent uninstall
Write-Output "Starting uninstall of $guid..."

CarissaDurko

SELECT url,title,datetime(last_visit_time/ 1000000 + (strftime('%s','1601-01-01')),'unipoch','localtime')
FROM urls
ORDER BY last_visit_time DESC

CarissaDurko

AADSignInEventsBeta
| where ErrorCode == 50053
| where TimeStamp > ago(30d)
| where AccountUPN has "enterdomainhere.com"
| project AccountDisplayName, AccountUPN, AccountObjectId, DeviceName, UserAgent, ClientAppUsed, Browser, Country