njmulsqb

Azure Defender for Cloud KQL Queries

These are the queries that I wrote and found useful to extract data using Azure Resource Graph Explorer

Security Alerts

Fetch all the active suspicious authentication activities

SecurityResources
| where type == "microsoft.security/locations/alerts" and properties.AlertDisplayName=="Suspicious authentication activity" and properties.Status=="Active"

Fetch all the active suspicious authentication activities (Only Start Time and Hostname)

njmulsqb

import sys
import subprocess
import os

parentDir = 'sourceMapsToJS'
sourceMapURL = sys.argv[1]
dirName = sourceMapURL.strip(
    'https://').strip('http://').strip('www.').replace('/', '-').replace('.', '-')
if not os.path.exists(parentDir):
    os.mkdir(parentDir)

njmulsqb

Awesome-Security-Repos

Here's a list of github repos and tools that I believe are awesome and should be promoted and used.

Source Code Analysis

1. Semgrep - Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.
2. RegexPassive - Collection of regexp pattern for security passive scanning
3. Secure Codebox - secureCodeBox (SCB) - continuous secure delivery out of the box

Wordlist and Payloads