Had this saved in the WIP folder forever KQL for anti-forensics activities github.com/AttacktheSOC... So much can be added to this. Think 3rd party tools to aid anti-forensics, browser forensics... too much to name OMG, look at this😶updates to come! github.com/MikeHorn-git... - ThreadSky | a Reddit-style client for Bluesky

attackthesoc.com • 16 days ago

Had this saved in the WIP folder forever
KQL for anti-forensics activities

https://github.com/AttacktheSOC/Azure-SecOps/blob/main/KQL/Endpoint/AntiForensicsActivityOnEndpoint.md

So much can be added to this. Think 3rd party tools to aid anti-forensics, browser forensics... too much to name
OMG, look at this😶updates to come! https://github.com/MikeHorn-git/WAFS/tree/main

Comments