Investigating HVNC Attacks
HVNC Attacks allow attackers to work comfortably on their victims’ machines. Let’s investigate such attacks.
Read moreTag Archives: Microsoft Threat Protection
MDE Hunting 101
People that start working with Defender for Endpoint (MDE) often ask the question “where should I start when I see an alert in MDE?”. There is lot of valuable information available in the portal to help judge if an alert is a real incident or a false positive. Additionally, you can query the raw telemetry via KQL. But there is still lot of room for interpretation. So, what should you do to get started? And what is even more important: how do I keep the overview?
Read moregundog
Gundog provides you powershell based guided hunting for Microsoft 365 Defender.
Read moreThoughts on identity
The big list of modern cloud identity protection.
Read moreThreat Hunting with MTP: The Sixth Sense
Let’s assume you just learned about this new vulnerability in in VLC. Attackers can exploit it by sending .mkv files to your users via Email. Pretty easy – pretty dangerous.
Read moreGo, hack yourself! – Ignite 2019 Edition
In spring 2019 I have written a post on how you can hack yourself to better understand the Microsoft Tools that help you defend modern attacks. Since then, several month and one MS Ignite have been past, in other words: things have changed.
Read more
emptydc.com 