Identity

KQL query: Identify brute force attacks or invalid credential usage attempts

April 19, 2024 by Applied KQL

Identifying brute force attack targets or invalid credential usage - Copilot Designer — Identifying brute force attack targets or invalid credential usage – Copilot Designer

List user accounts with repeated logon failures to identify possible targets of brute force attacks or invalid credential usage attempts.

[Read more…]

KQL Query: Logon Failure Reason analysis

April 17, 2024 by Applied KQL

Artistic interpretation of a KQL query which returns a grouping of Logon Failure reasons by Application - Copilot Designer — Artistic interpretation of a KQL query which returns a grouping of Logon Failure reasons by Application – Copilot Designer

Investigate which Microsoft applications are experiencing the most logon failures and the reasons behind those failures.

[Read more…]

KQL query: Get Active Directory failed logons

April 14, 2024 by Applied KQL

Active Directory failed logons – Copilot Designer

List failed logons logged in Active Directory with additional attributes for investigation and troubleshooting. Comparable to Windows security log event ID 4625.

[Read more…]

KQL query: Get Active Directory sensitive group membership changes

April 13, 2024 by Applied KQL

An artistic interpretation of the query results that would be returned from a KQL query that lists sensitive group membership changes, including who was added or removed to what group, and who made the change. Digital art. Created by Copilot Designer. — Artistic interpretation of a KQL query returning sensitive group membership changes – Copilot Designer.

List sensitive group membership changes, including who was added or removed to what group, and who made the change.

[Read more…]

KQL query: Get Active Directory group membership changes

April 13, 2024 by Applied KQL

A digital art image of an artistic interpretation of a KQL query result which listed Active Directory group membership changes. Generated by Copilot Designer. — Active Directory group membership changes. Generated by Copilot Designer.

Get users and the groups they were added or removed from, including who made the change.

[Read more…]