Detection engineering, threat hunting, malware analysis. One defender bit at a time.
Join for free →
- Tweets 782
- Following 348
- Followers 2,130
- Likes 1,127
Pinned Tweet
Every KQL query you practice on is deleted after 30 days.
This free cluster keeps it: 8 Defender tables from a real AnyDesk lab intrusion, one paste, row counts to prove it loaded.
5
18
3,033
Ayush Anand retweeted
I'm doing the thing until I can convince people that focusing on whether or not AI is being used in intrusions is a waste of time. What will be figured out is that virtually every cyber threat is using AI, because AI these days is as generally available as the internet. Imagine back when the requirement was "threats using the internet." AI isn't an emerging threat anymore. It's the norm.
6
10
55
4,609
Ayush Anand retweeted
Working on a YouTube video, out this Saturday: my Claude Code hunting workflow on an RMM abuse case.
Two validly signed ScreenConnect clients on one lab host. One got the attacker in. The other is the one they kept.
Claude Code runs the first pass in KQL and ES|QL. I validate every row.
piped.video/@Securityinbits
1
2
3
348
Ayush Anand retweeted
You don't need to ingest a CSV to test a KQL detection on it.
Give the CSV the real table's name with one let line:
let DeviceProcessEvents = externaldata(...)
Your query runs on the file unchanged. Read-only, nothing loaded.
I ran my 6 AnyDesk hunt queries on a public lab bundle this way. All 6 returned rows.
ALT KQL externaldata query on case-05 CSV returns rows
Every KQL query you practice on is deleted after 30 days.
This free cluster keeps it: 8 Defender tables from a real AnyDesk lab intrusion, one paste, row counts to prove it loaded.
10
33
1,965
Ayush Anand retweeted
Every KQL query you practice on is deleted after 30 days.
This free cluster keeps it: 8 Defender tables from a real AnyDesk lab intrusion, one paste, row counts to prove it loaded.
5
18
3,033
Ayush Anand retweeted
I have observed more ARTEX servers than Cobalt Strike and all other C2 frameworks combined.
I have also seen new/not publicly detected AI-generated C2 frameworks already being used by threat actors.
Almost 2,200 servers are running ARTEX, and that only counts those with exposed default admin panels.
There are many more instances where the admin panel is hidden, disabled or modified.
Made with AI
10
36
235
16,288
Ayush Anand retweeted
Microsoft gives anyone with a Microsoft account a free Azure Data Explorer cluster.
No subscription, no credit card, full KQL. Mine took under 2 minutes to create.
aka.ms/kustofree
ALT Azure Data Explorer free cluster create dialog
1
7
38
2,452
An attacker installed ScreenConnect, then hid it from Programs and Features with one registry value.
SystemComponent = 1 on its Uninstall key.
- Service: running
- Programs and Features: no ScreenConnect
Sweep both HKLM Uninstall hives (incl. WOW6432Node) for SystemComponent = 1 and read the DisplayName. Installers hide sub-components this way too. A hidden RMM client is not one of them.
ALT A code snippet shows a PowerShell command to install ScreenConnect silently and hide it from the Programs and Features list.
ALT The Registry Editor displays entries related to ScreenConnect, including its uninstall path and hidden status via SystemComponent = 1.
6
19
1,170
My lab runs MDE and Elastic side by side, so I gave Claude Code a skill for each:
- mde-hunt: KQL on MDE + my ADX archive
- elastic-hunt: ES|QL on Elastic
One question, both stacks searched, one table back.
Most SOCs run one of these. Whichever is yours, want the skill? I can share it on GitHub.
ALT Lab report compares remote-access tools using MDE and Elastic over 120 days, listing commands, hosts, and detected tools. Results show discrepancies.
4
1
19
871
Got tired of pasting KQL into the Defender portal, so I built an mde-hunt skill with Claude Code.
- I ask in plain English
- Claude writes the KQL
- a Python script runs it on live MDE (last 30 days) or my ADX archive (older)
First test: remote-access tools over 120 days. 3 hosts, one running AnyDesk renamed Invoice_Viewer.exe.
Interested? I can share it on GitHub.
10
9
73
4,167
Details about: MDE data past 30 days
MDE Advanced Hunting only looks back 30 days.
For my lab I wanted to keep my own copy, so:
- Streaming API -> Azure Storage
- LightIngest -> free ADX cluster
- same KQL, now 162 days deep (587k events)
How do you keep MDE data past 30 days? Sentinel, data lake, ADX, or something better?
1
149
Ayush Anand retweeted
Two ScreenConnect implants on one host, 9 minutes apart. A signed cloud client to get in, then a self-hosted one on port 8041, pushed through the first, with the tray icon and banner turned off.
Ayush Anand (@Securityinbits) detonated it in a lab:
newsletter.securityinbits.co…
1
4
10
631
I ran my detection lab in VMware on my laptop for a long time.
But I wanted Proxmox on bare metal, plus room for real monitoring. So I moved the lab to a Beelink SER10 MAX:
- 12 cores / 24 threads, 64 GB, 1 TB
- 11 VMs: DC, workstations, servers, Kali, router
- Elastic, MDE, Suricata and Velociraptor deployed
One of those VMs runs Claude, and it controls the rest of the lab.
ALT Beelink SER10 MAX mini PC on my desk
ALT Proxmox summary: VMs, CPU, memory, storage gauges
1
2
595
Ayush Anand retweeted
AnyDesk is in 32 ransomware groups' toolsets in the Ransomware Tool Matrix, more than any other RMM. It's signed and legit, so the alert reads "probably IT" and gets closed.
Ayush Anand (@Securityinbits) ran it in a lab the way crews do:
newsletter.securityinbits.co…
2
11
41
2,290
Ayush Anand retweeted
Three network scanners show up across 45+ ransomware groups.
In my lab the scan had one shape: one process, 254 internal IPs, 5 ports, under 30 seconds.
Full walkthrough in Defender KQL + Elastic ES|QL, including how to tell an admin from an operator:
piped.video/Iun8zko6EZk
1
3
10
763
There are plenty of LOLBin lists, but only one page indexes all of them.
lolol.farm indexes the community's Living-Off-the-Land research in one searchable page:
- 31 projects, 21 tags, 8 platforms
- LOLBAS, GTFOBins, LOLDrivers, LoFP and more
- filter by platform or focus area
Built by @br0k3ns0und. Bookmark it for your next triage.
lolol.farm/
2
56
198
10,341