Advanced hunting for masquerading in Defender for Endpoint | Red Canary

Описание: Leverage Defender for Endpoint's Advanced Hunting console to examine raw telemetry associated with a sub-technique of Masquerading called Rename System Utilities. In part three of the "Investigating masquerading in Defender for Endpoint" series, viewers will learn how Defender for Endpoint can automatically generate Kusto queries to help them analyze telemetry and how they can generate their own Kusto queries as well. Last but not least, we'll discuss how you can stream raw telemetry out of Defender for Endpoint using the Advanced Hunting API and achieve greater defense in depth by parsing that telemetry against a wider library of detection analytics like those provided by Red Canary.

The videos in this series will cover the following topics:
Video 1: Triaging and investigating alerts in Defender for Endpoint so you know what to look for and where to find it
Video 2: Built in response actions and how to use them so you know what you can do in response to an alert or incident
Video 3: Generating Kusto queries, hunting for related activity, and leveraging the Advanced Hunting API

------

About the Red Canary Crash Course on Defender for Endpoint
In this collection of videos, you’ll learn how to simulate some of the most prevalent ATT&CK techniques in an environment protected by Microsoft Defender for Endpoint. Get ready to triage, investigate, respond, and hunt with experts from Red Canary.

Watch the entire Crash Course series: https://redcanary.com/products/mdr-fo...

--------

As your security ally, Red Canary enables your team to focus on the highest priority security issues impacting your business. By removing your need to build and manage a threat detection operation, we help you focus on running your business securely and successfully. Our Security Operations Platform delivers threat detection, hunting, and response—driven by human expert analysis and guidance—applied across your endpoints, cloud, and network security.

#RedCanary | #AtomicRedTeam | #MicrosoftDefenderForEndpoint