inodee

The baseline query

`4662_directory_sync_events`

| eval SubjectUserName=lower(trim(SubjectUserName))  ``` Normalize value ```

| bin _time span=1d AS last_day_seen  ``` 1d unit ```

``` Ingest the current baseline ```
| inputlookup append=1 dcsync_baseline.csv

inodee

// This is a prototype, do not run against long periods before tuning 
let SpamHausDROP = externaldata(cidr: string) [@"https://www.spamhaus.org/drop/drop_v4.json"] with (format="json", ignoreFirstRecord=False);
DeviceNetworkEvents
| where LocalIPType == 'Private' and RemoteIPType == 'Public'and ActionType == 'ConnectionSuccess'
| where not(InitiatingProcessFileName has_any ('chrome.exe','firefox.exe','msedge.exe','brave.exe'))
| evaluate ipv4_lookup(SpamHausDROP, RemoteIP, cidr, return_unmatched = false)
| where isnotempty(cidr)
| summarize InitiatingProcessCommandLine=make_set(InitiatingProcessCommandLine), RemoteUrl=make_set(RemoteUrl), LastSeen=max(Timestamp) by RemoteIP

inodee

index=_internal sourcetype=scheduler search_type="scheduled" scheduled_time=* savedsearch_name=*rule scheduler rule earliest=-24h@h latest=@h

| eventstats count by savedsearch_name
| where count>=23

| eval H=strftime(scheduled_time, "%-H")
| eval M=strftime(scheduled_time, "%-M")

| chart limit=24 count over M by H
| table M 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23

inodee

index=_audit sourcetype=audittrail TERM(create) operation=create action=indexes_edit
| rex field=_raw "object=\"*(?<object>[^\"]+)"
| stats values(user) AS user, min(_time) AS _time by object
| eval reason="There is a new index in town! New index: ".object.". Please evaluate if that needs to be in scope for any existing search or use case (ex.: IOC Scan Framework)."

inodee

index=_internal sourcetype=scheduler savedsearch_name="* - Rule" scheduled_time=*
| fields dispatch_time scheduled_time 

``` Pick the data point you want to use (hint: consider a dashboard dropdown) ```
| eval _time=scheduled_time

| eval H=strftime(_time, "%k"), M=strftime(_time, "%M")

``` Use a chart/viz or simply enable 'Heatmap' overlay from Format options ```
| chart useother=0 count over M by H

inodee

index=YOUR_ENDPOINT_TELEMETRY_INDEX msdt ChildPath=*msdt.exe ``` make sure you use msdt as a bloomfilter to speedup the query and filter on msdt.exe as child (primarily)```

``` Highlight interesting traces ```
| eval office_parent=if(match(ParentPath, "(?i)(winword|excel|powerpnt|outlook)\.exe"), 1, 0)
| eval cmdshell_parent=if(match(ParentPath, "(?i)\S+\\\(cmd|pwsh|sqlps|sqltoolsps|powershell|powershell_ise)\.exe"), 1, 0)
| eval uri_scheme=if(match(command, "(?i)ms-msdt:/"), 1, 0)
| eval traversal=if(match(command, "(?i)\.\.\S\.\."), 1, 0)
| eval exe_param=if(match(replace(command, "(?i)msdt\.exe", ""), "(?i)\S+\.exe"), 1, 0)

``` Normalize the parent path```

inodee

```<option name="charting.seriesColors">[#67001f,#b2182b,#d6604d,#f4a582,#fddbc7,#e0e0e0,#bababa,#878787,#4d4d4d]</option>```