LETHAL FORENSICS

Release Microsoft-Analyzer-Suite v1.5.0 · LETHAL-FORENSICS/Microsoft-Analyzer-Suite [1.5.0] - 2025-05-15 Added EntraSignInLogs-Analyzer: OriginalTransferMethod EntraSignInLogs-Analyzer: OriginalTransferMethod (Stats) EntraSignInLogs-Analyzer: UserAgent-Blacklist.csv EntraSignInLo...

Microsoft-Analyzer-Suite v1.5.0 is now available! We improved among other things the Device Code Flow Abuse detections and added support for the detection of suspicious UpdateInboxRules operations.

Check out the changelog for more information. Happy M365 Threat Hunting!

github.com/LETHAL-FOREN...

15.05.2025 07:15 — 👍 0    🔁 0    💬 0    📌 0

GitHub - LETHAL-FORENSICS/Microsoft-Analyzer-Suite: A collection of PowerShell scripts for analyzing data from Microsoft 365 and Microsoft Entra ID A collection of PowerShell scripts for analyzing data from Microsoft 365 and Microsoft Entra ID - LETHAL-FORENSICS/Microsoft-Analyzer-Suite

Quick update on some blacklists of the Microsoft-Analyzer-Suite: ApplicationPermission-Blacklist.csv, DelegatedPermission-Blacklist.csv, and UserAgent-Blacklist.csv. The update of the UserAgent-Blacklist covers the new M365 Account Takeover Attacks using HTTP Client Tools. github.com/LETHAL-FOREN...

25.03.2025 07:41 — 👍 0    🔁 0    💬 0    📌 0

#100DaysOfKQL

Day 75 - Activity From Suspicious User-Agent

I think I have one last after this piggybacking on @lethalforensics.bsky.social / @Evild3ad79 awesome CSV blacklists then I'm done.

Remember: if it can be done in the UAL, it can be done in Sentinel or MCAS.

github.com/SecurityAura...

18.03.2025 02:09 — 👍 2    🔁 1    💬 0    📌 0

All the credits go to @lethalforensics.bsky.social for providing the list I'm using in a handy CSV format!

Go check out their amazing Microsoft-Analyzer-Suite on GitHub!

github.com/LETHAL-FOREN...

17.03.2025 12:12 — 👍 2    🔁 1    💬 0    📌 0

#100DaysOfKQL

Day 73 - Activity From Known Abused Application in Entra ID

All credits for the blacklist used (CSV <3) goes to @LETHAL_DFIR / @evild3ad79 (on Twitter)

I once again invite you to explore the amazing tool that is Microsoft-Analyzer-Suite on Github.

github.com/SecurityAura...

16.03.2025 01:51 — 👍 1    🔁 1    💬 0    📌 1

Week 09 – 2025 Abdulrehman AliMustang Panda APT Adversary Simulation Akash Patel Running Plaso/Log2Timeline on Windows Mastering Timeline Analysis: A Practical Guide for Digital Forensics: (Log2timeline) Forensic…

Week 09 - 2025 #DFIR
thisweekin4n6.com/2025/03/02/w...

02.03.2025 12:03 — 👍 7    🔁 5    💬 0    📌 0

Week 11 - 2025 #DFIR

thisweekin4n6.com/2025/03/16/w...

16.03.2025 12:09 — 👍 1    🔁 2    💬 0    📌 0

#100DaysOfKQL

Day 74 - Consent to Application With Dangerous Delegated Permissions

Another one that uses a very helpful blacklist (CSV <3) from @LETHAL_DFIR / @Evild3ad79 (on Twitter).

Anything that can be found in UAL can be found in Sentinel logging.

github.com/SecurityAura...

17.03.2025 01:45 — 👍 1    🔁 1    💬 0    📌 1

#100DaysOfKQL

Day 72 - New Service Principal Added Following Consent to Application

User being able to consent to apps and creating Service Principals is bad mmmmkay? You don't want to have TAs add eM Client, PERFECTDATA, rclone, etc. through BECs.

github.com/SecurityAura...

15.03.2025 00:54 — 👍 4    🔁 1    💬 0    📌 0

Windows Memory Snapshot w/ MAGNET DumpIt (incl. Pagefile) + Triage Collection

Automated Processing of 'ProcessesAndModules-Extended_Info.tsv' (MAGNET Response)

ProcessesAndModules-Extended_Info.ps1' → MemProcFS-Analyzer

Just released Collect-MemoryDump v1.1.0 with various improvements. Triage Collection w/ MAGNET Response (Optional), Microsoft Protection Logs (MPLogs), Automated Processing of 'ProcessesAndModules-Extended_Info.tsv', and much more. #MemoryAnalysis #MemoryForensics #DFIR
github.com/LETHAL-FOREN...

17.03.2025 06:04 — 👍 1    🔁 1    💬 0    📌 0

Release Microsoft-Analyzer-Suite v1.4.0 · LETHAL-FORENSICS/Microsoft-Analyzer-Suite [1.4.0] - 2025-02-24 Added UAL-Analyzer: Detection of suspicious Inbox Rules via RegEx (incl. Conditional Formatting) UAL-Analyzer: MoveToFolder-Blacklist.csv UAL-Analyzer: UniqueTokenId and Issue...

Happy to announce the release of Microsoft-Analyzer-Suite v1.4.0. It is our first company-branded release! 🚀

Check out the changelog for more information and don't forget to follow LETHAL FORENSICS. Happy M365 Threat Hunting! #M365 #BEC #CloudIncidentResponse #DFIR

github.com/LETHAL-FOREN...

17.03.2025 05:58 — 👍 1    🔁 0    💬 0    📌 0