✳flâneur — a map of the web's best reading

Find lateral movement paths using KQL Graph semantics - Cloudbrothers

cloudbrothers.info · 4,087 words · saved by 1 readers

Graph databases offer great insights into existing data, that relational databases cannot or can only solve with more resources. Tools that leverage this ability to find lateral movement paths (edges) between user, computers and other entities (nodes) like Bloodhound offer an amazing data source for red teams and blue teams alike. But still the use in the defender world is yet limited. This might be because blue teams don’t like to use red teamers toolkit (really?) or companies often don’t see the immediate value of such additional data sources. But what we as defenders like to use is SIEM systems, EDR agents and other sensors that give us great, near real time insights into the companies IT landscape. Microsoft made a lot of lateral movement paths easy consumable with Microsoft Security Exposure Management and Defender for Cloud attack paths without the need of “additional” software for all customers that already use Microsoft Defender XDR. Other companies like the team at FalconForce

Find lateral movement paths using KQL Graph semantics Fabian Bader included in Advanced Hunting Entra ID KQL Security Sentinel Defender for Endpoint Defender XDR XSPM Kraph 2024-07-08 3104 words 15 minutes Contents Graph databases offer great insights into existing data, that relational databases cannot or can only solve with more resources. Tools that leverage this ability to find lateral movement paths (edges) between user, computers and other entities (nodes) like Bloodhound offer an amazing data source for red teams and blue teams alike. But still the use in the defender world is yet limit

Explore this link on the map →

related reading