Michalis Michalos

KQL-threat-hunting-queries. A repository of KQL queries focused on threat hunting and threat detecting for Microsoft Sentinel & Microsoft XDR (Former Microsoft 365 Defender).

MDE-DFIR-Resources. A curated list of resources for DFIR through Microsoft Defender for Endpoint leveraging kusto queries, powershell scripts, tools such as KAPE and THOR Cloud and more.

Hunting-Lists. A repository of curated lists with elements such as IoCs to use for threat hunting & detection queries.

cyb3rmik3. GitHub landing page repo

DFIR-Notes. Cheat sheet on memory forensics using various tools such as volatility.

presentations. A repository for notes and references of presentations.

MaltegoCE. Notes and comments regarding Maltego CE (community edition) and relevant available transformations for free.

Hunting-Queries-Detection-Rules. KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

awesome-detection-engineer. Online resources related to Detection Engineering. Detection rules, detection logic, attack samples, detection tests and emulation tools, logging configuration and best practices, event log references, resources, labs, data manipulation online tools, blogs, newsletters, good reads, books, trainings, podcasts, videos and twitter/x accounts.

defender-xdr-daily-brief-in-teams. Automated daily Microsoft Defender XDR security briefing delivered to Microsoft Teams using Azure Logic Apps, KQL Advanced Hunting, and Microsoft Graph.

TheBarn. A description of DFIR lab setup through experience/notes/courses

Open-Source-Threat-Intel-Feeds. This repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. Contains multiple types such as IP, URL, CVE and Hash.

bsidesath2021. References used to prepare and deliver presentation "Cyber resilience: Awareness is not enough" at Security BSides Athens 2021.

PGPKey. Interested in sending something confidential? You may drop me a line at michalis -at- michalos.net using this PGP key or encrypt any file and forward it.

mdo-dailyhealthchecks. A practical guide for running daily health checks in Microsoft Defender for Office 365 to maintain security posture and ensure protection effectiveness.