Advanced Hunting with KQL

This chapter will cover the exciting topic of advanced hunting with Kusto Query Language (KQL). Advanced hunting is a powerful feature that enables security analysts to proactively search for and identify potential security threats within an organization’s environment. The chapter will cover key aspects of KQL, including syntax, data types, and functions, and will provide practical examples of how to use KQL to create custom queries for advanced hunting.

Additionally, the chapter provides insights into best practices for optimizing query performance and using the results to investigate and remediate security threats. By following the instructions in this chapter, security analysts can leverage KQL and advanced hunting to enhance their organization’s overall security posture.

This chapter will cover these main topics of advanced hunting with KQL:

• Understanding advanced hunting
• How to construct KQL queries to hunt
• How to create...

Understanding advanced hunting

Advanced hunting is a powerful tool for proactively hunting threats by querying up to 30 days of raw data. It allows for a comprehensive examination of events in your Microsoft 365 Defender (M365D) environment to identify potential threats and entities. With flexible access to data, you can search for both known and unknown threats.

There are two modes of advanced hunting: guided and advanced. The guided mode is suitable for those who are not familiar with KQL or prefer the ease of using a query builder. On the other hand, the advanced mode is recommended for users comfortable with creating KQL queries from scratch.

Advanced hunting enables the creation of custom detection rules by supporting queries that cover a wider range of datasets from different Microsoft Defender products, such as Microsoft Defender for Endpoint (MDE), Microsoft Defender for Office 365 (MDO), Microsoft Defender for Cloud Apps (MDA), and Microsoft Defender for Identity (MDI...

Constructing KQL queries to hunt

M365D advanced hunting has two ways of constructing queries, as mentioned in the Understanding advanced hunting section: the more basic Query in builder (guided) and the more advanced Query in editor. Let us start by looking at the builder option, as it might be just what you need to take that next step in advanced hunting:

1. In the Microsoft 365 Defender portal, go to Advanced hunting | + Create new | Query in builder:

Figure 19.1 – Creating a new Query in builder

2. In the builder, we can start by adding the information we want to look for in the different fields:

Image 19.2 – Showing the result of entering just a device name in the query builder

3. From here, we can add more data that is relevant to our case simply by adding it to the corresponding text box.
4. If we want to learn more about Kusto, in the upper right corner of the builder, there is a button...

Creating custom detections

In the KQL editor, we have a Create detection rule option, which allows us to create our detections tailored to our own environment:

Figure 19.4 – The Create detection rule option in the KQL editor

Say we want to monitor changes to sensitive administrative groups in AD. We would start by constructing a query like this:

let MonitoredGroups = datatable(GroupName:string)
[
"Account Operators",
"Administrators",
"Backup Operators",
"Domain Admins",
"Domain Controllers",
"Enterprise Admins",
];
IdentityDirectoryEvents
| where ActionType == "Group Membership changed"
| extend AdditionalFields = parse_json(AdditionalFields)
| extend FromGroup = AdditionalFields.["FROM.GROUP"]
| extend ToGroup = AdditionalFields.["TO.GROUP"]
// Extract target user or device name
| extend TargetObject =  iff( isnull(AdditionalFields.["TARGET_OBJECT...

Summary

This chapter has been all about the wonderful world of KQL and how we should and can perform advanced hunting. Through practical examples, you have learned how to create custom queries to identify potential security threats within your organization’s environment.

In addition to technical guidance, the chapter provided lessons learned, including the importance of keeping queries simple and manageable and utilizing query sharing and collaboration features. The chapter also highlighted the need for continuous monitoring and analysis of query results to proactively identify and remediate security threats. By following the guidance and best practices outlined in this chapter, security analysts can effectively leverage KQL and advanced hunting to enhance their organization’s security posture and mitigate potential risks.

As you’ve probably already figured out, this chapter was not meant to be a KQL for dummies chapter, as that would take up the bulk of...

Questions

The best way to learn KQL is to practice it, hands-on, in the Microsoft 365 Defender portal. But, you can also test yourself with these questions:

1. True or false? You should practice actively hunting in your environment, rather than relying on automation, to stay ahead of emerging threats that may not have their own detection yet:
   1. True
   2. False
2. Which is this chapter’s recommended join flavor in advanced hunting?
   1. rightsemi
   2. leftsemi
   3. innerunique
   4. fullout
3. How many days back in time can you perform advanced hunting queries?
   1. 90 days
   2. 30 days
   3. 120 days
   4. 180 days
4. Which of the following two options can advanced hunting data be categorized into?
   1. Entity data
   2. Cloud/on-prem data
   3. Automatic/manual data
   4. Event/activity data
5. Which of the following is not an option for how often custom queries can run?
   1. Continuous
   2. Every 24 hours
   3. Every 48 hours
   4. Every 12 hours

Further reading

You may refer to the following links to expand your knowledge on the topics explored in this chapter:

• Must Learn KQL by Rod Trent: https://github.com/rod-trent/MustLearnKQL
• Shuffle hints: https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/shufflequery
• Join hints: https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/joinoperator?pivots=azuredataexplorer#join-hints
• Optimizing KQL queries: https://www.youtube.com/watch?v=ceYvRuPp5D8
• Advanced hunting query best practices: https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-best-practices?view=o365-worldwide
• https://cloudbrothers.info/en/alert-sensitive-ad-groups-mdi/
• https://cloudbrothers.info/en/automated-response-c2-traffic-devices/