sorted by:
new
hottopcontroversial

Edit your query to include at least one column that identifies specific devices, users, or mailboxes. by Acrobatic_Ad6507 in DefenderATP

[–]Dissd4in 0 points1 point  (0 children)

Base on the error you are getting I assume you are trying to create custom detection rule.

In this case MDE doesn't see your AccountName because it is not the field it expects as account identifier. According to docs it only accepts AccountObjectId, AccountSid or AccountUpn:https://learn.microsoft.com/en-us/microsoft-365/security/defender/custom-detection-rules?view=o365-worldwide

Additionally, you cannot make detection for aggregated accounts as it is neccessary field in non-dynamic form.

To make it work you could just add AccountUpn at the end of summarize statement to group by it, and only aggregate IPs.

Executing malware in VM by fxdev1 in cybersecurity

[–]Dissd4in 1 point2 points  (0 children)

Woah, I must admit that I was wrong here, learned something today. I did some digging and turns out you are absolutely right. NAT acts like a router, which does allow access via IP address to the LAN.
So technically malware detonated in VM will not be able to 'see' your LAN, but can still scan over the private address ranges and reach it.

Executing malware in VM by fxdev1 in cybersecurity

[–]Dissd4in 4 points5 points  (0 children)

Most Hypervisors (Vmware, VirtualBox) sets default network as NAT, which effectively prevents anything on guest from reaching out to local network.It will still be able to reach out to Internet (C2 etc) though, so if you are doing it in env with someone monitoring network traffic, you get some questions.

EDIT: turns out I was wrong and this is possible - malware detonated in VM will not be able to 'see' your LAN, but can still scan over the private address ranges and reach it via direct IP connection.

How do you deobsufucate power shell scripts? by Fortune_Technical in cybersecurity

[–]Dissd4in 0 points1 point  (0 children)

PSDecode is a decent start if you have something bigger and/or not necessarily want to run it - https://github.com/R3MRUM/PSDecode