Skip to content

Instantly share code, notes, and snippets.

@f-bader

f-bader/NsoCheck.kusto

Last active July 19, 2021 10:39
Show Gist options
  • Save f-bader/13d4ce270768da6468028c0aef928946 to your computer and use it in GitHub Desktop.
Save f-bader/13d4ce270768da6468028c0aef928946 to your computer and use it in GitHub Desktop.
Download ZIP
Check for client connections to well known NSO domains as published by @AmnestyTech
Raw
NsoCheck.kusto
let NsoDomains = externaldata(RemoteUrl:string)
[
h@"https://raw.githubusercontent.com/AmnestyTech/investigations/master/2021-07-18_nso/domains.txt",
h@"https://raw.githubusercontent.com/AmnestyTech/investigations/master/2021-07-18_nso/v2_domains.txt",
h@"https://raw.githubusercontent.com/AmnestyTech/investigations/master/2021-07-18_nso/v3_domains.txt",
h@"https://raw.githubusercontent.com/AmnestyTech/investigations/master/2021-07-18_nso/v4_domains.txt"
]
with(format="csv");
DeviceNetworkEvents
| join kind = inner ( NsoDomains | distinct RemoteUrl) on RemoteUrl
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment