Glenn hiddenillusion

Visualization

Name/Link	Description/Purpose	Tags
beagle	Transforms data sources and logs into graphs.	`fireeye:hx`, `win:evtx`

Helpers

EVTX logs

TOTAL_EXPECTED_FILES=$1
INGESTED=`find /path/to/logs -type f | wc -l`
PERCENTAGE=`echo $INGESTED/$TOTAL_EXPECTED_FILES*100 | bc -l`
echo $INGESTED" / "$TOTAL_EXPECTED_FILES" ( "$PERCENTAGE"% )"

CLI:

Application IDs withing the UAL

Application Name	ID
Global PowerShell	1b730954-1685-4b74-9bfd-dac224a7b894
Microsoft.Azure.ActiveDirectory	00000002-0000-0000-c000-000000000000
Microsoft.Azure.AnalysisServices	00000009-0000-0000-c000-000000000000
Microsoft.Azure.Workflow	00000005-0000-0000-c000-000000000000
Microsoft Office Client Service	0f698dd4-f011-4d23-a33e-b36416dcb1e6
Microsoft.Exchange	00000002-0000-0ff1-ce00-000000000000

If you have an Office 365 E3 or E5 business subscription, it includes security and compliance tools. In that case, you have access to these additional roles: Compliance administrator, eDiscovery Manager, Organization management, Reviewer, Security Administrator, Security Reader, Service Assurance User, Supervisory Review.

https://support.office.com/en-us/article/about-office-365-admin-roles-da585eea-f576-4f55-a1e0-87090b6aaa9d

Web logs

User-Agent is rare
User-Agent is new
Domain is rare
Domain is new
High frequency of http connections
URI is same
URI varies but length is constant
Domain varies but length is constant
Missing referrer

Term	Description	Link(s)
Alias	Another email address that people can use to email
App Password	An app password is a password that is created within the Azure portal and that allows the user to bypass MFA and continue to use their application.
Alternate email address	Required for admins to receive important notifications, or resetting the admin password which cannot be modified by the end users
AuditAdmin
AuditDelegate
Delegate	An account with assigned permissions to a mailbox.
Display Name	Name that appears in the Address Book & on the TO and From lines on an email.
EAC	"Exchange Admin Center"

	rule test_yara_rule
	{
	strings:
	$0 = "Command" nocase wide ascii
	$1 = "Windows" nocase wide ascii
	condition:
	any of them
	}

Glenn hiddenillusion

Visualization

Helpers

Web logs

X-TENSIONS

AWS

Configuration

Terminology