WELCOME TO CRONINITY

!!!Note: this is learning Notes, some AI slop. KQL needs to be tested!!! Detecting Microsoft CoPilot Abuse Patterns Because most of these techniques abuse legitimate Copilot functionality rather than exploiting a classic software vulnerability, detection has to shift from "block the bad traffic" to "baseline normal Copilot behavior and flag deviation. Purview / Copilot audit log analysis Monitor for Copilot interactions that retrieve sensitive-labeled content (per Microsoft P

Brief Overview of How Microsoft 365 Copilot Works Microsoft Copilot is an AI-powered processing and orchestration engine that combines several Microsoft technologies to deliver contextual productivity assistance. At a high level, Copilot coordinates three key components: Large Language Models (LLMs) — provide the AI reasoning and natural-language processing capabilities. Microsoft Graph — provides access to organizational context, including emails, chats, documents, meetings,

How Abuse of Microsoft Copilot Maps to the Attack Matrices MITRE ATLAS (atlas.mitre.org) Mitre Atlas is the ATT&CK-style knowledge base purpose-built for adversarial tactics against AI/ML systems. As of the current release it organizes techniques into 16 tactics run in rough attack-progression order: Reconnaissance → Resource Development → Initial Access → AI Model Access → Execution → Persistence → Privilege Escalation → Defense Evasion → Credential Access → Discovery → Lat

Scheduled Tasks Overview and Impact to Cybersecurity Running scheduled tasks is a fundamental part of Windows system administration. Organizations routinely use scheduled tasks to automate activities that need to occur at specific times or in response to specific system events. Common examples include running scripts, performing system maintenance, checking system health, generating reports, cleaning up temporary files, and executing backup or update routines. However, like m

Palantir Technologies — Overview Palantir is a data-analytics and AI software company founded in 2003, originally built for U.S. intelligence and counterterrorism work before expanding into commercial enterprise markets. Its core pitch: help large, complex organizations integrate messy, siloed data and turn it into operational decisions, not just dashboards, but software that can trigger real-world actions. Palantir organizes its offering around four principal software platfo

KQL Essentials: Variables with let and Arrays with dynamic Kusto Query Language (KQL) supports variables using the let statement, which allows you to store values, expressions, or entire subqueries for reuse within a query. This enhances readability, reduces duplication, and improves maintainability of complex queries. Using let to Create Variables The let statement follows this basic format: let VariableName = ExpressionOrValue; Key Components of let statement: let – Keyword

Summarize and Count Simple Sorts: | sort by fieldname asc //or | sort by fieldname desc Simple Summarize: | summarize by fieldname desc Adding summarize and then counting" | summarize count () by fieldname Different example: | summarize count() by columname1, columnname2 | sort by count_ Other option for summarize and count and then filtering the output to only counts over certain limits. | summarize EventCount = count() by fieldname | where EventCount > 1000 To see the 1st v

Working with Time in KQL Handling time effectively in Kusto Query Language (KQL) is essential for accurate analysis, efficient data management, and optimized query performance, especially when working in environments like Microsoft Sentinel or Microsoft Defender. Time Filtering Options Most logging platforms, including Microsoft Sentinel, provide a GUI-based datetime picker to filter logs within a specific timeframe. However, you can override the GUI time filter by specifying

Understanding KQL in the Microsoft Data Ecosystem In Microsoft's data ecosystem, KQL stands for Kusto Query Language. The name "Kusto" is a playful nod to Jacques Cousteau, the renowned deep-sea explorer. Just as Cousteau explored the depths of the oceans, KQL enables users to explore the depths of their data with power and precision. It’s worth noting that KQL is sometimes confused with another similarly named language: Kibana Query Language, used for querying data in Elasti

Digital Investigations: Sentinel Log Export and Chain of Custody Overview Digital investigations increasingly rely on centralized log platforms such as Microsoft Sentinel to support forensic analysis. With this shift comes the requirement to maintain strict chain of custody for all exported data to ensure integrity, traceability, and admissibility. There are two primary approaches for exporting Sentinel data in support of investigations: Query-Based Export Manual Automated Di

Detection Testing & Validation Detection Measurement Concepts Understanding how to evaluate a detection's performance is essential for tuning rules, prioritizing engineering efforts, and managing SOC efficiency. Key measurement concepts include: 1. Precision (a.k.a. True Positive Rate / Confidence): This measures how many of the triggered alerts are actually true positives. Formula: True Positives / (True Positives + False Positives) High precision means minimal false positi

Identifying and Tracking Detections An essential part of improving your detection capabilities is establishing a structured approach to inventory and track your detection rules. The first step is determining where and how detections will be tracked. However, several key considerations must be taken into account: Visibility into Detections – Many cybersecurity tools operate proprietary detection engines, which are not publicly exposed. Tracking every individual rule within too

Application log collection to Sentinel SIEM in a Microsoft defender environment Microsoft Defender for Endpoint (MDE) is a highly capable EDR platform that, when deployed to workstations and servers, collects extensive telemetry including process creation, network connections, file activity, registry changes, authentication events, and security logs. Out of the box, it provides deep endpoint visibility, functionally similar to an enhanced, enterprise-grade Sysmon. In many cas