In this episode of the Microsoft Threat Intelligence Podcast host Sherrod DeGrippo is joined by the authors of the new book The Definitive Guide to KQL: Using Kusto Query Language for Operations, Defending, and Threat Hunting. Guests Rod Trent, Matt Zorich, and Mark Morowczynski discuss the significance of KQL (Kusto Query Language) in cloud data security and how it enables efficient data querying for threat detection in Microsoft products like Sentinel and Defender. They share insights from their own experiences, highlight key features of the book, and explain how both beginners and experts can benefit from KQL. Later in the episode Sherrod speaks with Senior Threat Hunter Lekshmi Vijayan about the growing trend of cyberattacks using malicious PowerShell commands. Lekshmi explains how attackers trick users into copying and pasting harmful code, often through compromised websites or phishing emails. They discuss how these attacks aim to install remote access tools like NetSupport RAT or information stealers, targeting sensitive data like browser credentials and crypto keys. 

In this episode you’ll learn:      

• How KQL is applied in real-world security scenarios including incident response 
• Key features and benefits of KQL when it comes to security and cloud data 
• Distinguishing between legitimate and malicious uses of remote management tools  

Some questions we ask:       

• How does KQL tie into the Microsoft ecosystem, like Defender and Copilot? 
• What advice would you give to someone new to KQL who wants to start learning? 
• What is the technique we're seeing with copy-pasting malicious PowerShell?  

Resources:  

View Mark Morowczynski on LinkedIn 

View Matt Zorich on LinkedIn 

View Rod Trent on LinkedIn 

View Lekshmi Vijayan on LinkedIn  

View Sherrod DeGrippo on LinkedIn  

Related Microsoft Podcasts:                   

• Afternoon Cyber Tea with Ann Johnson 
• The BlueHat Podcast 
• Uncovering Hidden Risks     

Discover and follow other Microsoft podcasts at microsoft.com/podcasts  

Get the latest threat intelligence insights and guidance at Microsoft Security Insider 

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.