ForEach-Object (+ -Parallel when possible)

Grabs the list of emails form the 'email' column, and queries graph for the user Object Id and puts them in a separate file. *Note: even if you don't use this script, always preserve the original list sent to you.

Full disclosure: Needs a lot of work. An over-reliance on filename and cmdline. Performance ugh.
Also asked GPT to clean it up and consolidate it as it was a mess

@wietzebeukema.nl ArgFuscator really comes to mind on this one
🤔Could look at the InitiatingProcess + the InitiatingAccount

the simple query

no way

Any and all feedback is welcome. Did sprint through quite a few things I was hoping to dive into but the presentation gods were not pleased with me on this day.

Here are the slides for MDE Deception Capabilities: github.com/AttacktheSOC...

KQLs: github.com/AttacktheSOC...
many more to trickle in

Thank you, man! Been prepping for it

Will do. Always seems to be the issue, have all these things I intend to say and they all try getting out at the same time causing me to freeze up. 🥤

I do get to cheat a little as it's an online talk so that alone calmed the nerves a bit.