Najam Ul Saqib njmulsqb

Azure Defender for Cloud KQL Queries

These are the queries that I wrote and found useful to extract data using Azure Resource Graph Explorer

Security Alerts

Fetch all the active suspicious authentication activities

SecurityResources
| where type == "microsoft.security/locations/alerts" and properties.AlertDisplayName=="Suspicious authentication activity" and properties.Status=="Active"

Fetch all the active suspicious authentication activities (Only Start Time and Hostname)

Awesome-Security-Repos

Here's a list of github repos and tools that I believe are awesome and should be promoted and used.

Source Code Analysis

Semgrep - Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.
RegexPassive - Collection of regexp pattern for security passive scanning
Secure Codebox - secureCodeBox (SCB) - continuous secure delivery out of the box

	# Get token in system.security.securestring format and decode it
	$securestring = (Get-AzAccessToken).token
	$bstr = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($secureString)
	$plaintext = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($bstr)

	$token = $plaintext.Split(".")[1].Replace('-', '+').Replace('_', '/')

	while ($token.Length % 4) {$token += "="}
	# Decode the token, and match the ObjectIds returned by Get-AzRoleAssignment with oid section of JWT. You can also manually decode the JWT and pass oid to Get-AzRoleAssignment -ObjectId $oid
	Get-AzRoleAssignment \| where ObjectId -EQ ([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String($token)) \| ConvertFrom-Json).oid

	import sys
	import subprocess
	import os

	parentDir = 'sourceMapsToJS'
	sourceMapURL = sys.argv[1]
	dirName = sourceMapURL.strip(
	'https://').strip('http://').strip('www.').replace('/', '-').replace('.', '-')
	if not os.path.exists(parentDir):
	os.mkdir(parentDir)