MDEAutomator: Introducing MDEAutoHunt for Bulk Threat Hunting

By /

Listen to this Post

Featured Image
MDEAutoHunt is a powerful tool designed for bulk threat hunting using Microsoft Defender for Endpoint (MDE) APIs. Developed by Eric M., this solution simplifies large-scale query execution by leveraging Microsoft Graph API endpoints for Advanced Hunting.

How MDEAutoHunt Works

  • Uses Graph API (v1.0 & Beta) for robust query execution.
  • Implements load-balancing between API versions for efficiency.
  • Employs `ForEach-Object -Parallel` with throttling to maximize success rates.
  • Wrapped in `Invoke-WithRetry` to handle API failures gracefully.

Key Features

✔ Automated query execution from stored JSON/YAML/CSL files.

✔ Blob storage integration for exporting query results.

✔ Simplified deployment via ARM template.

✔ Frontend GUI for triggering hunts via HTTP requests.

You Should Know: Essential Commands & Setup

Installation & Setup

Install-Module -Name MDEAutomator -Force
Import-Module MDEAutomator
Connect-MgGraph -Scopes "AdvancedHunting.Read.All"

Running Advanced Hunting Queries

Invoke-AdvancedHunting -Query "DeviceProcessEvents | limit 10"

Automating Bulk Queries

Store queries in an array and execute:

$Queries = @(
'DeviceProcessEvents | where InitiatingProcessFileName =~ "powershell.exe"',
'DeviceNetworkEvents | where RemoteIP startswith "10."'
)
Invoke-MgGraphRequest -Method POST -Uri "https://graph.microsoft.com/v1.0/security/runHuntingQueries" -Body $Queries

Handling Throttling & Retries

function Invoke-WithRetry {
param (
[bash]$Script,
[bash]$MaxRetries = 3,
[bash]$Delay = 5
)
$retryCount = 0
while ($retryCount -lt $MaxRetries) {
try {
return & $Script
} catch {
$retryCount++
Start-Sleep -Seconds $Delay
}
}
throw "Max retries reached"
}

Exporting Results to Blob Storage

$StorageAccount = "yourstorageaccount"
$Container = "query-results"
$BlobName = "hunt-results-$(Get-Date -Format 'yyyyMMdd').json"
$Results | Out-File -FilePath $BlobName
az storage blob upload --account-name $StorageAccount --container-name $Container --file $BlobName --name $BlobName

What Undercode Say

MDEAutoHunt is a game-changer for security teams managing large-scale threat hunting. By utilizing Graph API endpoints, it overcomes traditional throttling issues and provides a scalable, automated approach to threat detection.

Expected Output:

  • Efficient bulk query execution with minimal API failures.
  • Seamless integration with Azure Blob Storage for log retention.
  • Scalable threat hunting for enterprises with massive datasets.

For more details, check the GitHub Repo.

Prediction

As Microsoft continues refining Graph API security endpoints, tools like MDEAutoHunt will become essential for SOC automation, reducing manual effort and improving detection rates. Expect more AI-driven optimizations in future iterations.

References:

Reported By: Emannon Mdeautomator – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

Join Our Cyber World:

💬 Whatsapp | 💬 Telegram

Related Posts: