Cloud Security Architecture & AI Defense

Dikshant Lather · Sep 25, 2026

Spotting LSASS Memory Dumping via Comsvcs.dll and Procdump in KQL

Detect credential theft targeting the Local Security Authority Subsystem Service (LSASS) via native LOLBINs like comsvcs.dll and Sysinternals ProcDump in KQL.

Endpoint Detection 2 min read

0 0

Dikshant Lather · Sep 25, 2026

Detect Password Spray Attacks in Microsoft Entra ID Using KQL

Learn how to detect distributed password spray attacks targeting Microsoft Entra ID using advanced KQL queries, threshold aggregation, and IP failure rate analysis.

Identity Security 2 min read

0 0

Dikshant Lather · Sep 25, 2026

Detecting Suspicious Microsoft 365 Inbox Forwarding Rules Using OfficeActivity

Halt Business Email Compromise (BEC) fraud by catching covert Exchange Online inbox rules forwarding emails to external domains.

Cloud Security 2 min read

0 0

Dikshant Lather · Sep 25, 2026

Hunting for Cobalt Strike and C2 Periodic Beaconing Using DeviceNetworkEvents

Detect outbound Command and Control beaconing patterns with low interval variance using statistical time-delta functions in Defender XDR KQL.

Network Security 2 min read

0 0

Dikshant Lather · Sep 25, 2026

Monitoring Azure Key Vault Unauthorized Enumeration and Secret Access with KQL

Detect adversaries enumerating and dumping secrets, certificates, and API keys from Azure Key Vault using diagnostic log queries in Sentinel.

Cloud Security 2 min read

0 0

Dikshant Lather · Sep 25, 2026

Detecting Shadow IT and Massive Cloud Storage Uploads in Enterprise Networks

Monitor unauthorized data transfers to personal cloud storage providers (MEGA, Dropbox, WeTransfer) using byte-count aggregation in KQL.

Network Security 1 min read

0 0

Dikshant Lather · Sep 25, 2026

Detecting Brute Force Attacks Followed by Successful Logon in Microsoft Sentinel

Correlate failed sign-ins followed by a successful authentication within a short time window to immediately flag compromised user accounts.

Incident Response 2 min read

0 0

Dikshant Lather · Sep 25, 2026

Identifying Inactive and Dormant Service Principals Misuse in Microsoft Entra ID

Detect sudden activity from long-dormant Service Principals and App Registrations that may indicate compromised client secrets or abandoned credentials.

Identity Security 2 min read

0 0