Cloud Security Architecture & AI Defense

Dikshant Lather · Sep 25, 2026

Identifying Inactive and Dormant Service Principals Misuse in Microsoft Entra ID

Detect sudden activity from long-dormant Service Principals and App Registrations that may indicate compromised client secrets or abandoned credentials.

Identity Security 2 min read

0 0

Dikshant Lather · Sep 25, 2026

Detecting Persistence via Windows Scheduled Task Creation Using KQL

Hunt for adversary persistence via unauthorized Windows Scheduled Tasks by parsing Security Event ID 4698 and DeviceProcessEvents in KQL.

Threat Hunting 2 min read

0 0

Dikshant Lather · Sep 25, 2026

Detecting Brute Force Attacks Followed by Successful Logon in Microsoft Sentinel

Correlate failed sign-ins followed by a successful authentication within a short time window to immediately flag compromised user accounts.

Incident Response 2 min read

0 0

Dikshant Lather · Sep 25, 2026

Identifying Rogue Azure Subscription Role Assignments and Privilege Escalation

Monitor high-privilege Azure RBAC grant operations (Owner, Contributor, User Access Administrator) in AzureActivity logs using proactive KQL alert rules.

Cloud Security 2 min read

0 0

Dikshant Lather · Sep 25, 2026

Detecting MFA Fatigue and Push Notification Bombing in Microsoft Entra ID

Catch MFA push notification bombing attacks where attackers trigger repeated authentication requests until the victim accidentally approves access.

Identity Security 2 min read

0 0

Dikshant Lather · Sep 25, 2026

Uncovering Malicious Windows Service Installation via Event ID 7045 and Defender KQL

Catch lateral movement and persistence tools (PsExec, Cobalt Strike PsExec service) by monitoring new Windows Service installations with KQL.

Threat Hunting 2 min read

0 0

Dikshant Lather · Sep 25, 2026

Detecting Suspicious Base64 Encoded PowerShell Commands with Defender XDR KQL

Halt fileless execution and command obfuscation by spotting encoded PowerShell flags (-enc, -encodedcommand) with Defender for Endpoint KQL queries.

Endpoint Detection 2 min read

0 0

Dikshant Lather · Sep 25, 2026

Spotting LSASS Memory Dumping via Comsvcs.dll and Procdump in KQL

Detect credential theft targeting the Local Security Authority Subsystem Service (LSASS) via native LOLBINs like comsvcs.dll and Sysinternals ProcDump in KQL.

Endpoint Detection 2 min read

0 0