Cloud Security Architecture & AI Defense

Dikshant Lather · Sep 25, 2026

Spotting LSASS Memory Dumping via Comsvcs.dll and Procdump in KQL

Detect credential theft targeting the Local Security Authority Subsystem Service (LSASS) via native LOLBINs like comsvcs.dll and Sysinternals ProcDump in KQL.

Endpoint Detection 2 min read

0 0

Dikshant Lather · Sep 25, 2026

Detect Password Spray Attacks in Microsoft Entra ID Using KQL

Learn how to detect distributed password spray attacks targeting Microsoft Entra ID using advanced KQL queries, threshold aggregation, and IP failure rate analysis.

Identity Security 2 min read

0 0

Dikshant Lather · Sep 24, 2026

7 DevSecOps Tools Every Engineer Should Know in 2026

Discover seven DevSecOps tools covering code, dependencies, secrets, IaC, containers, APIs, and security testing that engineers can use in modern CI/CD pipelines.

devsecops 6 min read

0 0

Dikshant Lather · Sep 24, 2026

How to Implement Zero Trust Architecture in AWS and Azure: A Practical 2026 Guide

Learn how to design Zero Trust across AWS and Azure using identity, least privilege, segmentation, continuous monitoring, and assume-breach principles.

cloud-security 6 min read

0 0

Dikshant Lather · Sep 25, 2026

Detecting Suspicious Microsoft 365 Inbox Forwarding Rules Using OfficeActivity

Halt Business Email Compromise (BEC) fraud by catching covert Exchange Online inbox rules forwarding emails to external domains.

Cloud Security 2 min read

0 0

Dikshant Lather · Sep 25, 2026

Hunting for Cobalt Strike and C2 Periodic Beaconing Using DeviceNetworkEvents

Detect outbound Command and Control beaconing patterns with low interval variance using statistical time-delta functions in Defender XDR KQL.

Network Security 2 min read

0 0

Dikshant Lather · Sep 25, 2026

Monitoring Azure Key Vault Unauthorized Enumeration and Secret Access with KQL

Detect adversaries enumerating and dumping secrets, certificates, and API keys from Azure Key Vault using diagnostic log queries in Sentinel.

Cloud Security 2 min read

0 0

Dikshant Lather · Sep 25, 2026

Identifying Inactive and Dormant Service Principals Misuse in Microsoft Entra ID

Detect sudden activity from long-dormant Service Principals and App Registrations that may indicate compromised client secrets or abandoned credentials.

Identity Security 2 min read

0 0