Uncovering Local Windows Account Creation via Command Line with KQL
Threat Hunting
2 min read
KQL
Topic • 20 Stories
Detecting Shadow IT and Massive Cloud Storage Uploads in Enterprise Networks
Network Security
1 min read
Detecting Suspicious Microsoft 365 Inbox Forwarding Rules Using OfficeActivity
Cloud Security
2 min read
Spotting Web Shell Execution: Web Server Spawning Suspicious Child Processes
Endpoint Detection
2 min read
Identifying Inactive and Dormant Service Principals Misuse in Microsoft Entra ID
Identity Security
2 min read
Detecting Defender Antivirus Tamper Protection Disablement and Registry Evasion
Endpoint Detection
2 min read
Hunting for Cobalt Strike and C2 Periodic Beaconing Using DeviceNetworkEvents
Network Security
2 min read
Detecting DNS Tunneling and High-Volume Data Exfiltration with Sentinel KQL
Network Security
2 min read
Monitoring Azure Key Vault Unauthorized Enumeration and Secret Access with KQL
Cloud Security
2 min read
