Notes on threat detection and incident response.
Latest
-
ClickFix Detection: Comparing the Public Approaches
A study note on the public ways to detect ClickFix: where each one looks, which variants it covers, and when to use it. -
When the Vendor Is the Way In: Detecting Abused SaaS Integrations in Microsoft Sentinel
Attackers breached Klue, stole the OAuth tokens its customers had granted, and pulled their Salesforce data. How to spot a trusted integration that has changed hands. -
From DNS Takeover to Atlassian Org Admin: Detection and Response in Microsoft Sentinel
How an attacker who controlled a company's DNS used Atlassian's own domain verification to become org admin, and how to detect it when identity logs show nothing. -
Detecting the ShinyHunters Vishing Attack Chain in Microsoft Sentinel
How the 2026 ShinyHunters vishing campaign went from one phone call to SaaS data theft, and four Microsoft Sentinel detections, with KQL, to catch it.
subscribe via RSS