Detection Engineering

Finding password.txt Before Someone Else Does

Alright class. Somewhere in your tenant right now there is

Fixing the "Mass Secret Retrieval from Azure Key Vault" Analytic Rule

Alright class. This time let's take a trip

Fixing the "MFA Rejected by User" Analytic Rule

Alright class. The original "MFA Rejected by User"

Fixing the "Rare Application Consent" Analytic Rule

Alright class. Back in the Entra audit log for this

Fixing the "Account Created From Non-Approved Sources" Analytic Rule

Alright class. A companion piece to the last lesson, from

Fixing the "Account Created or Deleted by Non-Approved User" Analytic Rule

Alright class. This one comes from the Entra ID audit

Fixing the "Account Created and Deleted in Short Timeframe" Analytic Rule

Alright class. Today it is "Account Created and Deleted

Is Your SOC Actually Doing Anything? Here Is How to Find Out

All right class. A friend of mine recently took over

PIM Auditing in Microsoft Sentinel: High Value Detections

Alright class. Most lessons in this series are usually autopsies.

Your Crown Jewels Are in Defender. You Just Never Set Them Up.

All right class. You have been saying "crown jewels&