KQL

Fixing the "RDP Nesting" Analytic Rule

Alright class. Sixth lesson in this series. In the last

Fixing the "Rare RDP Connections" Analytic Rule

Ghost Post Settings Alright class. Fifth lesson in this series.

Fixing the "Attempt to Bypass Conditional Access Rule" Analytic Rule

Alright class. Fourth lesson in this series. We have fixed

Fixing the "New User Assigned to Privileged Role" Analytic Rule

Alright class. Third lesson in this series. We have already

Finding password.txt Before Someone Else Does

Alright class. Somewhere in your tenant right now there is

Fixing the "Mass Secret Retrieval from Azure Key Vault" Analytic Rule

Alright class. This time let's take a trip

Fixing the "Rare Application Consent" Analytic Rule

Alright class. Back in the Entra audit log for this

Fixing the "Account Created From Non-Approved Sources" Analytic Rule

Alright class. A companion piece to the last lesson, from

Fixing the "Account Created or Deleted by Non-Approved User" Analytic Rule

Alright class. This one comes from the Entra ID audit

Fixing the "Account Created and Deleted in Short Timeframe" Analytic Rule

Alright class. Today it is "Account Created and Deleted