Topic

Threat Hunting

Threat hunting in Microsoft Sentinel and Defender XDR: building hypotheses, hunting queries you can run today, and KQL for what your rules miss.

20 posts

Microsoft Sentinel Anyone With the Link All right class. Somebody shared a file this week by picking the option at the top of the list. The one that says Anyone with the link. It 15 Oct 2026

Microsoft Sentinel The Sentinel Data Lake Got Respecced: What Actually Moved to Fabric All right class. You moved your firewall logs to the data lake tier because the analytics bill had turned into a monthly argument with finance. You built a 1 Oct 2026

Defender XDR Your Crown Jewels Are in Defender. You Just Never Set Them Up. All right class. You have been saying "crown jewels" and "tier zero assets" in meetings for years. You can explain exactly why domain controllers 2 Jun 2026

Threat Hunting Building Your First Threat Hunting Hypothesis (The MITRE Way) All right class. Lots of SOC teams say they do threat hunting. What they actually do is run a couple of saved KQL queries on a Friday afternoon 26 May 2026

Microsoft Sentinel Azure Key Vault: The High-Value Queries Your SOC Isn't Running All right class. Key Vault is where your secrets live. Connection strings, API keys, certificates, encryption keys, service account credentials. If an attacker gets into your environment and 12 May 2026

KQL Hunting PowerShell Abuse in MDE: Eight Queries, Real Results All right class PowerShell is in every serious Windows intrusion. Not because attackers are creative, but because it works, it's already there, and it leaves just 5 May 2026

Microsoft Sentinel User Audit Investigation Workbook: Deploy in Minutes, Investigate in Seconds All right class. This is the workbook I wish people would build once, instead of recreating the same “user activity timeline” from scratch every time HR/Legal comes 27 Jan 2026

SOC KQL User Audit Playbook V2: The Insider Threat Investigation Guide All right class. This is a continuation of my previous lesson, which contains useful queries for insider risk hunting. Make sure to read it first, as it may 22 Jan 2026

Microsoft Sentinel Teams Threat Protection: What Actually Changed and What You Can Actually Hunt All right class Your SOC has limited visibility into Teams. Attackers run credential theft campaigns in chat. You see some of it through audit logs if you' 20 Jan 2026

SOC Threat Analytics in Microsoft Defender: What It Actually Does and Why Your SOC Needs It All right class. You're doing your SOC investigations at 3 pm Tuesday. A threat report drops that a Chinese state-backed group is hitting financial services 15 Jan 2026

SOC Hunting in Microsoft Sentinel: What Hunting Actually Is and Why You Need It Terminology matters here. Microsoft uses these words in specific ways, and if you get them wrong, you'll waste time doing the wrong thing. What Is Hunting 13 Jan 2026

KQL Building a Brute Force Detection Query: How To Think Through Network Logon Failures All right class, take your seats. This post is about methodology. How do you go from "I want to hunt brute force attempts" to a query 2 Dec 2025