12 posts found
Scope unauthorised AnyDesk, ScreenConnect and TeamViewer use across a client estate: find every install, read the session logs, build a timeline and contain it safely.
A repeatable workflow for public sector SOCs to turn NCSC co-sealed advisories into ATT&CK mapped hunts, tested detections and clear evidence for the CAF.
Spot adversary in the middle phishing in Entra ID by tracking session IDs, OfficeHome sign ins and token risk events, then contain it before a payment fraud lands.
The Defender XDR tables your analysts query most, the columns worth remembering, starter KQL and the multi tenant rules that keep MSP hunts fast and clean.
Find regular callback traffic in proxy and EDR logs with interval analysis in KQL and SPL, then separate real command and control from noisy legitimate software.
A practical playbook for investigating a suspicious Microsoft 365 inbox rule: read the rule, scope the account, check what mail was exposed and contain it cleanly.
Build a tuned LSASS access detection from Sysmon Event ID 10, with Splunk, Sentinel and Sigma versions, plus triage steps and the hardening that reduces your risk.
RC4 is now off by default on domain controllers, so old Kerberoasting rules go quiet. Hunt AES ticket bursts, leftover RC4 accounts and decoy SPNs instead.
Use Sentinel watchlists to suppress known scanners, flag VIP accounts and keep exclusions out of your rule logic, with ready KQL for each pattern.