14 posts found
Scope unauthorised AnyDesk, ScreenConnect and TeamViewer use across a client estate: find every install, read the session logs, build a timeline and contain it safely.
A repeatable workflow for public sector SOCs to turn NCSC co-sealed advisories into ATT&CK mapped hunts, tested detections and clear evidence for the CAF.
Spot adversary in the middle phishing in Entra ID by tracking session IDs, OfficeHome sign ins and token risk events, then contain it before a payment fraud lands.
A practical workflow for investigating an unknown domain with internal logs, RDAP, passive DNS and certificate data, then turning the results into a clear verdict.
The Defender XDR tables your analysts query most, the columns worth remembering, starter KQL and the multi tenant rules that keep MSP hunts fast and clean.
A shift-ready reference for Windows logon event IDs, logon types and failure codes, with KQL, SPL and PowerShell to show who logged on, from where and how.
Find regular callback traffic in proxy and EDR logs with interval analysis in KQL and SPL, then separate real command and control from noisy legitimate software.
A practical playbook for investigating a suspicious Microsoft 365 inbox rule: read the rule, scope the account, check what mail was exposed and contain it cleanly.
Build a tuned LSASS access detection from Sysmon Event ID 10, with Splunk, Sentinel and Sigma versions, plus triage steps and the hardening that reduces your risk.