4 posts found
A practical hunt for T1053.005: stack scheduled tasks across hosts, spot risky actions, catch tasks hidden by SD value removal and sweep the registry for what your logs missed.
A hands-on triage guide for device code sign-ins in Entra ID: separate real use from phishing, check for token abuse and device registration, then contain the account.
AI agents don’t just answer questions: they plan steps, use tools and take actions. Here’s how they help on shift, where they fail, and how to detect and govern them as non-human identities.
A repeatable beginner workflow for the most common SOC alert: lots of failed Windows logons. Read the alert, enrich, scope, decide and document.
