KDKajal Dhanjalinkajalbuilds.hashnode.dev·6d ago · 4 min readBuilding a Sentinel Detection Lab, Part 8: Watching for Agents, Not Just AttackersRepo: github.com/Kajal-Dhanjal/sentinel-detection-lab Most process-lineage detections in SOC content are written to catch attackers—Office spawning PowerShell, a browser spawning cmd.exe. Part 8 is th00
KDKajal Dhanjalinkajalbuilds.hashnode.dev·6d ago · 4 min readBuilding a Sentinel Detection Lab, Part 7: The Detection That Taught Me My Own Telemetry's Blind SpotRepo: github.com/Kajal-Dhanjal/sentinel-detection-lab Part 6 caught AI tooling launching. The natural next question was what happens once it's running—specifically, where does it talk to? This is the 00
KDKajal Dhanjalinkajalbuilds.hashnode.dev·6d ago · 4 min readBuilding a Sentinel Detection Lab, Part 6: Shadow AI and the Detection That's Honest About What It Hasn't Proven Yet Repo: github.com/Kajal-Dhanjal/sentinel-detection-lab Five detections in, every one of them pointed at a fairly traditional attacker: brute force, malicious PowerShell, registry persistence, recon, an00
KDKajal Dhanjalinkajalbuilds.hashnode.dev·Jun 26 · 7 min readHumans Aren't the Weakest Link "Humans are the weakest link." You've seen it on a vendor slide. Probably more than one. It's the most repeated line in security awareness, and it's repeated for a reason: it's comforting. If the huma00
KDKajal Dhanjalinkajalbuilds.hashnode.dev·Jun 21 · 9 min readBuilding a Sentinel Detection Lab, Part 5: MFA Registration, a Missing License, and the First Detection That Talks Backhttps://github.com/Kajal-Dhanjal/sentinel-detection-lab Part 4 ended on this note: moving off the endpoint entirely and into identity, starting with attackers registering their own MFA methods on com00
