KDKajal Dhanjalinkajalbuilds.hashnode.dev·Aug 18 · 12 min readAnatomy of an identity compromiseWhy nothing fired When a detection misses, the first instinct is to blame the rule. Wrong threshold, wrong table, wrong logic. Sometimes that is exactly right. But there is a class of intrusion where 00
KDKajal Dhanjalinkajalbuilds.hashnode.dev·Aug 5 · 9 min readWhat your logs can't seeThe premise "A detection rule can only fire on evidence that reached the platform." That sounds obvious written down, and it's routinely skipped in practice. When coverage gets audited, it gets audite00
KDKajal Dhanjalinkajalbuilds.hashnode.dev·Jul 21 · 14 min readFortiBleed had around twenty people. JadePuffer had an agent. The way in was identical.The thesis I had to throw out Two intrusions dominated the last month, and the coverage of both led with AI. FortiBleed: an initial-access operation running on around twenty people with a defined div00
KDKajal Dhanjalinkajalbuilds.hashnode.dev·Jun 30 · 4 min readBuilding a Sentinel Detection Lab, Part 8: Watching for Agents, Not Just AttackersRepo: github.com/Kajal-Dhanjal/sentinel-detection-lab Most process-lineage detections in SOC content are written to catch attackers—Office spawning PowerShell, a browser spawning cmd.exe. Part 8 is th00
KDKajal Dhanjalinkajalbuilds.hashnode.dev·Jun 30 · 4 min readBuilding a Sentinel Detection Lab, Part 7: The Detection That Taught Me My Own Telemetry's Blind SpotRepo: github.com/Kajal-Dhanjal/sentinel-detection-lab Part 6 caught AI tooling launching. The natural next question was what happens once it's running—specifically, where does it talk to? This is the 00
