#kql articles | Hashnode

KDKajal Dhanjalkajalbuilds.hashnode.dev2h ago · 14 min read

FortiBleed had around twenty people. JadePuffer had an agent. The way in was identical.

The thesis I had to throw out Two intrusions dominated the last month, and the coverage of both led with AI. FortiBleed: an initial-access operation running on around twenty people with a defined div

0

KDKajal Dhanjalkajalbuilds.hashnode.devJun 30 · 4 min read

Building a Sentinel Detection Lab, Part 7: The Detection That Taught Me My Own Telemetry's Blind Spot

Repo: github.com/Kajal-Dhanjal/sentinel-detection-lab Part 6 caught AI tooling launching. The natural next question was what happens once it's running—specifically, where does it talk to? This is the

0

KDKajal Dhanjalkajalbuilds.hashnode.devJun 30 · 4 min read

Building a Sentinel Detection Lab, Part 6: Shadow AI and the Detection That's Honest About What It Hasn't Proven Yet

Repo: github.com/Kajal-Dhanjal/sentinel-detection-lab Five detections in, every one of them pointed at a fairly traditional attacker: brute force, malicious PowerShell, registry persistence, recon, an

0

KDKajal Dhanjalkajalbuilds.hashnode.devJun 30 · 4 min read

Building a Sentinel Detection Lab, Part 8: Watching for Agents, Not Just Attackers

Repo: github.com/Kajal-Dhanjal/sentinel-detection-lab Most process-lineage detections in SOC content are written to catch attackers—Office spawning PowerShell, a browser spawning cmd.exe. Part 8 is th

0

KDKajal Dhanjalkajalbuilds.hashnode.devJun 21 · 9 min read

Building a Sentinel Detection Lab, Part 5: MFA Registration, a Missing License, and the First Detection That Talks Back

https://github.com/Kajal-Dhanjal/sentinel-detection-lab Part 4 ended on this note: moving off the endpoint entirely and into identity, starting with attackers registering their own MFA methods on com

0

KDKajal Dhanjalkajalbuilds.hashnode.devJun 21 · 6 min read

Building a Sentinel Detection Lab, Part 4: Catching Reconnaissance — and the Case-Sensitivity Bug That Made It Look Broken

https://github.com/Kajal-Dhanjal/sentinel-detection-lab This is Part 4 of the series where I build a Microsoft Sentinel detection engineering lab from scratch and write down what actually happened —

0

KDKajal Dhanjalkajalbuilds.hashnode.devJun 15 · 4 min read

Building a Sentinel Detection Lab, Part 3: My Detection Flagged Legitimate Windows Behavior — Here's How I Tuned It Without Going Blind

Part 3 of a series on building a detection engineering lab in Microsoft Sentinel. This post: registry persistence, a textbook false positive, and the single most important lesson in detection engineer

1

K

KDKajal Dhanjalkajalbuilds.hashnode.devJun 15 · 7 min read

Building a Sentinel Detection Lab, Part 1: Catching Brute Force (and the Bug That Flagged the Wrong Account)

Part 1 of a series on building a detection engineering lab in Microsoft Sentinel from scratch. This post: writing my first detection, and the parsing bug that taught me more than the detection itself.

0

KDKajal Dhanjalkajalbuilds.hashnode.devJun 15 · 4 min read

Building a Sentinel Detection Lab, Part 2: Suspicious PowerShell, and Why Some Detections Need No Threshold

Part 2 of a series on building a detection engineering lab in Microsoft Sentinel. This post: hunting malicious PowerShell with Sysmon, and the difference between volume detections and signature detect

0

YDYuval De Roosyuvaldrs.hashnode.devFeb 1 · 3 min read

KQL Visualization: The "Missing Zero" Trap

You have seen this happen: You run a query to track errors over time. Between 14:00 and 16:00, you had zero errors. But when you render the timechart, Kusto draws a straight line connecting the 14:00 point directly to the 16:00 point. The Illusion: I...

0

#kql

#kql

Explore Hashnode

Trending tags this week

FortiBleed had around twenty people. JadePuffer had an agent. The way in was identical.

Building a Sentinel Detection Lab, Part 7: The Detection That Taught Me My Own Telemetry's Blind Spot

Building a Sentinel Detection Lab, Part 6: Shadow AI and the Detection That's Honest About What It Hasn't Proven Yet

Building a Sentinel Detection Lab, Part 8: Watching for Agents, Not Just Attackers

Building a Sentinel Detection Lab, Part 5: MFA Registration, a Missing License, and the First Detection That Talks Back

Building a Sentinel Detection Lab, Part 4: Catching Reconnaissance — and the Case-Sensitivity Bug That Made It Look Broken

Building a Sentinel Detection Lab, Part 3: My Detection Flagged Legitimate Windows Behavior — Here's How I Tuned It Without Going Blind

Building a Sentinel Detection Lab, Part 1: Catching Brute Force (and the Bug That Flagged the Wrong Account)

Building a Sentinel Detection Lab, Part 2: Suspicious PowerShell, and Why Some Detections Need No Threshold

KQL Visualization: The "Missing Zero" Trap

#kql

Search Hashnode

#kql

Explore Hashnode

Trending tags this week

FortiBleed had around twenty people. JadePuffer had an agent. The way in was identical.

Building a Sentinel Detection Lab, Part 7: The Detection That Taught Me My Own Telemetry's Blind Spot

Building a Sentinel Detection Lab, Part 6: Shadow AI and the Detection That's Honest About What It Hasn't Proven Yet

Building a Sentinel Detection Lab, Part 8: Watching for Agents, Not Just Attackers

Building a Sentinel Detection Lab, Part 5: MFA Registration, a Missing License, and the First Detection That Talks Back

Building a Sentinel Detection Lab, Part 4: Catching Reconnaissance — and the Case-Sensitivity Bug That Made It Look Broken

Building a Sentinel Detection Lab, Part 3: My Detection Flagged Legitimate Windows Behavior — Here's How I Tuned It Without Going Blind

Building a Sentinel Detection Lab, Part 1: Catching Brute Force (and the Bug That Flagged the Wrong Account)

Building a Sentinel Detection Lab, Part 2: Suspicious PowerShell, and Why Some Detections Need No Threshold

KQL Visualization: The "Missing Zero" Trap