#sentinel articles

KDKajal Dhanjalkajalbuilds.hashnode.devJul 21 · 14 min read

FortiBleed had around twenty people. JadePuffer had an agent. The way in was identical.

The thesis I had to throw out Two intrusions dominated the last month, and the coverage of both led with AI. FortiBleed: an initial-access operation running on around twenty people with a defined div

0

KDKajal Dhanjalkajalbuilds.hashnode.devJun 30 · 4 min read

Building a Sentinel Detection Lab, Part 6: Shadow AI and the Detection That's Honest About What It Hasn't Proven Yet

Repo: github.com/Kajal-Dhanjal/sentinel-detection-lab Five detections in, every one of them pointed at a fairly traditional attacker: brute force, malicious PowerShell, registry persistence, recon, an

0

KDKajal Dhanjalkajalbuilds.hashnode.devJun 30 · 4 min read

Building a Sentinel Detection Lab, Part 7: The Detection That Taught Me My Own Telemetry's Blind Spot

Repo: github.com/Kajal-Dhanjal/sentinel-detection-lab Part 6 caught AI tooling launching. The natural next question was what happens once it's running—specifically, where does it talk to? This is the

0

KDKajal Dhanjalkajalbuilds.hashnode.devJun 30 · 4 min read

Building a Sentinel Detection Lab, Part 8: Watching for Agents, Not Just Attackers

Repo: github.com/Kajal-Dhanjal/sentinel-detection-lab Most process-lineage detections in SOC content are written to catch attackers—Office spawning PowerShell, a browser spawning cmd.exe. Part 8 is th

0

KDKajal Dhanjalkajalbuilds.hashnode.devJun 21 · 9 min read

Building a Sentinel Detection Lab, Part 5: MFA Registration, a Missing License, and the First Detection That Talks Back

https://github.com/Kajal-Dhanjal/sentinel-detection-lab Part 4 ended on this note: moving off the endpoint entirely and into identity, starting with attackers registering their own MFA methods on com

0

KDKajal Dhanjalkajalbuilds.hashnode.devJun 15 · 4 min read

Building a Sentinel Detection Lab, Part 3: My Detection Flagged Legitimate Windows Behavior — Here's How I Tuned It Without Going Blind

Part 3 of a series on building a detection engineering lab in Microsoft Sentinel. This post: registry persistence, a textbook false positive, and the single most important lesson in detection engineer

1

K

KDKajal Dhanjalkajalbuilds.hashnode.devJun 15 · 4 min read

Building a Sentinel Detection Lab, Part 2: Suspicious PowerShell, and Why Some Detections Need No Threshold

Part 2 of a series on building a detection engineering lab in Microsoft Sentinel. This post: hunting malicious PowerShell with Sysmon, and the difference between volume detections and signature detect

0

ODOlujimi David T.redis-simple-until-production.hashnode.devJun 8 · 5 min read

Redis: Simple Until Production

Redis is often praised for its speed and simplicity. A single command spins it up, and for many teams it starts life as a quick cache or a session store. But when you move from development to producti

0

ODOlujimi David T.redis-simple-until-production.hashnode.devJun 8 · 8 min read

Redis ACLs: Why a Private Network Isn’t Enough

Placing Redis inside a private network is a common first step, but it only controls who can reach Redis, not what they can do once they get there. By default, Redis requires no authentication and list

0

SKSuren Krmoiannestjs-redis.hashnode.devApr 21 · 2 min read

Mastering Redis Sentinel with NestJS and RedisX

Redis Sentinel is like the unsung hero in the world of Redis deployments. It's all about keeping your Redis instances running smoothly with high availability. But when you throw NestJS and RedisX into the mix, things get even more interesting. Let's ...

0

#sentinel

#sentinel

Explore Hashnode

Trending tags this week

FortiBleed had around twenty people. JadePuffer had an agent. The way in was identical.

Building a Sentinel Detection Lab, Part 6: Shadow AI and the Detection That's Honest About What It Hasn't Proven Yet

Building a Sentinel Detection Lab, Part 7: The Detection That Taught Me My Own Telemetry's Blind Spot

Building a Sentinel Detection Lab, Part 8: Watching for Agents, Not Just Attackers

Building a Sentinel Detection Lab, Part 5: MFA Registration, a Missing License, and the First Detection That Talks Back

Building a Sentinel Detection Lab, Part 3: My Detection Flagged Legitimate Windows Behavior — Here's How I Tuned It Without Going Blind

Building a Sentinel Detection Lab, Part 2: Suspicious PowerShell, and Why Some Detections Need No Threshold

Redis: Simple Until Production

Redis ACLs: Why a Private Network Isn’t Enough

Mastering Redis Sentinel with NestJS and RedisX

#sentinel

Search Hashnode

#sentinel

Explore Hashnode

Trending tags this week

FortiBleed had around twenty people. JadePuffer had an agent. The way in was identical.

Building a Sentinel Detection Lab, Part 6: Shadow AI and the Detection That's Honest About What It Hasn't Proven Yet

Building a Sentinel Detection Lab, Part 7: The Detection That Taught Me My Own Telemetry's Blind Spot

Building a Sentinel Detection Lab, Part 8: Watching for Agents, Not Just Attackers

Building a Sentinel Detection Lab, Part 5: MFA Registration, a Missing License, and the First Detection That Talks Back

Building a Sentinel Detection Lab, Part 3: My Detection Flagged Legitimate Windows Behavior — Here's How I Tuned It Without Going Blind

Building a Sentinel Detection Lab, Part 2: Suspicious PowerShell, and Why Some Detections Need No Threshold

Redis: Simple Until Production

Redis ACLs: Why a Private Network Isn’t Enough

Mastering Redis Sentinel with NestJS and RedisX