KQL Search

Benjamin ZulligerSep 29, 2026

Bert-Jan PalsSep 28, 2026

Benjamin ZulligerSep 28, 2026

Jay KeraiSep 27, 2026

Sergio AlbeaSep 26, 2026

Sergio AlbeaSep 25, 2026

Benjamin ZulligerSep 25, 2026

David AlonsoSep 24, 2026

Benjamin ZulligerSep 24, 2026

David AlonsoSep 17, 2026

Our Sponsors ❤️

Detecting Non Latin Characters With KQL

Kubernetes Container Escape

Kubernetes Suspicious Probing And Subsequent Escalation Activity

Crypto Miner Or Scanning Tool Execution In Kubernetes Container

Suspicious Credential Access And Process Memory Enumeration In Kubernetes Containers

Community Repositories

Multi Stage Social Engineering Attack Mail Bombing External Teams Phishing And RMM Execution

W Script C Script Executing Java Script From User Profile

Unusual Access To Helm Secrets In Kubernetes

Suspicious Shell Execution From Container Web Service

Kubernetes Suspicious Daemon Set Or Cron Job Creation

Suspicious Kubernetes Admission Controller Webhook Creation

New Privileged Kubernetes Workload Detected

Unauthorized Kubelet API Or Proxy Access

Anomalous Azure Kubernetes Service Administrative Activity

Unusual Kubelet Node Authentication Activity

Kubernetes Suspicious Service Account Creation And Token Minting

Azure Kubernetes Service Pod Accessing Instance Metadata API

Anomalous Kubernetes Service Account API Activity

Modifications To Azure DNS Zones

Hunting Invisible Unicode In Emails

Kubernetes Security Configuration Tampering

Kubernetes Workload Creation From Unapproved Registry

Kubernetes API Discovery From Workload

Kubernetes Pod Accessing Service Account Tokens

Suspicious Shell And Tooling Activity In Containerized Environment

Interactive Access To Kubernetes Pods By Unusual User

Kubernetes Secret Enumeration By Non Admin Identity

Kubernetes Cluster Admin Role Binding Created Or Modified

Kubernetes Privileged Or Host Sensitive Workload Creation

MDO 20 Teams Safe Links Click Through

Kubernetes Container Reverse Shell Execution

Suspicious Activity Detected In Containerized Environment

New Unusual Process Execution In Container

Vulnerability Statistics Logic App Sentinel Workbook

Anomalous NTLM Logon Pattern To Multiple Device Groups Lateral Movement Behavior

Foundry Mcp Unapproved Server Execution

Foundry Tool Error Storm

APIM Latency Baseline Anomaly

APIM Request Dependency Correlation

APIM Request Exception Correlation

APIM Request Volume Baseline

APIM Unusual Operation Combination

APIM Abnormal Request Volume

APIM Api Enumeration

APIM High Failure Rate

APIM New Country For Known Caller

APIM New Operation First Seen

APIM Repeated Unauthorized Requests

Our Sponsors