KQL Search

Benjamin ZulligerOct 13, 2026

Bert-Jan PalsOct 13, 2026

Michalis MichalosOct 8, 2026

David AlonsoOct 7, 2026

Benjamin ZulligerOct 5, 2026

Bert-Jan PalsOct 4, 2026

Jay KeraiOct 2, 2026

David AlonsoOct 2, 2026

Benjamin ZulligerSep 30, 2026

Sergio AlbeaSep 30, 2026

Benjamin ZulligerSep 30, 2026

Benjamin ZulligerSep 29, 2026

Bert-Jan PalsSep 28, 2026

Benjamin ZulligerSep 28, 2026

Our Sponsors ❤️

Key Vault Secret Access From New IP Address Per Identity

Renamed System And Third Party Binaries With Signature Context

Browser Cache Smuggling Payload Extraction And Execution

Risky Sign In Followedby Key Vault Activity

Suspicious Key Vault Enumerationor Reads

Delivered Mail Carrying Exfiltration Style Urls

Pivot In Every Prompt Injection Detection For Investigation

Uncover Every Prompt Injection Detection And Its Disposition

CAND 001 Sentinel

CAND 001

CAND 002 Guardrail Enriched

Agent Observability Preflight

Workspace Preflight

Data Staging Via Potential Stealer Activity

UAC Weakening And Persistence Mechanism Detection

Entra Trace Azure AD Graph User Agent Matches

Entra Trace Microsoft Graph User Agent Matches

Entra Trace Sign In User Agent Matches

Stale Cloud Accounts With Sign Ins On Prem

Stale On Prem Accounts With Cloud Sign Ins

Entra App Instance Property Lock Tampering Service Principal Lock Configuration

01 Agent Entitlement Materialization

02 Observed Permission Usage

03 Service Principal Context And Risk

04 Blast Radius Dependency Rollup

05 Agentsinfo Blueprint And Identity Snapshot

06 Cloudappevents Agent Execution Spans

07 Sentinel Datalake Agent Tables Preflight

08 Datalake Agent Identity Inventory Job

09 Datalake Unified Agent Executions Job

10 Canonical Permission Edge Contract

Detecting Non Latin Characters With KQL

Threat Hunting Microsoft Teams Calls By TLD

Mail Bombing Followed By External Teams Contact And Remote Access Execution

Kubernetes Container Escape

Kubernetes Suspicious Probing And Subsequent Escalation Activity

Crypto Miner Or Scanning Tool Execution In Kubernetes Container

Suspicious Credential Access And Process Memory Enumeration In Kubernetes Containers

Community Repositories

Multi Stage Social Engineering Attack Mail Bombing External Teams Phishing And RMM Execution

W Script C Script Executing Java Script From User Profile

Unusual Access To Helm Secrets In Kubernetes

Suspicious Shell Execution From Container Web Service

Kubernetes Suspicious Daemon Set Or Cron Job Creation

Suspicious Kubernetes Admission Controller Webhook Creation

New Privileged Kubernetes Workload Detected

Unauthorized Kubelet API Or Proxy Access

Anomalous Azure Kubernetes Service Administrative Activity

Unusual Kubelet Node Authentication Activity

Kubernetes Suspicious Service Account Creation And Token Minting

Our Sponsors