Each feed is checked for new posts. Every post is read, and those that belong here join the catalog. What Trove read and did not keep stays on file, not shown.
A hands-on guide to wiring Microsoft Sentinel Workbooks to Logic Apps (playbooks) using the ARM Action link and HTTP request trigger, allowing analysts to export arbitrary workbook column data as parameters and POST it to a playbook without requiring an Incident/Entity ID. The author flags that this pipes untrusted attacker-controlled data (URLs, command lines) into downstream automation, and notes example WAF/XSS events can trigger HTML injection directly in the workbook via the URI parameter.
Microsoft SentinelAzure Logic AppsAzure Resource Manager
A blog post that provides three concrete KQL queries for Microsoft Sentinel/Log Analytics to detect Conditional Access Policy (CAP) violations in Entra ID: single-factor sign-ins by privileged admins that should require MFA, group members bypassing trusted-location/device-compliance requirements, and resources with no Conditional Access applied at all. It also surveys community tooling for CAP gap analysis, including the built-in Gap Analyzer Workbook, Maester, CA Optics, DCToolbox's What-if simulator, and Beau Bullock's MFASweep. The approach turns an organization's intended CAP strategy into ongoing detection logic rather than one-time policy review.
KQLMicrosoft Entra IDMicrosoft Sentinel
MaesterMFASweepCA Optics+1
Blue Team & Detection, Identity & Access· 2025-03-23T14:32:18+00:00
A blue-team operations guide for optimizing a Microsoft Sentinel/Defender XDR SOC, compiling community-built workbooks and techniques for four problem areas: data collection health (ingestion anomaly detection workbook, KQL-based ingestion-failure alerts, Azure Policy for enforcing DCR association on Arc-managed servers), analytic rule false-positive triage (Bert-Jan's Analytic Rules Efficiency KQL query, referencing Anton Chuvakin's alert fatigue research), MITRE ATT&CK coverage mapping (Sentinel ATT&CK Map, Use Case Mapper workbook), and Logic Apps/playbook health monitoring via the built-in Playbooks health workbook and Azure Monitor alert rules. It's a curated roundup of community solutions rather than original research, aimed at reducing analyst alert fatigue and closing detection gaps.
Microsoft SentinelMicrosoft Defender XDRKQL+2
Blue Team & Detection, Cloud & Infra· 2024-12-07T22:32:18+00:00
A technical KQL deep-dive on detecting hands-on-keyboard attacker activity by correlating multiple suspicious process executions (route.exe, quser.exe, curl.exe, setspn.exe, klist.exe) within a time window on the same device. The author explains why bin()/bin_at() bucketing and Near-Real-Time (NRT) analytic rules are unreliable for temporal-proximity detections, then walks through using the row_window_session() window function with MaxDistanceFromFirst, MaxDistanceBetweenNeighbors, and a Restart expression to build accurate session-based correlation across DeviceProcessEvents in Microsoft Defender XDR.
A detection engineering methodology post arguing that UEBA/behavior detections should be built around defining undesirable 'states/conditions' rather than chasing mutable 'activity', citing Florian Roth's detection engineering framework. It walks through a worked example: detecting Shadow Credentials attacks (anomalous additions to the AD msDS-KeyCredentialLink attribute) by correlating Windows Event ID 5136 (directory service object modified) with Event ID 4624 (logon) and Microsoft Defender XDR's DeviceNetworkInfo table to flag KCL writes originating from IPs never associated with the target computer, complete with a full KQL query.
KQLActive DirectoryMicrosoft Defender XDR
Shadow CredentialsElad ShamirChristoph Falta+4
Blue Team & Detection, Identity & Access· 2024-07-07T17:34:24+00:00
A practical deception-engineering guide showing how to "stack" Microsoft Defender XDR's native Deception rules (basic/advanced lures, decoy hosts, credentials) with Thinkst Canarytokens (tokenized PDFs, custom EXEs, DNS/AWS-key tokens) to close detection gaps. It walks through generating tokens on Canarytokens.com, embedding them as lure files in Defender XDR deception rules, and routing alerts via email/Teams/Slack or an Azure Logic App into Microsoft Sentinel for SOC-integrated incident creation.
Microsoft Defender XDRCanarytokensMicrosoft Sentinel+2
A practical guide to the "Sentinel activities" feature in the unified Microsoft Sentinel/Defender XDR portal, which surfaces entity behavior (alerts, bookmarks, anomalies, custom activities) directly on identity/device/IP pages. The author walks through creating a custom activity that queries an OktaSSO custom log table via KQL to flag privileged Okta changes made by a user, then displays the enriched result in that user's entity timeline, and notes current limitations (no historical backfill, no pivot-to-hunting link).
attackthesoc.comarticle
