🧰 KQL

The items that name it 15

• Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks
  writeupas classification.technologies2026-10-23
• AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
  writeupas classification.technologies2026-10-21
• DFIR Radar (@DFIR_Radar) on X
  threadas classification.technologies2026-10-19
• Tracking CVE-2026-73570: unauthenticated command injection on internet-facing mail servers
  writeupas classification.technologies2026-09-30
• ThreatIntel-Aggregator
  repoas tools2026-09-17

  Detection query language used for Sentinel/Defender rules, statically validated on import

• How to Spot and Stop Rogue Device Joins
  writeupas classification.technologies2026-08-18
• hunt.md
  repoas classification.technologies2026-08-17
• Anatomy of a Deno-Based Proxy & RAT
  writeupas classification.technologies2026-06-15
• Azure Storage Account Attacks and Detections
  writeupas classification.technologies2025-12-15
• Using KQL to Detect Gaps in your Conditional Access Strategy
  writeupas tools2025-03-23It is written here as KQL (Kusto Query Language).

  Used to write detection queries against SigninLogs, IdentityInfo, and ExposureGraphEdges to find Conditional Access policy gaps

• Oh my .. ! - Suspicious network traffic detected including Ransomware
  writeupas classification.technologies2025-01-22
• Optimizing the SOC
  articleas classification.technologies2024-12-07
• Practical Temporal Proximity in KQL
  writeupas tools2024-09-15It is written here as KQL (Kusto Query Language).

  Query language used to build detections in Microsoft Defender/Sentinel, including bin(), bin_at(), row_window_session(), and serialize operator

• Simplifying User and Entity Behavior Detection
  writeupas tools2024-07-07It is written here as KQL (Kusto Query Language).

  Used to write the shadow credential detection query joining SecurityEvent and DeviceNetworkInfo tables

• Enhancing Your Entity Timelines: Sentinel Activities in the Unified Microsoft Defender XDR Portal
  writeupas tools2024-04-13It is written here as KQL (Kusto Query Language).

  Used to write custom activity queries against tables like OktaSSO to surface contextual entity data