🧰 Microsoft Defender XDR

The items that name it 22

• Inside a malicious Claude Code-branded extension and its persistent SSH backdoor
  writeupas tools2026-10-31

  Provides detections, threat analytics and advanced hunting queries (DeviceNetworkEvents, DeviceFileEvents, DeviceEvents) to find affected systems and artifacts of the backdoor.

• From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths
  writeupas tools2026-10-30

  Connects collaboration, endpoint, identity, certificate and Kerberos signals; provides detections, attack disruption and advanced hunting.

• Tracking AI adoption in North Korean threat actor tradecraft
  articleas tools2026-10-29It is written here as Microsoft Defender XDR (automatic attack disruption, attack surface reduction rules, threat analytics reports).

  automatic attack disruption, attack surface reduction rules, threat analytics reports

• Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks
  writeupas classification.technologies2026-10-23
• AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
  writeupas classification.technologies2026-10-21
• The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime
  articleas tools2026-10-14It is written here as Microsoft Defender XDR: threat analytics reports and detections for downstream activity.
• Tracking CVE-2026-73570: unauthenticated command injection on internet-facing mail servers
  writeupas classification.technologies2026-09-30
• Phishing Abuses RMM Tools for Persistent Access
  writeupas tools2026-09-29

  Coordinates detection, prevention, investigation, and response across endpoints, identities, email, and apps; provides Threat Analytics and threat intelligence reporting for this campaign.

• Star Blizzard refines phishing and malware delivery with the RedFlick technique
  writeupas tools2026-09-29

  Advanced hunting queries and threat analytics reports to detect related Star Blizzard activity

• NeedyMantis: Unpacking a post-compromise malware family used in targeted operations
  writeupas tools2026-09-28

  Coordinates detection, prevention, investigation and response; provides automatic attack disruption, attack surface reduction rules, and advanced hunting queries

• Storm-3168: Agentic-driven cloud attacks using compromised service principals
  writeupas tools2026-09-25

  Coordinates detection, prevention, investigation, and response across cloud, endpoints, identities, email, and apps; provides threat analytics reports for this activity

• Passkey-themed social engineering leads to identity and cloud compromise
  writeupas tools2026-09-09

  Coordinates detection, prevention, investigation, and response across endpoints, identities, email, and apps; provides detection coverage for the described TTPs.

• When AI infrastructure becomes the target: Securing gateways and control points | Microsoft Security Blog
  articleas tools2026-08-26

  Provides Advanced hunting queries used to detect gateway-originated execution, secret access, payload staging, persistence, and outbound communication associated with this intrusion

• [tl;dr sec] #340 - Anthropic and Meta Agents be Hackin', Agentic Incident Response Notebooks, Figma's AI Code Scanning
  articleas tools2026-08-07

  Queried with KQL through the notebook SDK.

• Anatomy of a Deno-Based Proxy & RAT
  writeupas tools2026-06-15

  EDR/XDR platform providing telemetry and alerts, including Teams-related detections

• Optimizing the SOC
  articleas classification.technologies2024-12-07
• Microsoft Defender XDR's Deception Technology
  writeupas affected products2024-10-10

  Deception technology capability; decoy accounts and hosts logged into nearly every device in an organization, mistaken for suspicious/unauthorized accounts by customers

• Practical Temporal Proximity in KQL
  writeupas affected products2024-09-15

  Telemetry limitations discussed, e.g. DeviceImageLoadEvents not reliable for detecting library load order/timing

• Simplifying User and Entity Behavior Detection
  writeupas classification.technologies2024-07-07
• Today I Learned - Device Discovery
  writeupas classification.technologies2024-04-27
• Stack Your Deception: Stacking MDE Deception Rules with Thinkst Canarytokens
  writeupas classification.technologies2024-04-21
• Enhancing Your Entity Timelines: Sentinel Activities in the Unified Microsoft Defender XDR Portal
  writeupas classification.technologies2024-04-13