Threat Hunting for Logins Outside the U.S.: Why Location Context Matters
A login location can tell your security team a lot, but it rarely tells the whole story.
In...
Topic
Security Operations Center (SOC)
Threat Hunting for Azure PowerShell Logins: Why Admin Tool Usage Matters
Most users do not need to sign in through Azure PowerShell, Azure Active Directory PowerShell, or...
Threat Hunting for Blocked Sign-Ins With a Correct Password: Why Identity Context Matters
A failed login does not always mean the password was wrong.
People mistype passwords every day, so...
Threat Hunting for Suspicious Consented Applications: Why OAuth App Visibility Matters
Business email compromise does not always end when a password is changed.
In Microsoft 365...
Threat Hunting for Suspicious BITS Jobs: Why Background File Transfers Matter
Not every risky download starts in a browser.
In Windows environments, files can move through...
Threat Hunting for PowerShell Activity: Lessons from Powercat
Some security concerns are easy to recognize. A known malware file, a suspicious login, or a...
Threat Hunting for Disabled System Restore: Why Endpoint Recovery Matters
Some attacker behaviors are designed to gain access. Others are designed to make recovery harder.
...