Threat Hunting for Device Code Phishing: How Legitimate Microsoft Logins Can Be Abused
A Microsoft login page is usually reassuring. You're entering your credentials on a familiar...
Topic
Security Operations Center (SOC)
Microsoft Defender Automatic Attack Disruption: Balancing Automation and Control
The faster a security system can respond to an active attack, the less time the attacker has to...
Threat Hunting for SYSTEM Account Logins: Why Privileged Access Visibility Matters
Not all account activity carries the same level of risk.
A standard user login and a privileged...
Threat Hunting for Compromised Packages: Why Software Supply Chain Visibility Matters
Not every security risk begins inside your environment.
Sometimes, risk enters through tools,...
Threat Hunting for Known Threat Actor Activity: Why Proactive Validation Matters
Threat actor names often show up in security headlines, but the name itself is not the most...
Threat Hunting for Logins Outside the U.S.: Why Location Context Matters
A login location can tell your security team a lot, but it rarely tells the whole story.
In...
Threat Hunting for Azure PowerShell Logins: Why Admin Tool Usage Matters
Most users do not need to sign in through Azure PowerShell, Azure Active Directory PowerShell, or...
Threat Hunting for Blocked Sign-Ins With a Correct Password: Why Identity Context Matters
A failed login does not always mean the password was wrong.
People mistype passwords every day, so...
Threat Hunting for Suspicious Consented Applications: Why OAuth App Visibility Matters
Business email compromise does not always end when a password is changed.
In Microsoft 365...
Threat Hunting for Suspicious BITS Jobs: Why Background File Transfers Matter
Not every risky download starts in a browser.
In Windows environments, files can move through...