Learn how to build high-order behavioral detections for Windows and Entra ID attack activity that remain resilient to evasion and can be adapted across tools.

Learn how to build high-order behavioral detections for Windows and Entra ID attack activity that remain resilient to evasion and can be adapted across tools.

Learn the core knowledge and practical skills required to perform effective threat hunting in real-world environments.

Somebody from Elastic Security decided to post an exploit for CVE-2025–14847 on Christmas Day.

Mega savings on KQL courses for threat hunting, detection engineering, and incident response.

Mega savings on KQL courses for threat hunting, detection engineering, and incident response.

Learn how to query Azure Resource Graph using KQL without hitting limits.

The best guide to homelabs just got a lot better—and bigger.

Detect BadSuccessor attacks exploiting dMSA in Windows Server 2025. Learn key detection methods and auditing configurations.

Detect vulnerable Windows drivers in MDE the right way using KQL and LOLDrivers.io. Avoid common query mistakes and boost detection accuracy.

Detect vulnerable Windows drivers in MDE the right way using KQL and LOLDrivers.io. Avoid common query mistakes and boost detection accuracy.

Master KQL for threat hunting, detection engineering, and incident response in a hyper-realistic lab environment using real logs!

Learn the basics of KQL to start your journey into security investigations, threat hunting, and detection engineering with hands-on experience in a hyper-realistic lab environment! Certificate of Com...

At its core — cybersecurity revolves around data.

Detecting C2 Beaconing using MDE Aggregated Report Telemetry.

Sliding window functions are one of the powerful methods for accurate detections as they eliminate the potential false negatives. They can be used in threat hunting, detection engineering, and DFIR to...

Window functions are one of the powerful methods for data analysis. They can be used in threat hunting, detection engineering, and DFIR to solve complicated use cases.

Let's learn how to set up our own private network for secure self-hosted services.

Dev Tunnels is a tunneling service that can boost your productivity when testing and debugging web apps, webhooks, APIs, and more

Mastering log Ingestion delay in detection engineering to avoid false positives, false negatives, and improve accuracy.

Simple pure PowerShell POC to bypass Entra / Intune Compliance Conditional Access Policy - zh54321/PoCEntraDeviceComplianceBypass

Written by Michaela Adams, Roman Daszczyszak, Steve Luke.

Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language). - Cyb3r-Monk/Threat-Hunting-and-Detection

When it comes to learning a new technical skill, there’s nothing like a hands-on course to make it stick. That’s especially true for security analysts diving into KQL, Microsoft’s query language that ...

Hidden gems in the SecurityAlert table in Microsoft Sentinel that can supercharge your investigation and automation workflows.

there's something nice about 65 degree weather in the desert

Alternative methods for EDR Silencers for blocking EDR communication to disable defenses.

Mega savings are here

All the deals for InfoSec related software/tools this Black Friday - 0x90n/InfoSec-Black-Friday

Detecting AiTM Phishing and other Account Takeover Attacks

Learn about Windows Firewall dynamic keywords and how to configure it using Windows PowerShell.