Cloud Security Architecture & AI Defense

Dikshant Lather · Sep 25, 2026

Detecting DNS Tunneling and High-Volume Data Exfiltration with Sentinel KQL

Uncover covert C2 communication channels and DNS data exfiltration using string length thresholds and subdomain entropy analysis in KQL.

Network Security 2 min read

0 0

Dikshant Lather · Sep 25, 2026

Identifying Inactive and Dormant Service Principals Misuse in Microsoft Entra ID

Detect sudden activity from long-dormant Service Principals and App Registrations that may indicate compromised client secrets or abandoned credentials.

Identity Security 2 min read

0 0

Dikshant Lather · Sep 25, 2026

Spotting Web Shell Execution: Web Server Spawning Suspicious Child Processes

Detect web server compromises and web shell activity by identifying suspicious interactive shells spawned by IIS (w3wp.exe), Nginx, or Apache.

Endpoint Detection 2 min read

0 0

Dikshant Lather · Sep 25, 2026

Detecting Persistence via Windows Scheduled Task Creation Using KQL

Hunt for adversary persistence via unauthorized Windows Scheduled Tasks by parsing Security Event ID 4698 and DeviceProcessEvents in KQL.

Threat Hunting 2 min read

0 0

Dikshant Lather · Sep 25, 2026

Detecting MFA Fatigue and Push Notification Bombing in Microsoft Entra ID

Catch MFA push notification bombing attacks where attackers trigger repeated authentication requests until the victim accidentally approves access.

Identity Security 2 min read

0 0

Dikshant Lather · Sep 25, 2026

Uncovering Malicious Windows Service Installation via Event ID 7045 and Defender KQL

Catch lateral movement and persistence tools (PsExec, Cobalt Strike PsExec service) by monitoring new Windows Service installations with KQL.

Threat Hunting 2 min read

0 0

Dikshant Lather · Sep 25, 2026

Detect Password Spray Attacks in Microsoft Entra ID Using KQL

Learn how to detect distributed password spray attacks targeting Microsoft Entra ID using advanced KQL queries, threshold aggregation, and IP failure rate analysis.

Identity Security 2 min read

0 0

Dikshant Lather · Sep 25, 2026

Hunting for Impossible Travel and Anomalous Token Sign-Ins in Sentinel

Detect geographic anomalies, session cookie theft, and impossible travel patterns across cloud user logins using geospatial distance calculation functions in KQL.

Identity Security 2 min read

0 0