Cloud Security Architecture & AI Defense

Dikshant Lather · Sep 25, 2026

Hunting for Cobalt Strike and C2 Periodic Beaconing Using DeviceNetworkEvents

Detect outbound Command and Control beaconing patterns with low interval variance using statistical time-delta functions in Defender XDR KQL.

Network Security 2 min read

0 0

Dikshant Lather · Sep 25, 2026

Detecting Brute Force Attacks Followed by Successful Logon in Microsoft Sentinel

Correlate failed sign-ins followed by a successful authentication within a short time window to immediately flag compromised user accounts.

Incident Response 2 min read

0 0

Dikshant Lather · Sep 25, 2026

Detecting Suspicious Microsoft 365 Inbox Forwarding Rules Using OfficeActivity

Halt Business Email Compromise (BEC) fraud by catching covert Exchange Online inbox rules forwarding emails to external domains.

Cloud Security 2 min read

0 0

Dikshant Lather · Sep 25, 2026

Detecting Shadow IT and Massive Cloud Storage Uploads in Enterprise Networks

Monitor unauthorized data transfers to personal cloud storage providers (MEGA, Dropbox, WeTransfer) using byte-count aggregation in KQL.

Network Security 1 min read

0 0

Dikshant Lather · Sep 25, 2026

Uncovering Local Windows Account Creation via Command Line with KQL

Spot unauthorized backdoor user accounts created on endpoints via net.exe, net1.exe, and PowerShell local user management cmdlets.

Threat Hunting 2 min read

0 0

Dikshant Lather · Sep 25, 2026

Detecting Defender Antivirus Tamper Protection Disablement and Registry Evasion

Alert when ransomware or attackers attempt to disable Microsoft Defender Real-Time Monitoring and Antivirus via registry tampering.

Endpoint Detection 2 min read

0 0

Dikshant Lather · Sep 25, 2026

Identifying Rogue Azure Subscription Role Assignments and Privilege Escalation

Monitor high-privilege Azure RBAC grant operations (Owner, Contributor, User Access Administrator) in AzureActivity logs using proactive KQL alert rules.

Cloud Security 2 min read

0 0

Dikshant Lather · Sep 25, 2026

Identifying Inactive and Dormant Service Principals Misuse in Microsoft Entra ID

Detect sudden activity from long-dormant Service Principals and App Registrations that may indicate compromised client secrets or abandoned credentials.

Identity Security 2 min read

0 0