Detecting Suspicious Base64 Encoded PowerShell Commands with Defender XDR KQL
Endpoint Detection
2 min read
Stories & Technical Research
Architecture guides, CSPM automation, and AI guardrail blueprints authored by Dikshant Lather and contributing practitioners.
All Topics
KQL
(20)
Cloud Security
(8)
Azure
(6)
DevSecOps
(6)
Entra ID
(5)
Microsoft Sentinel
(5)
AI Security
(4)
Threat Hunting
(4)
DeviceProcessEvents
(4)
SecurityEvent
(4)
Prompt Injection
(3)
GenAI
(3)
Identity Security
(3)
SigninLogs
(3)
Persistence
(3)
Zero Trust
(2)
AWS
(2)
LLM
(2)
IaC Security
(2)
Container Security
(2)
Workload Identity
(2)
Terraform
(2)
CI/CD
(2)
Azure RBAC
(2)
CloudTrail
(2)
SIEM
(2)
Secrets Management
(2)
LLM Security
(2)
Defender for Endpoint
(2)
Defender XDR
(2)
Credential Access
(2)
OfficeActivity
(2)
Exfiltration
(2)
DeviceNetworkEvents
(2)
IAM
(1)
Application Security
(1)
SAST
(1)
SCA
(1)
Azure Storage
(1)
Azure Policy
(1)
Data Security
(1)
Least Privilege
(1)
Azure PIM
(1)
JIT Access
(1)
Privileged Access
(1)
AWS IAM
(1)
Cloud Detection
(1)
GitHub Actions
(1)
GitHub
(1)
Gitleaks
(1)
Credential Security
(1)
Checkov
(1)
Trivy
(1)
IaC
(1)
Kubernetes
(1)
Secrets
(1)
AI Gateway
(1)
RAG Security
(1)
AI Agents
(1)
Tool Calling
(1)
Agentic AI
(1)
FinOps
(1)
Security Cost Optimization
(1)
Defender
(1)
Password Spray
(1)
Identity Protection
(1)
Impossible Travel
(1)
Session Hijacking
(1)
Token Theft
(1)
PowerShell
(1)
Execution
(1)
LSASS
(1)
Credential Dumping
(1)
Mimikatz
(1)
Scheduled Tasks
(1)
EventID 4698
(1)
AzureActivity
(1)
Privilege Escalation
(1)
Cloud Governance
(1)
Sentinel
(1)
Kerberoasting
(1)
Active Directory
(1)
EventID 4769
(1)
MFA Fatigue
(1)
Push Bombing
(1)
Authentication
(1)
Data Exfiltration
(1)
SharePoint
(1)
OneDrive
(1)
Insider Threat
(1)
System Services
(1)
EventID 7045
(1)
DeviceEvents
(1)
Brute Force
(1)
SOC Analytics
(1)
Azure Key Vault
(1)
AzureDiagnostics
(1)
Cloud Forensics
(1)
DNS Tunneling
(1)
DnsEvents
(1)
Network Forensics
(1)
C2 Beaconing
(1)
Cobalt Strike
(1)
Defender Tampering
(1)
Defense Evasion
(1)
DeviceRegistryEvents
(1)
Antivirus Bypass
(1)
Service Principals
(1)
App Registrations
(1)
AADServicePrincipalSignInLogs
(1)
Web Shells
(1)
Initial Access
(1)
IIS
(1)
Nginx
(1)
Apache
(1)
Business Email Compromise
(1)
BEC
(1)
Exchange Online
(1)
Mail Redirection
(1)
Shadow IT
(1)
Data Leakage
(1)
Local Accounts
(1)
Incident Response
(1)
Spotting LSASS Memory Dumping via Comsvcs.dll and Procdump in KQL
Detect credential theft targeting the Local Security Authority Subsystem Service (LSASS) via native LOLBINs like comsvcs.dll and Sysinternals ProcDump in KQL.
Endpoint Detection
2 min read
