#microsoft-defender

Passing the New CRTE: Red Teaming a Modern Active Directory (Server 2025, Widows 11, MDI & MDE)

I recently passed the new version of the Certified Red Team Expert (CRTE) from Altered Security. This is the fully revamped edition, built…

Your Endpoints Are Running Local AI Agents — Can You See Them?

Learn how Microsoft Defender discovers local AI agents, and how to use Advanced Hunting and KQL to investigate agent usage across users…

Testing AI Threat Hunting against Real-World KQL: A Side-by-Side Test

A real-world experiment revealing where AI excels and where it still struggles. Here’s an honest breakdown of the gap.

Patch Tuesday de juin 2026 : l’IA débusque un nombre record de failles

Hidden in Plain Sight: PowerShell Visibility Most Defender XDR Analysts Miss

Discover how an often-overlooked telemetry source in Microsoft Defender XDR can reveal PowerShell script activity that traditional process…

AiTM Attack Anatomy - Hunting Stolen Tokens in Microsoft Defender XDR

Become a Defender — TryHackMe Answers | by Deepti Gupta

Platform: TryHackMe Room: Become a Defender Room URL: https://tryhackme.com/room/becomeadefender Difficulty: Easy Please attempt the room…

Agent 365 | Security Operations in Defender

Surface every AI agent in your tenant and expose the ones throwing security signals — across both the IT and SOC view. Triage high-severity…

Intro

Sometimes you encounter a base64 string but you don’t know the original text encoding. This guide shows a Python script that:

Understanding XOR Encryption + Jigsaw Obfuscation

In this research, I used a two-layer obfuscation approach: XOR Encryption followed by Jigsaw Obfuscation. Both techniques are simple yet…

Defender for Storage Bicep Fix: Malware Scanning

MDE &Intune Integration: How a Compromised Endpoint Gets Blocked in Real Time

Parts 1 and 2 covered MDE and Intune as separate platforms. This is where they become something more than the sum of their parts. When MDE…

Threat hunting — Popular process misbehaving

My favorite type of detection rules are the ones that do not rely on any upfront threat intelligence signals. No domains, IPs, commands…

Microsoft Defender for Cloud: Best Hybrid Cloud Security Strategy

Explore how Microsoft Defender for Cloud secures hybrid environments with advanced threat protection, visibility, and compliance. Learn key…

Unpacking Microsoft Defender for Office 365: A 30-Day SOC Triage Series

Welcome to Day 1 of a structured, 30-day deep dive into Microsoft Defender for Office 365 (MDO)—designed for IT professionals, SOC…

Defender for Cloud: Building Secure Workloads on AKS — Part 4

Containers and Kubernetes are central to modern development, yet security teams often face challenges that result in misconfigurations and…

Bypassing MDE’s AMSI Provider

AMSI

PART 2: A Complete Guide to Microsoft Defender for Cloud Apps (MDCA)

Cloud adoption has accelerated dramatically across organisations of all sizes. This shift has created enormous opportunities in…

🧠 Threat Hunting Campaign Ideas with Microsoft Defender XDR

🎯 Goal: Develop and run cohesive threat hunting campaigns that bridge the gap between manual hunts and automated detections.

The Evolution of Microsoft Defender for Office: A Comprehensive Overview

Microsoft Defender for Office (MDO) has often been criticized for lacking functionality and not catching all malicious emails. However…

Monitoring Administrative Actions in Microsoft Defender for Endpoint: Ensuring Compliance…

In today’s security landscape, visibility into administrative actions is not just a best practice; it’s a necessity. Microsoft Defender for…

Navigating Microsoft 365 Security and Compliance Features for Your Business

- Overview of the importance of security and compliance in the digital age.

Microsoft Announced Security Copilot (Microsoft Security + Open AI GPT4)

#How Microsoft Security Copilot Can Boost Your Cybersecurity Skills