#microsoft-defender-xdr

Follow the File Hash: Hunting for Sensitive Files Leaving Your Organization with Defender Advanced…

Imagine you’re asked a seemingly simple question: “Show me files labeled as Confidential that were sent as email attachments to free public…

When Attackers Hijack Your Inbox: Detecting Mailbox Forwarding Rules with Microsoft Defender XDR

Business Email Compromise (BEC) attacks continue to be one of the most common and costly cyber threats for organizations today. Once…

Onboard MDE ด้วย .EXE สำเร็จรูปตัวใหม่ ไฉไลกว่า Script เดิมมากกกก

สมัยก่อน เราจะต้อง Onboard เครื่องเอนด์พอยต์ในองค์กร เพื่อติดตั้ง Sensor เข้ากับ EDR อย่าง Microsoft Defender for Endpoint (MDE)…

You Assume Your Logs Are Flowing.

A detection that never fires looks exactly like a peaceful night. The only way to tell the difference between “nothing is wrong” and “we…

Hunting for USB anomalous devices

Yes, yes… I know. You have USB storage devices blocked by policy. Fine. But that does not mean you don’t have to worry about other devices…

The Blind Spot in the Watchtower: Detections for When Someone Attacks Your Sentinel

Your SIEM monitors everything in your environment, but it rarely monitors itself the first thing an attacker will try to access.Today…

AiTM Attack Anatomy - Hunting Stolen Tokens in Microsoft Defender XDR

Microsoft Sentinel Automation Lab: Building an End-to-End SOAR Workflow

I am a SOC Analyst currently focused on developing practical experience across Microsoft security ecosystem, particularly within SIEM and…

Day 5 of Learning Cybersecurity: My First Alert and Incident

If you have been following my previous articles, you would know that I successfully ingested logs into my Log Analytics workspace. It was…

Day 4 of cybersecurity: Setting up Microsoft Sentinel from Scratch (Beginner’s Journey — Part 1)

Recently, I started learning Microsoft Defender XDR solutions and Microsoft Sentinel. One of the most common pieces of advice I came across…

3 ข้อเช็คลิสต์ต้องทำ ก่อนใช้ Microsoft Purview ค่ะ ❤

Microsoft Purview ชื่อเดิมคือ Purview Compliance หรือเดิมกว่านั้นอีกคือ M365 Compliance Portal ปัจจุบันเป็น SaaS ที่ใช้ทำ Compliance และ…

ได้เมลเตือน Unusual File Sharing บ่อยมากกก สำคัญ? กับ Purview Compliance Alert

ใครเป็นแอดมิน M365 โดยเฉพาะที่มีไลเซนส์ขั้นต่ำเป็น Business Premium ที่เปิดใช้บริการความปลอดภัยข้อมูลอย่าง Microsoft Purview…

Vulnerability response in Microsoft Security tools (Defender XDR, Cloud & EASM)

New vulnerability announcements are a familiar pattern: a CVE drops late on a Friday or during the holidays, a proof of concept quickly…

🧠 Threat Hunting Campaign Ideas with Microsoft Defender XDR

🎯 Goal: Develop and run cohesive threat hunting campaigns that bridge the gap between manual hunts and automated detections.

TryHackMe: Defending Azure — My Review

TL;DR