DeviceInfoDeviceTvmSoftwareVulnerabilities+1Device Vulnerability Software Evidence DetailsBenjamin Zulliger•Aug 19, 2026
DeviceInfoDeviceProcessEvents+2Hunting CVE 2026 65400 Exploitation On Mac OSSergio Albea•Aug 19, 2026
search_kql_queriesget_kql_query+1Add KQL Search MCP In VS Code Github CopilotBenjamin Zulliger•Aug 18, 2026
EmailEventsMessageEvents+2Multi Stage Social Engineering Attack Mail Bombing External Teams Phishing And RMM ExecutionBenjamin Zulliger•Aug 17, 2026
DeviceRegistryEventsDeviceProcessEvents+2Suspicious Windows Defender Exclusion Added For Uncommon FilesBenjamin Zulliger•Aug 17, 2026
DeviceProcessEventsSQL Server Engine Process Spawned Suspicious Shell Or LOL BinBenjamin Zulliger•Aug 13, 2026
DeviceProcessEventsDeviceFileEventsWindows Privilege Escalation Using Dangerous Token PrivilegesBenjamin Zulliger•Aug 13, 2026
DeviceInfoDeviceProcessEventsLinux Sudo Abuse And GTFO Bins Escalation DetectionBenjamin Zulliger•Aug 13, 2026
SigninLogsAnomalous Windows Hello For Business Sign In Without Device IDBenjamin Zulliger•Aug 11, 2026
IntuneDeviceComplianceOrgIdentityQueryEventsSuspicious LDAP Reconnaissance From Non Compliant DevicesBenjamin Zulliger•Aug 11, 2026
CloudAppEventsCloud App Events No Threats Found By AIR Investigation In Phishing SubmissionJose Sebastián Canós•Jul 29, 2026
EntraIdSignInEventsDetecting Connections Affected By The Blocking Legacy Authentication Enforcement Expected By July 2025Sergio Albea•Jul 28, 2026
