Sign In
Insights & Guides

The Attacks You'll Investigate. The Detections You'll Write. The Decisions You'll Defend.

Practical analysis of real attack patterns, detection techniques, identity security, and operational judgment, written by the professionals who build the courses. Every post teaches something you can apply at work this week.

Browse by Topic ↓ All Posts Unlock the Full Course →
Detection Engineering17Security Operations11Incident Response8Identity Security6Compliance & Audit10Security Architecture2
Latest Device Code Phishing Uses Microsoft's Real Sign-In Page. Here's What Your Logs Still Show. 10 November 2026 · Identity Security · 15 min read Device code phishing passes MFA on Microsoft's own page. Find it in sign-in logs, catch the device registration that follows, and block the flow safely. Read post →

Detection Engineering

Detection rules that survive contact with production: what a rule actually fires on, how to measure coverage against ATT&CK, and how to tune without losing the true positives. KQL, Sigma and SPL, side by side.

27 October 2026 · 11 min The Remote Session Columns in Defender Don't Describe PowerShell Remoting 7 October 2026 · 9 min PowerShell Accepts Spellings of -EncodedCommand Your Detection Has Never Seen 4 August 2026 · 11 min The Hunt That Found Nothing 21 July 2026 · 9 min One Failed Login Is Noise. The Same Failure Across Sixty Accounts Is a Spray Your Rule Can't Count. 14 July 2026 · 9 min Your Sigma Rule Converts Cleanly and Still Never Fires. Here's the Test That Catches It. 2 July 2026 · 11 min Detecting Malicious Scheduled Tasks: The Persistence That Survives Your Cleanup 16 June 2026 · 10 min Catch C2 Beaconing by Its Cadence in Sentinel and Splunk 15 June 2026 · 9 min The EC2 Credential-Theft Detection Most Teams Ship Wrong 9 June 2026 · 9 min Your Noisy Rule Has 200 False Positives a Day. Don't Suppress the Field That's Making Noise. 4 June 2026 · 9 min KQL SigninLogs, The 10 Queries Every SOC Analyst Runs First 2 June 2026 · 9 min You Deployed 350 Detection Rules. Only 50 Fire Regularly. Are the Other 300 Working? 20 May 2026 · 12 min Credential Access Detection Beyond LSASS, The Five Techniques Your Rules Are Missing 19 May 2026 · 9 min Is Your Detection Program Effective? And How Would You Know? 16 May 2026 · 10 min KQL Sign-In Log Analysis, What ResultType != 0 Actually Tells You 3 May 2026 · 9 min Five KQL Threat Hunts Every M365 SOC Should Run This Month 15 April 2026 · 7 min The M365 Detections Microsoft Doesn't Give You 7 April 2026 · 5 min Five auditd Rules That Catch Kernel Module Rootkits Before They Load

All Detection Engineering posts →

Security Architecture

Decisions that shape everything downstream: Zero Trust design in Microsoft 365, identity governance, and the architecture decision records that explain to the next engineer why it was built this way.

20 October 2026 · 9 min Your Break-Glass Account Is Excluded From Every Policy. It Still May Not Get You In. 7 July 2026 · 14 min Core Security Settings to Secure Your Active Directory Environment

All Security Architecture posts →

The blog shows you what's possible. The courses make you capable.

Every technique, detection rule, and investigation method referenced in these posts is taught in depth across the course catalog. Start with the course preview.

Unlock the Full Course Browse All Courses