Mehmet Ergene

Check out my new blog on nested app authentication.

Querying Azure Resource Graph Without Limits Using KQL Learn how to query Azure Resource Graph using KQL without hitting limits.

🛑 Azure Resource Graph limits number of results to 1000 when queried from Sentinel or Defender XDR using KQL.

There is a little trick that lets you bypass these limits.🤓

🔗
academy.bluraven.io/blog/queryin...

#KQL #MicrosoftSentinel #AzureResourceGraph #DefenderXDR

Announcing The Homelab Almanac: Version 3.0 The best guide to homelabs just got a lot better—and bigger.

Hello, friends! I'm thrilled to announce that The Homelab Almanac, v3.0 has officially launched! There is a **ton** of new stuff in this version, including:

- Proper DNS
- PKI
- Automatic signed certificates
- New secrets management
- Proxmox clustering
- Cloud integration

Detecting BadSuccessor: Shorcut to Domain Admin Detect BadSuccessor attacks exploiting dMSA in Windows Server 2025. Learn key detection methods and auditing configurations.

🚨 BadSuccessor = Bad OPSEC

With the right audit config, it's pretty easy to detect BadSuccessor.

academy.bluraven.io/blog/detecti...

#ThreatHunting #DetectionEngineering #ThreatDetection
#BadSuccessor

Detecting Vulnerable Drivers (a.k.a. LOLDrivers) the Right Way Detect vulnerable Windows drivers in MDE the right way using KQL and LOLDrivers.io. Avoid common query mistakes and boost detection accuracy.

This blog is a little bitter, but it's what it is🫠

academy.bluraven.io/blog/detecti...

#ThreatHunting #DetectionEngineering

Detecting Vulnerable Drivers (a.k.a. LOLDrivers) the Right Way Detect vulnerable Windows drivers in MDE the right way using KQL and LOLDrivers.io. Avoid common query mistakes and boost detection accuracy.

This blog is a little bitter, but it's what it is🫠

academy.bluraven.io/blog/detecti...

#ThreatHunting #DetectionEngineering

Website is down?

🚨 Test your Lateral Movement investigation skills!

We have just added a new challenge to our FREE "Hands-On Introduction to KQL for Security Analysis" course!

You can even test your AI agents' skills 😉

#KQL #Kusto #MicrosoftSentinel #MicrosoftDefender

academy.bluraven.io/course/intro...

Home - Blu Raven Academy Master KQL for threat hunting, detection engineering, and incident response in a hyper-realistic lab environment using real logs!

🐣 HAPPY EASTER CAPSTONE! 🛡️

My KQL courses now include a complete attack scenario to test your skills — end to end.

🎯 Hands-on labs
📉 20% OFF for a limited time!
Crack it open 👇

#KQL #Kusto #ThreatHunting #DetectionEngineering #DFIR

academy.bluraven.io

🎁 NEW UPDATE:

I've added a small challenge to my FREE "Hands-On Introduction to KQL for Security Analysis" course.

More will be coming soon!

#KQL #Kusto #MicrosoftDefender #MicrosoftSentinel
academy.bluraven.io/course/intro...

Introduction to KQL for Security Analysis Learn the basics of KQL to start your journey into security investigations, threat hunting, and detection engineering with hands-on experience in a hyper-realistic lab environment! Certificate of Com...

🚨 FREE unlimited lab access to "Introduction to KQL for Security Analysis" course!

Thrilled to announce that my Intro to KQL for Security Analysis lab environment is now completely free with no time restrictions!

academy.bluraven.io/course/intro...

#KQL #Kusto #ThreatHunting #Infosec

🚨 Problem with Cyber Range/Training platforms ❓

Most range platforms and training labs provide you with all the questions to solve, hinting answers to other questions.

I've implemented a trick to hide some questions that reveal hints for other questions for a real-life experience.

Stay tuned.👀

Why Knowing How to Query is an Essential Cybersecurity Skill At its core — cybersecurity revolves around data.

osintteam.blog/why-knowing-...

C2 Beaconing Detection with MDE Aggregated Report Telemetry Detecting C2 Beaconing using MDE Aggregated Report Telemetry.

🚨 Detect C2 Beacons!

New Microsoft Defender for Endpoint telemetry provides new opportunities for threat detection!

🔗
academy.bluraven.io/blog/beaconi...


#ThreatHunting #DetectionEngineering #MDE

Advanced KQL for Threat Hunting: Window Functions — Part 2 Sliding window functions are one of the powerful methods for accurate detections as they eliminate the potential false negatives. They can be used in threat hunting, detection engineering, and DFIR to...

When you group your logs by timestamp(binning) to detect threats, you probably cause false negatives. Solve it using sliding window counts!

academy.bluraven.io/blog/advance...

#KQL #ThreatHunting #DetectionEngineering

It appears Microsoft quietly mitigated most of the risk of the "Intune company portal" device compliance CA bypass by restricting the scope of Azure AD graph tokens issued to this app, making them almost useless for most abuse scenarios. Thx @domchell.bsky.social for the heads up.

The phishing usually happens on a managed device, though 🤔

I used plaintext roadtx and then used roadrecon to dump Entra ID data. I even caused sign-in failures. There isn't any CAP in this tenant. Could that be the reason? AFAIK, it doesn't affect risk identification.

🥲 Seems like you don't even have to use residential proxies for device code phishing for evasion. Just get a machine in one of the cloud providers' corresponding regions. 🤷‍♂️

💙Fall in Love with Threat Hunting, Incident Response, and Detection Engineering using #KQL💙
Code: VLTN30
Valid until 17.02

#ThreatHunting
academy.bluraven.io

I'm for multivariate anomaly detection approach and scoring the results. However, this scoring is not static like "if X, then score += 10".

Advanced KQL for Threat Hunting: Window Functions — Part 1 Window functions are one of the powerful methods for data analysis. They can be used in threat hunting, detection engineering, and DFIR to solve complicated use cases.

Window functions do wonders!

academy.bluraven.io/blog/advance...

#ThreatHunting #KQL

🚨 Time to check your detection queries for MDE:

DLL load events are recorded in DeviceImageLoadEvents table, NOT DeviceEvents table. I keep seeing people sharing queries with the wrong table and even with the wrong ActionType filters.

Your Private Wireguard Network from Scratch Let's learn how to set up our own private network for secure self-hosted services.

Here it is: your complete guide to building a Wireguard network that doesn't require any open ports at home, and doesn't require any third-party tools. Just Wireguard, your devices, and a little elbow grease.

taggart-tech.com/wir...

How to Manage Dev Tunnels with Group Policies Dev Tunnels is a tunneling service that can boost your productivity when testing and debugging web apps, webhooks, APIs, and more

It seems like there is an easy way to block VS Code tunnels (Dev Tunnels) on Windows to prevent malicious usage. 😮

techcommunity.microsoft.com/blog/azurede...

#LOLBAS project update:

Entries now have placeholders for paths, URLs, and more. This makes it easier to visually see what parts are "variable", and for LOLBAS API users (lolbas-project.github.io/api/) it'll be easier to use with automation.

Check it out:
⭐ lolbas-project.github.io

Tell me a single windows logon event (network logon) that shows the IP address, Port, and if the logon has admin privileges.

I don't have insights into everything but I don't think so from my experience.

Detectable by Design?
We keep failing on "shift left", "secure by design", etc. to prevent malicious activities.
How about "detectable by design" approach? It's certain your product will fail on the prevention side but you could design it in a way that makes it easy to detect malicious activities.

Mastering Log Ingestion Delay in Detection Engineering Mastering log Ingestion delay in detection engineering to avoid false positives, false negatives, and improve accuracy.

New Year, New Blog

academy.bluraven.io/blog/masteri...

#DetectionEngineering #SIEM #XDR