𝗞𝗤𝗟𝗪𝗶𝘇𝗮𝗿𝗱 𝗔𝗻𝗻𝗼𝘂𝗻𝗰𝗲𝗺𝗲𝗻𝘁 😊 I’m deeply honoured to be awarded the 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗠𝗩𝗣 in SIEM & XDR (Microsoft Sentinel & Microsoft Defender XDR suite). A heartfelt thank you to 𝗗𝗲𝗯𝗮𝗰 𝗠𝗮𝗻𝗶𝗸𝗮𝗻𝗱𝗮𝗻 for your trust and support in nominating me, and to 𝗝𝗮𝘆 𝗞𝗲𝗿𝗮𝗶 for your invaluable guidance throughout the application process. This recognition is a meaningful way to close out 2025 and an inspiring start to 2026. I look forward to continuing to learn, grow, and share KQL magic with our amazing defender community.🙏 #MicrosoftMVP #MVPBuzz #Sentinel #DefenderXDR

⚠️ 𝗜𝗻𝘁𝗲𝗿𝗲𝘀𝘁𝗶𝗻𝗴 𝗼𝗻𝗲 𝗳𝗼𝗿 𝗳𝗲𝗹𝗹𝗼𝘄 𝗱𝗲𝗳𝗲𝗻𝗱𝗲𝗿𝘀. ​ A domain registered just 𝟭𝟯 𝗱𝗮𝘆𝘀 𝗮𝗴𝗼, closely resembling a Microsoft Copilot FQDN. VirusTotal at capture time: 𝟬/𝟵𝟮 𝗱𝗲𝘁𝗲𝗰𝘁𝗶𝗼𝗻𝘀. ​ Sharing for awareness. 🛡️ ​ #ThreatHunting

🔍 𝗧𝗵𝗿𝗲𝗮𝘁 𝗘𝗻𝘁𝗶𝘁𝗶𝗲𝘀 𝗯𝘆 𝗠𝗜𝗧𝗥𝗘 𝗧𝗮𝗰𝘁𝗶𝗰𝘀 ​ This view helps defenders understand which 𝗠𝗜𝗧𝗥𝗘 𝗔𝗧𝗧&𝗖𝗞 𝘁𝗮𝗰𝘁𝗶𝗰𝘀 𝗮𝗿𝗲 𝗮𝘀𝘀𝗼𝗰𝗶𝗮𝘁𝗲𝗱 𝘄𝗶𝘁𝗵 𝗱𝗶𝗳𝗳𝗲𝗿𝗲𝗻𝘁 𝘁𝗵𝗿𝗲𝗮𝘁 𝗮𝗰𝘁𝗼𝗿𝘀, making it easier to focus threat hunting and investigation on relevant adversary behaviors. detections.ai/share/rule/kny… ​ #threathunting

🚨 𝗖𝗼𝗻𝗻𝗲𝗰𝘁𝘄𝗶𝘀𝗲 𝗖𝗿𝗲𝗱𝗲𝗻𝘁𝗶𝗮𝗹 𝗔𝗯𝘂𝘀𝗲𝗱 𝗜𝗻𝗰𝗶𝗱𝗲𝗻𝘁 𝗘𝘅𝗽𝗼𝘀𝘂𝗿𝗲 ​ A widespread security incident involving ConnectWise Cloud Backup (formerly SkyKick) enabled an unknown threat actor to leverage compromised SkyKick access to gain access to customers’ Microsoft 365 environments. If you uses ConnectWise Cloud Backup, you can run the below KQL to check for possible exposure. 🫡 connectwise.com/company/trus… ​ #threathunting #skykick

Top 5 Emerging Threat Actors by Country IPs according to Microsoft Threat Intelligence data.

⚠️ 𝟱 𝗺𝗼𝗻𝘁𝗵𝘀 𝗼𝗹𝗱. 𝟬/𝟵𝟮 𝗱𝗲𝘁𝗲𝗰𝘁𝗶𝗼𝗻𝘀. 𝗦𝘁𝗶𝗹𝗹 𝗺𝗮𝗹𝗶𝗰𝗶𝗼𝘂𝘀☠️ ​ ANY.RUN researchers uncovered a fake Claude installation campaign using 𝗖𝗹𝗶𝗰𝗸𝗙𝗶𝘅-𝘀𝘁𝘆𝗹𝗲 𝗣𝗼𝘄𝗲𝗿𝗦𝗵𝗲𝗹𝗹 𝗲𝘅𝗲𝗰𝘂𝘁𝗶𝗼𝗻, despite the domain shown in the screenshot receiving 𝗻𝗼 𝗳𝗹𝗮𝗴𝘀 𝗳𝗿𝗼𝗺 𝟵𝟮 𝗩𝗶𝗿𝘂𝘀𝗧𝗼𝘁𝗮𝗹 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝘃𝗲𝗻𝗱𝗼𝗿𝘀. ​ A timely reminder: "𝗻𝗼𝘁 𝗱𝗲𝘁𝗲𝗰𝘁𝗲𝗱” 𝗱𝗼𝗲𝘀 𝗻𝗼𝘁 𝗺𝗲𝗮𝗻 “𝘀𝗮𝗳𝗲.” ​ Behavioral analysis and sandbox detonation remain critical when attackers abuse trusted AI brands and legitimate-looking installation workflows. any.run/cybersecurity-blog/f… ​ #ClickFix #FakeAI

🎣 ANY.RUN researchers identified 𝗦𝗸𝘆𝘄𝟰𝗹𝗸𝗲𝗿, a 𝗱𝗲𝘃𝗶𝗰𝗲 𝗰𝗼𝗱𝗲 𝗽𝗵𝗶𝘀𝗵𝗶𝗻𝗴 campaign primarily 𝘁𝗮𝗿𝗴𝗲𝘁𝗶𝗻𝗴 𝗨.𝗦. 𝗼𝗿𝗴𝗮𝗻𝗶𝘇𝗮𝘁𝗶𝗼𝗻𝘀 across the manufacturing, technology, and healthcare sectors. The campaign uses password-protected contract or service-proposal decoys and sites[.]google[.]com lures to redirect victims to Microsoft authentication, seeking M365 token access without directly harvesting passwords. ​ #Skyw4lker #DeviceCodePhishing

𝗔𝗻𝗮𝗹𝘆𝘀𝗶𝘀 𝗼𝗳 𝗔𝗜 𝗔𝗴𝗲𝗻𝘁 𝗕𝗹𝗮𝘀𝘁 𝗥𝗮𝗱𝗶𝘂𝘀 𝗮𝗻𝗱 𝗥𝗶𝘀𝗸 🔎 ​ I created a discovery KQL to explore 𝗔𝗜 𝗮𝗴𝗲𝗻𝘁 𝗯𝗹𝗮𝘀𝘁 𝗿𝗮𝗱𝗶𝘂𝘀 𝗮𝗻𝗱 𝗶𝗻𝗵𝗲𝗿𝗶𝘁𝗲𝗱 𝗿𝗶𝘀𝗸 𝗳𝗿𝗼𝗺 𝘁𝗵𝗲 𝗶𝗱𝗲𝗻𝘁𝗶𝘁𝘆 𝗮𝘀𝘀𝗼𝗰𝗶𝗮𝘁𝗲𝗱 𝘄𝗶𝘁𝗵 𝘁𝗵𝗲 𝗮𝗴𝗲𝗻𝘁. ​ The concept is simple: 𝗔𝗜 𝗔𝗴𝗲𝗻𝘁 → 𝗜𝗱𝗲𝗻𝘁𝗶𝘁𝘆 → 𝗕𝗹𝗮𝘀𝘁 𝗥𝗮𝗱𝗶𝘂𝘀 → 𝗥𝗶𝘀𝗸 ​ Understanding the relationship between the 𝗮𝗴𝗲𝗻𝘁, 𝗶𝗱𝗲𝗻𝘁𝗶𝘁𝘆, 𝗯𝗹𝗮𝘀𝘁 𝗿𝗮𝗱𝗶𝘂𝘀, 𝗮𝗻𝗱 𝗿𝗶𝘀𝗸 gives us another useful angle for AI security discovery and hunting. ​ As AI agents become part of the enterprise landscape, perhaps we should not look at the agent in isolation. The identity associated with the agent matters too. ​ #AISecurity #AgenticAI #KQL #MicrosoftDefender #AdvancedHunting

🚨 𝗙𝗿𝗲𝘀𝗵 𝗛𝗲𝗹𝗽𝗱𝗲𝘀𝗸-𝗧𝗵𝗲𝗺𝗲𝗱 𝗗𝗼𝗺𝗮𝗶𝗻𝘀 𝗜𝗺𝗽𝗲𝗿𝘀𝗼𝗻𝗮𝘁𝗶𝗻𝗴 𝗙𝗶𝗻𝗮𝗻𝗰𝗶𝗮𝗹 𝗜𝗻𝘀𝘁𝗶𝘁𝘂𝘁𝗶𝗼𝗻𝘀 ​ While threat hunting with @silentpush , I came across an interesting cluster of 𝗻𝗲𝘄𝗹𝘆 𝗰𝗿𝗲𝗮𝘁𝗲𝗱 𝗵𝗲𝗹𝗽𝗱𝗲𝘀𝗸-𝘁𝗵𝗲𝗺𝗲𝗱 𝗱𝗼𝗺𝗮𝗶𝗻𝘀. ​ The domain names appear to reference major financial brands, including 𝗝𝗣𝗠𝗼𝗿𝗴𝗮𝗻, 𝗕𝗮𝗻𝗸 𝗼𝗳 𝗔𝗺𝗲𝗿𝗶𝗰𝗮’𝘀 𝗖𝗮𝘀𝗵𝗣𝗿𝗼, 𝗪𝗲𝘀𝘁𝗽𝗮𝗰, 𝗖𝗵𝗮𝘀𝗲, 𝗮𝗻𝗱 𝗛𝗦𝗕𝗖. ​ 🛡️ 𝗧𝗼 𝗳𝗲𝗹𝗹𝗼𝘄 𝗱𝗲𝗳𝗲𝗻𝗱𝗲𝗿𝘀 𝘄𝗼𝗿𝗸𝗶𝗻𝗴 𝘄𝗶𝘁𝗵 𝗼𝗿 𝗽𝗿𝗼𝘁𝗲𝗰𝘁𝗶𝗻𝗴 𝘁𝗵𝗲𝘀𝗲 𝗳𝗶𝗻𝗮𝗻𝗰𝗶𝗮𝗹 𝗶𝗻𝘀𝘁𝗶𝘁𝘂𝘁𝗶𝗼𝗻𝘀: this may be worth a closer look. Keep an eye on newly registered lookalike domains, helpdesk-themed lures, and related infrastructure appearing in your telemetry. ​ Sharing with the community for awareness and further investigation.🤝 ​ #Threathunting 🧙‍♂️

⚠️ 𝗨𝘀𝗶𝗻𝗴 𝗭𝗼𝗼𝗺? 𝗕𝗲𝘄𝗮𝗿𝗲. ​ Defender XDR hunting has surfaced Zoom-themed domain indicators associated with 𝗦𝗮𝗽𝗽𝗵𝗶𝗿𝗲 𝗦𝗹𝗲𝗲𝘁 (𝟵𝟱), 𝗨𝗻𝗸𝗻𝗼𝘄𝗻 𝗮𝗰𝘁𝗼𝗿 (𝟮𝟱), 𝗮𝗻𝗱 𝗦𝘁𝗼𝗿𝗺-𝟮𝟳𝟴𝟳 (𝟮). Keep an eye on suspicious Zoom-related domains. 🫡 ​ #threathunting 🧙‍♂️

⚠️ 𝗗𝗲𝗳𝗲𝗻𝗱𝗲𝗿𝘀: 𝘄𝗮𝘁𝗰𝗵 𝗳𝗼𝗿 𝗗𝗼𝗰𝘂𝗦𝗶𝗴𝗻-𝘁𝗵𝗲𝗺𝗲𝗱 𝚠𝚘𝚛𝚔𝚎𝚛𝚜.𝚍𝚎𝚟 𝗱𝗼𝗺𝗮𝗶𝗻𝘀 ​ A quick hunt in Microsoft Defender XDR Threat Intelligence Explorer surfaced 𝟮𝟯𝟬 𝗱𝗼𝗺𝗮𝗶𝗻 𝗶𝗻𝗱𝗶𝗰𝗮𝘁𝗼𝗿𝘀 𝗶𝗻 𝗢𝗰𝘁𝗼𝗯𝗲𝗿 𝟮𝟬𝟮𝟲 matching the DocuSign theme on 𝚠𝚘𝚛𝚔𝚎𝚛𝚜.𝚍𝚎𝚟 ​ Worth checking your environment for: 📧 URLs observed in email 🌐 Outbound network connections 🔍 DNS/proxy activity 💻 Endpoint telemetry ​ 𝗛𝘂𝗻𝘁𝗶𝗻𝗴 𝗶𝗱𝗲𝗮: look for unexpected 𝚍𝚘𝚌𝚞𝚜𝚒𝚐𝚗-*.𝚠𝚘𝚛𝚔𝚎𝚛𝚜.𝚍𝚎𝚟 activity and investigate any hits. ​ Small IOC patterns can sometimes reveal a much larger campaign footprint.🫡 ​ #ThreatHunting #DefenderXDR

Read an interesting piece on Punycode and Unicode-based typosquatting today. theregister.com/security/202…​ Rather than stopping at “𝘵𝘩𝘢𝘵’𝘴 𝘪𝘯𝘵𝘦𝘳𝘦𝘴𝘵𝘪𝘯𝘨”, I like asking: “𝗛𝗼𝘄 𝘄𝗼𝘂𝗹𝗱 𝗜 𝗵𝘂𝗻𝘁 𝗳𝗼𝗿 𝘁𝗵𝗶𝘀?” 🔎 ​ So I put together a quick Microsoft Defender Advanced Hunting query to surface 𝚡𝚗-- DNS requests, decode the Punycode domains, and see what turns up. ​ Not every Punycode domain is malicious, but it gives us another useful signal to investigate. ​ Sometimes the best threat-hunting ideas start with a good piece of security research. ​ detections.ai/share/rule/Q5o… ​ #ThreatHunting #KQL #MicrosoftDefender

𝗜𝘁’𝘀 𝗰𝗹𝗲𝗮𝗻. 𝗭𝗲𝗿𝗼 𝗱𝗲𝘁𝗲𝗰𝘁𝗶𝗼𝗻𝘀. ✅ Probably Microsoft just ran out of Azure cloud resources and decided to run this one on Amazon. Nothing suspicious here. Carry on. 😂

🛡️𝗗𝗲𝘁𝗲𝗰𝘁 𝗧𝗲𝗮𝗺𝘀 𝗜𝗺𝗽𝗲𝗿𝘀𝗼𝗻𝗮𝘁𝗶𝗼𝗻 𝗠𝗮𝗹𝗶𝗰𝗶𝗼𝘂𝘀 𝗤𝗥 𝗖𝗼𝗱𝗲𝘀 ​ MC1490905: Microsoft Defender for Office 365 extends Teams URL protection to detect malicious URLs in QR codes post-delivery, warning users and enabling security teams to investigate via Advanced Hunting. Rolling out worldwide from October to November 2026, no user action is required. admin.cloud.microsoft/?ref=M… Detection Code: detections.ai/share/rule/Xz5… ​ #threathunting 🧙‍♂️

👀𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗧𝗲𝗮𝗺𝘀-𝗧𝗵𝗲𝗺𝗲𝗱 𝗔𝘁𝘁𝗮𝗰𝗸𝘀 𝘃𝗶𝗮 𝗠𝗮𝗹𝘃𝗲𝗿𝘁𝗶𝘀𝗶𝗻𝗴 & 𝗟𝗟𝗠 𝗣𝗼𝗶𝘀𝗼𝗻𝗶𝗻𝗴 ​ Yesterday, I shared a newly registered domain, 𝘁𝗲𝗮𝗺𝘀-𝗼𝗻𝗹𝗶𝗻𝗲[.]𝗰𝗼𝗺, which was actively mimicking the Microsoft Teams login experience and user interface. ​ Today, I came across another domain, 𝘁𝗲𝗮𝗺𝘀-𝗹𝗶𝘃𝗲𝗺𝗲𝗲𝘁𝗶𝗻𝗴[.]𝗰𝗼𝗺, registered by the same organization and appearing in a similar attack pattern involving 𝗺𝗮𝗹𝘃𝗲𝗿𝘁𝗶𝘀𝗶𝗻𝗴 𝗮𝗻𝗱 𝗟𝗟𝗠 𝗽𝗼𝗶𝘀𝗼𝗻𝗶𝗻𝗴. ​ What makes this particularly interesting is that the threat actor may not need to send a single Teams-themed phishing email to enterprise users. In the live search example below, a user simply searches for Teams-related keywords. A malicious Teams-themed domain is then surfaced through 𝘀𝗽𝗼𝗻𝘀𝗼𝗿𝗲𝗱 𝗮𝗱𝘃𝗲𝗿𝘁𝗶𝘀𝗶𝗻𝗴 𝗮𝗻𝗱 𝗮𝗻 𝗟𝗟𝗠-𝗴𝗲𝗻𝗲𝗿𝗮𝘁𝗲𝗱 𝗿𝗲𝘀𝗽𝗼𝗻𝘀𝗲, potentially directing the user toward attacker-controlled infrastructure. ​ 💡 𝗧𝗵𝗲 𝗸𝗲𝘆 𝘁𝗮𝗸𝗲𝗮𝘄𝗮𝘆: A newly created phishing domain does not necessarily need to be actively distributed through email to reach enterprise users. Attackers can position malicious domains where users are already looking for legitimate services, turning 𝘀𝗲𝗮𝗿𝗰𝗵 𝗲𝗻𝗴𝗶𝗻𝗲𝘀, 𝗮𝗱𝘃𝗲𝗿𝘁𝗶𝘀𝗶𝗻𝗴 𝗲𝗰𝗼𝘀𝘆𝘀𝘁𝗲𝗺𝘀, 𝗮𝗻𝗱 𝗔𝗜-𝗴𝗲𝗻𝗲𝗿𝗮𝘁𝗲𝗱 𝗮𝗻𝘀𝘄𝗲𝗿𝘀 into potential attack-delivery channels. ​ Threat hunting therefore needs to look beyond the email inbox. ​ #ThreatHunting