Microsoft XDR, KQL, real-world security engineering, and other fun stuff from DevSecOpsDad, your friendly neighbourhood Attack Surface Samurai.
-
-
KQL Detection of the Week: The Query That Wrote Itself Eight Times
Detecting SharePoint RCE When the Brief Wrote the Same Query All Week, the Correlation Has No Anchor, and the Best Detection in the Stack Is a Baseline
-
AI Sovereignty on a Raspberry Pi: Running Qwen3 with Ollama
No GPU. No API key. No monthly bill. The model they can’t turn off.
-
KQL Detection of the Week: Sins of the Grandfather
Detecting npm Lifecycle Worms When the Payload Is Two Generations Down and the C2 Is a Public Blockchain
-
KQL Detection of the Week: A Heap of Trouble
Detecting Spring Boot Heapdump Theft When the Exfiltration Is a GET Request