Microsoft XDR, KQL, real-world security engineering, and other fun stuff from DevSecOpsDad, your friendly neighbourhood Attack Surface Samurai.
-
-
AI Sovereignty on a Raspberry Pi: Running Qwen3 with Ollama
No GPU. No API key. No monthly bill. The model they can’t turn off.
-
KQL Detection of the Week: Sins of the Grandfather
Detecting npm Lifecycle Worms When the Payload Is Two Generations Down and the C2 Is a Public Blockchain
-
KQL Detection of the Week: A Heap of Trouble
Detecting Spring Boot Heapdump Theft When the Exfiltration Is a GET Request
-
Kql Detection Of The Week: A Meeting In 2050 (detecting Project Cav3rn's Outlook Calendar C2 And Dns Aaaa Recovery Channel)
There is a meeting on your calendar for 13 May 2050. Nobody will ever attend it. Nobody has ever scrolled there — a quarter-century out, in a fixed one-hour window between 22:00 and 23:00 UTC, parked in the most-synced, least-read database in your tenant. [Read More]