leftanti — detection engineering notes

Detection engineering, KQL, and threat hunting notes for Microsoft Sentinel and Defender. Everything here is written to be copied, adapted, and tuned against your own data.

//everything, newest first

1. DetectionEngineering

   |Failed sign-on bursts from a single address

   //|2026-08-04querySigninLogsT1110.003

2. DetectionEngineering

   |Impossible travel that survives contact with a VPN estate

   //|2026-07-28ruleSigninLogsT1078.004

3. ThreatResearch

   |Where persistence hides in Entra app registrations

   //|2026-07-19AuditLogsT1098.001

4. CheatSheets

   |BTL2 — network forensics reference

   //|2026-07-06BTL2

5. Notes

   |Why I stopped writing 500-line analytics rules

   //|2026-06-22