Detection engineering, KQL, and threat hunting notes.https://leftanti.dev/en-gbhttps://leftanti.dev/kql/failed-signon-burst/https://leftanti.dev/kql/failed-signon-burst/Groups failed Entra sign-ins by source address and application to surface password spraying, while ignoring the interrupt result codes that are not really failures.Tue, 04 Aug 2026 00:00:00 GMTKqlLibraryentraidentitypassword-sprayhttps://leftanti.dev/rules/impossible-travel-watchlist-suppression/https://leftanti.dev/rules/impossible-travel-watchlist-suppression/An impossible-travel rule is only as good as its suppression list. This one drives exclusions from a watchlist so the logic never has to be edited to add an egress range.Tue, 28 Jul 2026 00:00:00 GMTAnalyticsRulesentraidentitywatchlistsfalse-positiveshttps://leftanti.dev/hunting/entra-app-registration-persistence/https://leftanti.dev/hunting/entra-app-registration-persistence/A hunt for credentials quietly added to existing service principals — the persistence that survives a password reset, an MFA enrolment, and a device wipe.Sun, 19 Jul 2026 00:00:00 GMTThreatHuntingentrapersistenceservice-principalshttps://leftanti.dev/cheatsheets/btl2-network-forensics/https://leftanti.dev/cheatsheets/btl2-network-forensics/Ports, protocol tells, and the Wireshark and tcpdump filters worth having in muscle memory for the network forensics section of BTL2.Mon, 06 Jul 2026 00:00:00 GMTCheatSheetsbtl2networkwiresharkpcaphttps://leftanti.dev/notes/against-long-analytics-rules/https://leftanti.dev/notes/against-long-analytics-rules/Long detections feel thorough and behave badly. What actually goes wrong when one rule tries to cover six behaviours, and what to do instead.Mon, 22 Jun 2026 00:00:00 GMTNotesdetection-engineeringopinion