https://leftanti.devhttps://leftanti.dev/abouthttps://leftanti.dev/cheatsheetshttps://leftanti.dev/cheatsheets/btl2-network-forensicshttps://leftanti.dev/huntinghttps://leftanti.dev/hunting/entra-app-registration-persistencehttps://leftanti.dev/intelhttps://leftanti.dev/intel/campaignhttps://leftanti.dev/intel/exploitedhttps://leftanti.dev/intel/iochttps://leftanti.dev/intel/otherhttps://leftanti.dev/intel/techniquehttps://leftanti.dev/kqlhttps://leftanti.dev/kql/failed-signon-bursthttps://leftanti.dev/notes/against-long-analytics-ruleshttps://leftanti.dev/resourceshttps://leftanti.dev/ruleshttps://leftanti.dev/rules/impossible-travel-watchlist-suppressionhttps://leftanti.dev/tagshttps://leftanti.dev/tags/auditlogshttps://leftanti.dev/tags/btl2https://leftanti.dev/tags/detection-engineeringhttps://leftanti.dev/tags/entrahttps://leftanti.dev/tags/false-positiveshttps://leftanti.dev/tags/identityhttps://leftanti.dev/tags/mediumhttps://leftanti.dev/tags/networkhttps://leftanti.dev/tags/opinionhttps://leftanti.dev/tags/password-sprayhttps://leftanti.dev/tags/pcaphttps://leftanti.dev/tags/persistencehttps://leftanti.dev/tags/service-principalshttps://leftanti.dev/tags/signinlogshttps://leftanti.dev/tags/t1078-004https://leftanti.dev/tags/t1098-001https://leftanti.dev/tags/t1110-003https://leftanti.dev/tags/watchlistshttps://leftanti.dev/tags/wireshark