Hunting Impossible Travel in Sentinel with KQL
Two sign-ins too far apart in time and distance to be one person. In Sentinel, KQL's prev() and a distance function are all it takes.
KQL
Hunting Password Spray in Sentinel: One Password Against a Thousand Doors
Brute force tries many passwords on one account. Spray tries one password on many accounts, and hides under your lockout threshold. Here's the shape it leaves.
Hunting MFA Fatigue in Sentinel: Building the Detection One Line at a Time
Push-bombing leaves a loud shape in SigninLogs. In Sentinel, a KQL count, a threshold and a join are enough to catch it.
Getting Started with Sentinel Hunting: A KQL Primer for People Who Keep Putting It Off
A KQL primer for hunting in Microsoft Sentinel: five operators, one mental model, and why you never trust a detection you can't read.