2026-06-03Detecting a storm of ZipLine attacks with KQL
A technical breakdown of the ZipLine initial access campaign linked to Qilin ransomware, and how to detect the HTA delivery chain in Microsoft Defender XDR.
by kqlcat
AI-assisted Entra ID tenant destruction and how to detect it
How AI can automate Entra ID tenant destruction and what it leaves behind in Entra ID audit logs.
by kqlcat
Threat Intelligence in Sentinel: MDTI and custom Feeds
This blog post explains how Security Teams can integrate threat intelligence feeds into KQL-based detections; from Microsoft Defender Threat Intelligence (MDTI) to open source feeds.
by kqlcat
How KQL can be used to detect stealthy backdoors in Entra ID applications
A breakdown of Service Principal credential persistence in Entra ID and how to detect it with KQL.
by kqlcat
Detecting MCP and OpenClaw with KQL
AI agents are redefining 'the weakest link' means in enterprise architecture. A KQL-based solution to detecting OpenClaw and MCP in modern environments.
by kqlcat
Reversing CanisterSprawl for KQL detections
A technical breakdown of CanisterSprawl; the second iteration of the CanisterWorm supply chain operation, now with active self-propagation, cross-ecosystem PyPI infection, and upgraded exfiltration infrastructure.
by kqlcat
Using KQL to detect BYOVD attacks via known vulnerable LOLDrivers
A practical approach to detecting Bring Your Own Vulnerable Driver (BYOVD) activity using KQL and LOLDrivers.
by kqlcat