Mehmet Ergene
@cyb3rmonk.bsky.social
https://academy.bluraven.io Threat Hunting & Research, Detection Engineering | Microsoft Security MVP #KQL #DFIR #DataScience All is one. Opinions are my own http://posts.bluraven.io https://github.com/Cyb3r-Monk/Threat-Hunting-and-Detection
Today I’m announcing Advanced Threat Hunting & Detection Engineering in the Enterprise. More details: academy.bluraven.io/course/advan... #ThreatHunting #DetectionEngineering
Advanced Threat Hunting and Detection Engineering in the Enterprise
Learn how to build high-order behavioral detections for Windows and Entra ID attack activity that remain resilient to evasion and can be adapted across tools.
academy.bluraven.io
Today I’m announcing Advanced Threat Hunting & Detection Engineering in the Enterprise. More details: academy.bluraven.io/course/advan... #ThreatHunting #DetectionEngineering
Advanced Threat Hunting and Detection Engineering in the Enterprise
Learn how to build high-order behavioral detections for Windows and Entra ID attack activity that remain resilient to evasion and can be adapted across tools.
academy.bluraven.io
IMO the worst mistake people make trying to AI-proof their career is dropping everything to learn AI. It's like dropping out of math to study how to push calculator buttons really fast. The skill cap for AI is going to be your understanding of the underlying subject, not how good you are at prompts.
I've released my new course: Practical Threat Hunting for Beginners Similar courses: $$$$ This course: $$ academy.bluraven.io/course/pract... #ThreatHunting #DetectionEngineering
Practical Threat Hunting for Beginners
Learn the core knowledge and practical skills required to perform effective threat hunting in real-world environments.
academy.bluraven.io
patch ye MongoDB, there's an exploit for a vuln which has been in the product for over a decade that allows the remote, unauth read of any memory - which includes plaintext creds. Somebody posted an exploit on Christmas Day, Merry Christmas! doublepulsar.com/merry-christ...
Merry Christmas Day! Have a MongoDB security incident.
Somebody from Elastic Security decided to post an exploit for CVE-2025–14847 on Christmas Day.
doublepulsar.com
🔥 #BlackFriday discounts are live🔥 ➤ 35% OFF all #KQL courses for threat hunting, detection engineering, and incident response. #ThreatHunting #DetectionEngineering #DFIR #incidentresponse #CyberSecurity #InfoSec 👉academy.bluraven.io/blackfriday2...
Black Friday
Mega savings on KQL courses for threat hunting, detection engineering, and incident response.
academy.bluraven.io
🔥 #BlackFriday discounts are live🔥 ➤ 35% OFF all #KQL courses for threat hunting, detection engineering, and incident response. #ThreatHunting #DetectionEngineering #DFIR #incidentresponse #CyberSecurity #InfoSec 👉academy.bluraven.io/blackfriday2...
Black Friday
Mega savings on KQL courses for threat hunting, detection engineering, and incident response.
academy.bluraven.io
Check out my new blog on nested app authentication.
SpecterOps@specterops.io · 12mo agoWhy should Microsoft's Nested App Authentication (NAA) should be on your security team's radar? @1cemoon.bsky.social breaks down NAA and shows how attackers can pivot between Azure resources using brokered authentication. ghst.ly/45h2Zw3
🛑 Azure Resource Graph limits number of results to 1000 when queried from Sentinel or Defender XDR using KQL. There is a little trick that lets you bypass these limits.🤓 🔗 academy.bluraven.io/blog/queryin... #KQL #MicrosoftSentinel #AzureResourceGraph #DefenderXDR
Querying Azure Resource Graph Without Limits Using KQL
Learn how to query Azure Resource Graph using KQL without hitting limits.
academy.bluraven.io
Hello, friends! I'm thrilled to announce that The Homelab Almanac, v3.0 has officially launched! There is a **ton** of new stuff in this version, including: - Proper DNS - PKI - Automatic signed certificates - New secrets management - Proxmox clustering - Cloud integration
Announcing The Homelab Almanac: Version 3.0
The best guide to homelabs just got a lot better—and bigger.
taggart-tech.com
🚨 BadSuccessor = Bad OPSEC With the right audit config, it's pretty easy to detect BadSuccessor. academy.bluraven.io/blog/detecti... #ThreatHunting #DetectionEngineering #ThreatDetection #BadSuccessor
Detecting BadSuccessor: Shorcut to Domain Admin
Detect BadSuccessor attacks exploiting dMSA in Windows Server 2025. Learn key detection methods and auditing configurations.
academy.bluraven.io
This blog is a little bitter, but it's what it is🫠 academy.bluraven.io/blog/detecti... #ThreatHunting #DetectionEngineering
Detecting Vulnerable Drivers (a.k.a. LOLDrivers) the Right Way
Detect vulnerable Windows drivers in MDE the right way using KQL and LOLDrivers.io. Avoid common query mistakes and boost detection accuracy.
academy.bluraven.io
This blog is a little bitter, but it's what it is🫠 academy.bluraven.io/blog/detecti... #ThreatHunting #DetectionEngineering
Detecting Vulnerable Drivers (a.k.a. LOLDrivers) the Right Way
Detect vulnerable Windows drivers in MDE the right way using KQL and LOLDrivers.io. Avoid common query mistakes and boost detection accuracy.
academy.bluraven.io
🚨 Test your Lateral Movement investigation skills! We have just added a new challenge to our FREE "Hands-On Introduction to KQL for Security Analysis" course! You can even test your AI agents' skills 😉 #KQL #Kusto #MicrosoftSentinel #MicrosoftDefender academy.bluraven.io/course/intro...
🐣 HAPPY EASTER CAPSTONE! 🛡️ My KQL courses now include a complete attack scenario to test your skills — end to end. 🎯 Hands-on labs 📉 20% OFF for a limited time! Crack it open 👇 #KQL #Kusto #ThreatHunting #DetectionEngineering #DFIR academy.bluraven.io
Home - Blu Raven Academy
Master KQL for threat hunting, detection engineering, and incident response in a hyper-realistic lab environment using real logs!
academy.bluraven.io
🎁 NEW UPDATE: I've added a small challenge to my FREE "Hands-On Introduction to KQL for Security Analysis" course. More will be coming soon! #KQL #Kusto #MicrosoftDefender #MicrosoftSentinel academy.bluraven.io/course/intro...
🚨 FREE unlimited lab access to "Introduction to KQL for Security Analysis" course! Thrilled to announce that my Intro to KQL for Security Analysis lab environment is now completely free with no time restrictions! academy.bluraven.io/course/intro... #KQL #Kusto #ThreatHunting #Infosec
Introduction to KQL for Security Analysis
Learn the basics of KQL to start your journey into security investigations, threat hunting, and detection engineering with hands-on experience in a hyper-realistic lab environment! Certificate of Com...
academy.bluraven.io
🚨 Problem with Cyber Range/Training platforms ❓ Most range platforms and training labs provide you with all the questions to solve, hinting answers to other questions. I've implemented a trick to hide some questions that reveal hints for other questions for a real-life experience. Stay tuned.👀
🚨 Detect C2 Beacons! New Microsoft Defender for Endpoint telemetry provides new opportunities for threat detection! 🔗 academy.bluraven.io/blog/beaconi... #ThreatHunting #DetectionEngineering #MDE
C2 Beaconing Detection with MDE Aggregated Report Telemetry
Detecting C2 Beaconing using MDE Aggregated Report Telemetry.
academy.bluraven.io
When you group your logs by timestamp(binning) to detect threats, you probably cause false negatives. Solve it using sliding window counts! academy.bluraven.io/blog/advance... #KQL #ThreatHunting #DetectionEngineering
Advanced KQL for Threat Hunting: Window Functions — Part 2
Sliding window functions are one of the powerful methods for accurate detections as they eliminate the potential false negatives. They can be used in threat hunting, detection engineering, and DFIR to...
academy.bluraven.io
It appears Microsoft quietly mitigated most of the risk of the "Intune company portal" device compliance CA bypass by restricting the scope of Azure AD graph tokens issued to this app, making them almost useless for most abuse scenarios. Thx @domchell.bsky.social for the heads up.
🥲 Seems like you don't even have to use residential proxies for device code phishing for evasion. Just get a machine in one of the cloud providers' corresponding regions. 🤷♂️
💙Fall in Love with Threat Hunting, Incident Response, and Detection Engineering using #KQL💙 Code: VLTN30 Valid until 17.02 #ThreatHunting academy.bluraven.io
Window functions do wonders! academy.bluraven.io/blog/advance... #ThreatHunting #KQL
Advanced KQL for Threat Hunting: Window Functions — Part 1
Window functions are one of the powerful methods for data analysis. They can be used in threat hunting, detection engineering, and DFIR to solve complicated use cases.
academy.bluraven.io
🚨 Time to check your detection queries for MDE: DLL load events are recorded in DeviceImageLoadEvents table, NOT DeviceEvents table. I keep seeing people sharing queries with the wrong table and even with the wrong ActionType filters.
Here it is: your complete guide to building a Wireguard network that doesn't require any open ports at home, and doesn't require any third-party tools. Just Wireguard, your devices, and a little elbow grease. taggart-tech.com/wir...
Your Private Wireguard Network from Scratch
Let's learn how to set up our own private network for secure self-hosted services.
taggart-tech.com
It seems like there is an easy way to block VS Code tunnels (Dev Tunnels) on Windows to prevent malicious usage. 😮 techcommunity.microsoft.com/blog/azurede...
How to Manage Dev Tunnels with Group Policies
Dev Tunnels is a tunneling service that can boost your productivity when testing and debugging web apps, webhooks, APIs, and more
techcommunity.microsoft.com
#LOLBAS project update: Entries now have placeholders for paths, URLs, and more. This makes it easier to visually see what parts are "variable", and for LOLBAS API users (lolbas-project.github.io/api/) it'll be easier to use with automation. Check it out: ⭐ lolbas-project.github.io
Detectable by Design? We keep failing on "shift left", "secure by design", etc. to prevent malicious activities. How about "detectable by design" approach? It's certain your product will fail on the prevention side but you could design it in a way that makes it easy to detect malicious activities.
