Microsoft Defender
Lessons from the field. Always landing on my feet.
New Pods, Same Finding: Testing Defender’s Kubernetes Controller Scope
On October 5, 2026, Microsoft announced a welcome change to how Microsoft Defender for Cloud reports Kubernetes misconfigurations. Affected Kubernetes Security Posture Management (KSPM) recommendations are moving from individual running container …
GigaWiper Detection as Code: Testing Custom Detections in Sentinel Repositories
Review update (September 25, 2026): The merged September 25 source now chooses a labeled executable identity from populated SHA1, then SHA256, then a normalized path; it excludes empty identity values. Its KQL semantic analysis and offline suite …
Copy Fail in the Cloud: A Defender, Sentinel, and AKS Response Guide for CVE-2026-31431
Review update (September 25, 2026): The retained Sentinel/AKS evidence was captured May 2, 2026, without executing Copy Fail exploit code. The May 3 CVE/KEV snapshot remains historical; its May 15 due date has passed. Recheck the live NVD record and …
Block Device Code Phishing in Entra Without Breaking Legit Workflows
Review update (September 26, 2026): The merged rules run every 15 minutes, retain their correlation lookbacks, and gate on recent ingestion from either relevant side. Rule 2 merges duplicate representations of a successful sign-in while retaining …
Agent 365 Launch Playbook: I Tested the Defender Response for AI Agent Attacks
Review update (September 26, 2026): The source reviewed September 26 requires explicit GA model/version selection and Python 3.12 hash-locked dependencies. Current rules use stable alert IDs and ingestion freshness, without a fixed artificial …
Scan Blob Uploads, Trace Later Reads: Defender for Storage + Sentinel
Review update (September 25, 2026): The merged source disables Shared Key, uses the stable 2025-06-01 account settings API, scopes every StorageBlobLogs workbook panel to the lab account, and shows four correctly defined KPI tiles. It passed 35 …
AKS Runtime Security: Binary Drift, Anti-Malware & Gated Deployment with Defender for Cloud
Review update (September 25, 2026): The merged September 25 source resolves and records an exact regional GA Kubernetes patch on first deployment and refuses implicit version changes on owned reruns. Pricing restoration is bound to the captured …