detection-engineering

Lessons from the field. Always landing on my feet.

All Cloud Security Identity Security Microsoft Sentinel Microsoft Defender AI Security Detection Engineering Threat Detection Container Security Entra ID Zero Trust DevSecOps Infrastructure as Code Agentic AI 3 posts
Jerrad Dahlager
Jerrad Dahlager, CISSP, CCSP Cloud Security Architect · Adjunct Instructor
About me →
Threat Detection

Detecting Infostealer Session Hijacking with Microsoft Sentinel

Review update (September 25, 2026): Cookie replay maps to T1550.004 separately from cookie theft (T1539); these rules provide investigative signals rather than proof of either technique. Keep the sign-in tables used by scheduled rules in the …

27 min read Read more →
Detection Engineering

Building Custom Sentinel Connectors with CCF Push

Review update (September 25, 2026): The repaired sender treats a genuine empty upstream list as a successful zero-record poll without authentication or ingestion; a nonempty all-invalid list still fails. Rule enablement is a second phase after …

26 min read Read more →
Threat Detection

Detecting OAuth Redirect Abuse with Microsoft Sentinel and Entra ID

Review update (September 26, 2026): The merged source preserves an already-disabled user-consent policy and refuses unrecognized custom self-consent policy replacement for manual review. Reports, manifest staging and request-body files are …

18 min read Read more →