microsoft-defender

Lessons from the field. Always landing on my feet.

All Cloud Security Identity Security Microsoft Sentinel AI Security Detection Engineering Microsoft Defender Threat Detection Entra ID Container Security Zero Trust DevSecOps Infrastructure as Code Agentic AI 4 posts
Jerrad Dahlager
Jerrad Dahlager, CISSP, CCSP Cloud Security Architect · Adjunct Instructor
About me →
NEW Microsoft Security

Microsoft Security Fall 2026: Five Changes to Prepare For

Microsoft’s fall security updates change several assumptions that are easy to leave buried in an old runbook: what a Security Administrator can do during an incident, whether Sentinel automation needs Security Copilot capacity, which risk-policy …

16 min read Read more →
Detection Engineering

GigaWiper Detection as Code: Testing the Sentinel Repositories Preview

Microsoft published its technical analysis of GigaWiper on July 9, 2026. Microsoft describes it as a modular backdoor with destructive capabilities, including scheduled-task persistence, RabbitMQ-over-AMQP command C2, Redis status and output …

29 min read Read more →
Cloud Security

Copy Fail in the Cloud: A Defender, Sentinel, and AKS Response Guide for CVE-2026-31431

A Linux local privilege escalation bug is easy to dismiss if you only think in traditional server terms. An attacker already needs local access, so how bad can it be? In cloud environments, that assumption breaks fast. A compromised container, a …

17 min read Read more →
Threat Detection

Block Device Code Phishing in Entra Without Breaking Legit Workflows

Device code phishing is nasty because the user does not hand over a password. They hand over a session. The lure sends the victim to a legitimate Microsoft device sign-in page. The victim enters a short code. Entra ID issues tokens to the attacker’s …

16 min read Read more →