Microsoft-Defender

Lessons from the field. Always landing on my feet.

All Cloud Security Microsoft Sentinel Identity Security AI Security Detection Engineering Microsoft Defender Threat Detection Container Security Entra ID DevSecOps Infrastructure as Code Zero Trust Agentic AI 3 posts
Jerrad Dahlager
Jerrad Dahlager, CISSP, CCSP Cloud Security Architect · Adjunct Instructor
About me →
Detection Engineering

GigaWiper Detection as Code: Testing the Sentinel Repositories Preview

Microsoft published its technical analysis of GigaWiper on July 9, 2026. Microsoft describes it as a modular backdoor with destructive capabilities, including scheduled-task persistence, RabbitMQ-over-AMQP command C2, Redis status and output …

29 min read Read more →
Cloud Security

Copy Fail in the Cloud: A Defender, Sentinel, and AKS Response Guide for CVE-2026-31431

A Linux local privilege escalation bug is easy to dismiss if you only think in traditional server terms. An attacker already needs local access, so how bad can it be? In cloud environments, that assumption breaks fast. A compromised container, a …

17 min read Read more →
Threat Detection

Block Device Code Phishing in Entra Without Breaking Legit Workflows

Device code phishing is nasty because the user does not hand over a password. They hand over a session. The lure sends the victim to a legitimate Microsoft device sign-in page. The victim enters a short code. Entra ID issues tokens to the attacker’s …

15 min read Read more →