Timileyin.

[Dark Web Informer @DarkWebInformer]

POV: the threat actor finally gets root access and realizes the target was a honeypot.

[clibm079 @clibm079]

APT Encyclopedia
Threat Intelligence Database

https://t.co/ntvsAEhCEe

[Speaker 25 @rodtrent]

Microsoft Just Replaced the SOC? | ISOC Explained
https://t.co/1Sd3c4UhH7

[Joe Stocker @ITguySoCal]

ISOC in Microsoft Defender is a benefit for M365 E5 and E7 customers, it is not a new product. Those lucky customers will save 44% off 3P security log ingestion.
I spent all day reading and broke it down here to bring it to you straight:
https://t.co/goKE8zSnUI

[Megatron @TheM3gatr0n]

Defender query to detect PowerShell Spawned from Explorer via Win+R @0x534c
DeviceProcessEvents
| where FileName =~ "powershell.exe"
| where InitiatingProcessFileName =~ "explorer.exe"
| where ProcessCommandLine has_any ("iex", "Invoke-Expression", "DownloadString", "WebClient", "curl", "wget", "-enc", "-EncodedCommand")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc
#hunting #clickfix

[Jeffrey Appel | Microsoft MVP @JeffreyAppel7]

NEW BLOG: How to track browser extension installations with Microsoft Defender.

https://t.co/CpANNzRTAc

[Adam Goss @gossy_84]

If you work in CTI, bookmark this:

CLOAK - a MITRE ATT&CK-style framework for cybercriminal concealment measures.

→ 1,387 TTPs
→ Technical, Behavioral & Physical layers
→ Open source
→ Updated Feb 2026
→ Interactive at https://t.co/ZcsxWU1w5N

[FalconForce Official @falconforceteam]

Detection performance shouldn’t be buried across alerts and metrics. 📊
In our latest blog, we introduce and open-source #FalconDash - a modular dashboard built to make Microsoft Sentinel detection performance visible, explorable, and easier to tune. 🚀 https://t.co/0EVJcKB0VY

[mRr3b00t @UK_Daniel_Card]

I made a little tool which you can use (with or without an LLM) to make (I think very cool) network diagrams, business process diagrams, and it features a journey mode to walk people through things!
https://t.co/qCbspVmAq7

[OpenAI @OpenAI]

We have conducted a thorough investigation into the Hugging Face incident.

We are releasing a technical report and accompanying blog post that reconstruct the agents’ activity, explain why existing safeguards failed, and detail how we’re preventing recurrence.

https://t.co/hfxlbiXXiP

[Speaker 25 @rodtrent]

KQL Detection of the Week: The Query That Wrote Itself Eight Times
https://t.co/8VmKNBGEw0

[Tony/Humpty @humpty_tony]

If you operate a SIEM I'd recommend giving a look st https://t.co/XFRCqQryZ3. Absolute fantastic work!

[Matt Zorich @reprise_99]

Detection engineers don't want you to know this one trick

SigninLogs
| where AppDisplayName in ("OfficeHome", "Microsoft Azure CLI") and RiskLevelDuringSignIn in~ ("medium", "high")

[Nathan McNulty @NathanMcNulty]

Entra Cloud Sync finally supports syncing devices for Hybrid join 🥳

https://t.co/Ea1cmGOOLY

This was one of the last holdout features that was keeping folks on Entra Connect Sync, and for many, we can now retire that service and move to the more resilient Cloud Sync engine!

[mRr3b00t @UK_Daniel_Card]

I made a thing that might help people: https://t.co/qCbspVmAq7

[vx-underground @vxunderground]

> Peter Stokes
> Scattered Spider guy
> Arrested
> Microsoft helps FBI
> Read court documents
> Page 12
> Microsoft tracks Stokes from GDID
> Microsoft Global Device Identifier (GDID)
> Stokes used Windows
> Page 34
> GDID assigned to each OS install
> GDID unique to each device
> GDID only change if OS wiped
> Stokes GDID 6755467234350028
> GDID reported internet activity to Microsoft
> GDID showed Stokes using Ngrok
> GDID reported Stokes IP address
> GDID showed Stokes web activity
> GDID showed timestamps of web activity
> GDID mapped with video game activity
> GDID showed games played
> GDID undocumented
> GDID only mentioned in one MSDN document
> Azure UCDOStatus
> Azure Monitor Logging

[Speaker 25 @rodtrent]

A guide to innovating threat hunting with Microsoft Sentinel custom graph https://t.co/t0t0DcAd7W

[mRr3b00t @UK_Daniel_Card]

A cool ransomware tracking site:
https://t.co/8j2loMgKjO

[Vaishnavi @_vmlops]

MICROSOFT OPEN-SOURCED A PII DETECTION SDK

presidio detects and anonymizes sensitive data before it ever touches your model

the problem is real: names, emails, SSNs, credit cards, medical records all flowing through LLM pipelines unfiltered

presidio stops that

▫️ detects PII in text, images, and structured data
▫️ redacts, masks, or anonymizes before it hits the model
▫️ supports NLP, regex, rule-based, and transformer detection
▫️ runs on Python, PySpark, Docker, and Kubernetes
▫️ even handles DICOM medical images

in an era of GDPR, HIPAA, and AI compliance audits, this is infrastructure not optional

https://t.co/pcEkm4mMt7

[mRr3b00t @UK_Daniel_Card]

This is very POC, use at own risk: https://t.co/pP9FD0mrvd