Anything About IT

Learning, Building, Sharing

Exploring IdentityAccountInfo - Building a KQL Query to Assess Identity Password Security Posture

Use IdentityAccountInfo and IdentityInfo in Defender XDR to assess password hygiene, account sensitivity, and risky password policy settings.

Posted by Alex Verboon on Saturday, December 6, 2025

Shedding Light on Dormant Sensitive Accounts

Use Microsoft Defender XDR and KQL to enrich dormant sensitive account findings and add missing account context for remediation.

Posted by Alex Verboon on Tuesday, July 8, 2025

Users can create AzureAD tenants

Review and monitor the Azure AD setting that allows users to create new tenants, with KQL detection queries.

Posted by Alex Verboon on Tuesday, November 22, 2022

Generating Advanced hunting queries with PowerShell

Writing advanced hunting queries for Microsoft Defender ATP to search for execution of specific PowerShell commands.

Posted by Alex Verboon on Friday, July 10, 2020