Mehmet Ergene

IMO the worst mistake people make trying to AI-proof their career is dropping everything to learn AI. It's like dropping out of math to study how to push calculator buttons really fast. The skill cap for AI is going to be your understanding of the underlying subject, not how good you are at prompts.

Practical Threat Hunting for Beginners Learn the core knowledge and practical skills required to perform effective threat hunting in real-world environments.

I've released my new course:
Practical Threat Hunting for Beginners

Similar courses: $$$$
This course: $$

academy.bluraven.io/course/pract...

#ThreatHunting #DetectionEngineering

🤣🤣🤣

Merry Christmas Day! Have a MongoDB security incident. Somebody from Elastic Security decided to post an exploit for CVE-2025–14847 on Christmas Day.

patch ye MongoDB, there's an exploit for a vuln which has been in the product for over a decade that allows the remote, unauth read of any memory - which includes plaintext creds.

Somebody posted an exploit on Christmas Day, Merry Christmas!

doublepulsar.com/merry-christ...

Black Friday Mega savings on KQL courses for threat hunting, detection engineering, and incident response.

🔥 #BlackFriday discounts are live🔥
➤ 35% OFF all #KQL courses for threat hunting, detection engineering, and incident response.

#ThreatHunting #DetectionEngineering #DFIR #incidentresponse #CyberSecurity #InfoSec

👉academy.bluraven.io/blackfriday2...

Black Friday Mega savings on KQL courses for threat hunting, detection engineering, and incident response.

🔥 #BlackFriday discounts are live🔥
➤ 35% OFF all #KQL courses for threat hunting, detection engineering, and incident response.

#ThreatHunting #DetectionEngineering #DFIR #incidentresponse #CyberSecurity #InfoSec

👉academy.bluraven.io/blackfriday2...

Check out my new blog on nested app authentication.

Querying Azure Resource Graph Without Limits Using KQL Learn how to query Azure Resource Graph using KQL without hitting limits.

🛑 Azure Resource Graph limits number of results to 1000 when queried from Sentinel or Defender XDR using KQL.

There is a little trick that lets you bypass these limits.🤓

🔗
academy.bluraven.io/blog/queryin...

#KQL #MicrosoftSentinel #AzureResourceGraph #DefenderXDR

Announcing The Homelab Almanac: Version 3.0 The best guide to homelabs just got a lot better—and bigger.

Hello, friends! I'm thrilled to announce that The Homelab Almanac, v3.0 has officially launched! There is a **ton** of new stuff in this version, including:

- Proper DNS
- PKI
- Automatic signed certificates
- New secrets management
- Proxmox clustering
- Cloud integration

Detecting BadSuccessor: Shorcut to Domain Admin Detect BadSuccessor attacks exploiting dMSA in Windows Server 2025. Learn key detection methods and auditing configurations.

🚨 BadSuccessor = Bad OPSEC

With the right audit config, it's pretty easy to detect BadSuccessor.

academy.bluraven.io/blog/detecti...

#ThreatHunting #DetectionEngineering #ThreatDetection
#BadSuccessor

Detecting Vulnerable Drivers (a.k.a. LOLDrivers) the Right Way Detect vulnerable Windows drivers in MDE the right way using KQL and LOLDrivers.io. Avoid common query mistakes and boost detection accuracy.

This blog is a little bitter, but it's what it is🫠

academy.bluraven.io/blog/detecti...

#ThreatHunting #DetectionEngineering

Detecting Vulnerable Drivers (a.k.a. LOLDrivers) the Right Way Detect vulnerable Windows drivers in MDE the right way using KQL and LOLDrivers.io. Avoid common query mistakes and boost detection accuracy.

This blog is a little bitter, but it's what it is🫠

academy.bluraven.io/blog/detecti...

#ThreatHunting #DetectionEngineering

Website is down?

🚨 Test your Lateral Movement investigation skills!

We have just added a new challenge to our FREE "Hands-On Introduction to KQL for Security Analysis" course!

You can even test your AI agents' skills 😉

#KQL #Kusto #MicrosoftSentinel #MicrosoftDefender

academy.bluraven.io/course/intro...

Home - Blu Raven Academy Master KQL for threat hunting, detection engineering, and incident response in a hyper-realistic lab environment using real logs!

🐣 HAPPY EASTER CAPSTONE! 🛡️

My KQL courses now include a complete attack scenario to test your skills — end to end.

🎯 Hands-on labs
📉 20% OFF for a limited time!
Crack it open 👇

#KQL #Kusto #ThreatHunting #DetectionEngineering #DFIR

academy.bluraven.io

🎁 NEW UPDATE:

I've added a small challenge to my FREE "Hands-On Introduction to KQL for Security Analysis" course.

More will be coming soon!

#KQL #Kusto #MicrosoftDefender #MicrosoftSentinel
academy.bluraven.io/course/intro...

Introduction to KQL for Security Analysis Learn the basics of KQL to start your journey into security investigations, threat hunting, and detection engineering with hands-on experience in a hyper-realistic lab environment! Certificate of Com...

🚨 FREE unlimited lab access to "Introduction to KQL for Security Analysis" course!

Thrilled to announce that my Intro to KQL for Security Analysis lab environment is now completely free with no time restrictions!

academy.bluraven.io/course/intro...

#KQL #Kusto #ThreatHunting #Infosec

🚨 Problem with Cyber Range/Training platforms ❓

Most range platforms and training labs provide you with all the questions to solve, hinting answers to other questions.

I've implemented a trick to hide some questions that reveal hints for other questions for a real-life experience.

Stay tuned.👀

Why Knowing How to Query is an Essential Cybersecurity Skill At its core — cybersecurity revolves around data.

osintteam.blog/why-knowing-...

C2 Beaconing Detection with MDE Aggregated Report Telemetry Detecting C2 Beaconing using MDE Aggregated Report Telemetry.

🚨 Detect C2 Beacons!

New Microsoft Defender for Endpoint telemetry provides new opportunities for threat detection!

🔗
academy.bluraven.io/blog/beaconi...


#ThreatHunting #DetectionEngineering #MDE

Advanced KQL for Threat Hunting: Window Functions — Part 2 Sliding window functions are one of the powerful methods for accurate detections as they eliminate the potential false negatives. They can be used in threat hunting, detection engineering, and DFIR to...

When you group your logs by timestamp(binning) to detect threats, you probably cause false negatives. Solve it using sliding window counts!

academy.bluraven.io/blog/advance...

#KQL #ThreatHunting #DetectionEngineering

It appears Microsoft quietly mitigated most of the risk of the "Intune company portal" device compliance CA bypass by restricting the scope of Azure AD graph tokens issued to this app, making them almost useless for most abuse scenarios. Thx @domchell.bsky.social for the heads up.

The phishing usually happens on a managed device, though 🤔

I used plaintext roadtx and then used roadrecon to dump Entra ID data. I even caused sign-in failures. There isn't any CAP in this tenant. Could that be the reason? AFAIK, it doesn't affect risk identification.

🥲 Seems like you don't even have to use residential proxies for device code phishing for evasion. Just get a machine in one of the cloud providers' corresponding regions. 🤷‍♂️

💙Fall in Love with Threat Hunting, Incident Response, and Detection Engineering using #KQL💙
Code: VLTN30
Valid until 17.02

#ThreatHunting
academy.bluraven.io

I'm for multivariate anomaly detection approach and scoring the results. However, this scoring is not static like "if X, then score += 10".

Advanced KQL for Threat Hunting: Window Functions — Part 1 Window functions are one of the powerful methods for data analysis. They can be used in threat hunting, detection engineering, and DFIR to solve complicated use cases.

Window functions do wonders!

academy.bluraven.io/blog/advance...

#ThreatHunting #KQL

🚨 Time to check your detection queries for MDE:

DLL load events are recorded in DeviceImageLoadEvents table, NOT DeviceEvents table. I keep seeing people sharing queries with the wrong table and even with the wrong ActionType filters.

Your Private Wireguard Network from Scratch Let's learn how to set up our own private network for secure self-hosted services.

Here it is: your complete guide to building a Wireguard network that doesn't require any open ports at home, and doesn't require any third-party tools. Just Wireguard, your devices, and a little elbow grease.

taggart-tech.com/wir...