Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Mehmet Ergene
The Hidden Gaps in Microsoft’s New Linkable Token Identifier
Press enter or click to view image in full size On 21st July 2025, Microsoft announced the general availability of linkable token identifiers, which introduces a new identifier SessionId across various logs to enhance incident response and anomaly detection.
Detecting BadSuccessor: The Shortest Path to Domain Admin
Yuval Gordon from Akamai has recently introduced a dangerous attack, BadSuccessor, that lets low privileged users compromise the whole domain by abusing the delegated Managed Service Accounts (dMSA) feature introduced in Windows 2025. In this post, I’ll explain how we can reliably detect this abuse since it cannot be detected with default auditing configuration in Active Directory.
Your Logs are Lying: How Network Infrastructure Impacts EDR Network Telemetry
Detection engineers rely heavily on EDR for visibility into network activity originating from endpoints. But what if your infrastructure is quietly obscuring the truth?
Querying Azure Resource Graph without Limits Using KQL
One of the cool features of Microsoft Sentinel and Defender XDR is that they allow us to query Azure resources using KQL. However, this capability has limitations which makes it unusable in large environments. In this post, I’ll explain how to query Azure resources using KQL and bypassing the limits. You want to list all primary endpoints of all storage accounts in your Azure environment so that you can whitelist them when running your hunting query.
Detecting Vulnerable Drivers (a.k.a.
A recent poll I conducted revealed a concerning gap in understanding around how to detect vulnerable drivers using Microsoft Defender for Endpoint (MDE) telemetry. The results prompted this post; not just to clarify, but to help prevent the propagation of inaccurate detection methods. Misconceptions in Driver Load Events In the poll, 21% of respondents selected a table that doesn’t even exist in MDE.
EDR Silencer and Beyond: Exploring Methods to Block EDR Communication - Part 2
Attackers continuously innovate new ways to bypass security measures. Recently, a new technique called EDR Silencer has gained attention for its ability to disable EDR solutions. The method works by leveraging Windows Firewall rules to block EDR agents’ communication with their management centers, effectively cutting off telemetry, resulting in no telemetry or alert generated on the management console.
A Common KQL Mistake in Threat Hunting and Detection Engineering
When crafting queries for threat hunting or detection engineering using the Kusto Query Language (KQL), a frequent oversight involves handling numeric fields with null values. In KQL, numeric types such as int, long, and real can be null when data is missing, due to internal bugs in EDRs, or when queries or functions return no data. This nuance can significantly impact the effectiveness of queries, causing false negatives.
Using Python Plugin in Microsoft Sentinel by Leveraging ADX
Microsoft Sentinel is a robust SIEM platform, but it has its limitations, particularly when it comes to extending its capabilities with Python and fully leveraging the Kusto Query Language (KQL). However, there’s a workaround that bridges this gap up to a certain point, integrating the advanced analytics and flexibility of Python with Sentinel’s comprehensive security data. Azure Data Explorer (ADX), with its Python plugin and extensive KQL support, offers a solution.
A Deep Dive into the KQL Union Operator
The union operator in KQL is used to merge the results of two or more tables (or tabular expressions) into a single result set. A familiar instance of this operation is the search operator, which implicitly performs a union when querying across multiple tables. Syntax: <Table1> | union (<OptionalParameters>) <Table2>, <Table3>, <TabularExpression1>, ... // We can also use the below syntax union (<OptionalParameters>) <Table1>, <Table2>, <TabularExpression1>, ...
Advanced KQL for Threat Hunting: Window Functions
In my previous blog, I explained what window functions are and how we can use them for threat hunting and detection by giving Cloud Account Takeover Attacks as an example and using the prev() function: In this post, I'll explain the sliding_window_counts plugin and provide you with a query for Password Spray attack detection/hunting. According to the documentation, the sliding_window_counts plugin calculates counts and distinct count of values in a sliding window over a lookback period.
Enterprise Scale Threat Hunting with Process Tree Analysis
Let’s Connect | LinkedIn | Twitter A couple of months ago, I came across some blog posts about detecting threats by analyzing process trees or process parent-child relationships. The idea behind this method is to create process trees and find rare patterns that might be an indication of malicious activity. To make it more clear, let’s have a look at an example: You open a document you received and click “enable content”. Then, all of a sudden, you get compromised.
Advanced KQL for Threat Hunting: Window Functions - Part 1
Window functions are one of the powerful methods for data analysis. While they are primarily used in finance and business analytics, they can also be used in threat hunting and DFIR and solve complicated use cases. In this post, I will briefly explain two KQL(Kusto Query Language)window functions, prev() and next(), and how to use them for threat hunting. I’ll use the cloud account takeover scenario I’ve previously posted as an example to demonstrate.
Detecting Azure AD Account Takeover Attacks
Cloud account takeover(ATO) is an attack where attackers gain access to cloud identities by using methods like social engineering, device code phishing, etc. Detecting these attacks can sometimes be difficult. In this blog, I'll explain how we can develop a generic detection that covers almost any, if not all, methods for Azure AD(Well, the method can be applied to other identity providers, too).
Detecting DLL Hijacking Attacks - Part 1
DLL Hijacking methods are very well covered by Wietze Beukema in his blog: Below is what happens before and during the attack: A vulnerable application “vuln_app” loads legitimate DLL “legit.dll” from a directory “expected_directory”. The attacker plants a malicious DLL “legit.dll” into a directory “unexpected_directory”. The “vuln_app” application starts loading the malicious “legit.dll” from “unexpected_directory”.
Detecting DLL Hijacking Attacks
DLL hijacking ( T1574) is one of the most favorite techniques used by attackers. In this post, I'll explain a method to hunt/detect where a DLL with an invalid signature is used for DLL hijacking. The post explicitly covers the scenario of planting a DLL in a different folder and making an application load it instead of the original DLL. Some of the techniques covered in this scenario are DLL Search Order Hijacking, DLL Sideloading, and Path interception hijacking.
Email: “E” For “Error?”
Photo by Thanhy Nguyen on Unsplash A number of years ago while on a family vacation, a younger member of the household that stayed behind was given a simple task. We asked if they could go to the local post office to mail a letter for us. I’ll admit I wasn’t expecting the response “I don’t know how” and it gave me pause for thought. In the present society, we have an entire generation growing up that has never known a world without “The Internet”.
Detecting and Responding to Ransomware Attacks By Using Free Tools
After writing Defeating Ransomware by Using Sysmon and PowerShell, I continued my research on modern ransomware techniques and found new methods that can be applied for almost all kinds of ransomware. In this post, I’m going to explain modern ransomware techniques and how to detect and respond to them by using built-in Windows features and free tools.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Mehmet
Contact Mehmet, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack