Microsoft 365Entra IDDefender XDRSentinelPurview

From attack to detection

Defender XDR, Sentinel, Purview and Entra ID. Attack techniques, KQL hunting and hardening.

I'm Olivier, security architect at Wakers. This blog takes real attack techniques against Microsoft 365 and Entra ID and turns them into KQL hunts, detection rules and hardening you can apply on Monday morning.

Explore the attack matrix All articles

Featured

REFERENCE · UPDATED 2026

Microsoft 365 & Entra ID attack matrix The attacker's view of a tenant, mapped by tactic: password spray, AiTM, OAuth backdoors, BEC, GoldenSAML, Copilot abuse...

Explore by topic

Microsoft 365 & AzureIdentity, mailbox, OAuth, hybrid, Defender, Sentinel. PowerShellGuides and tooling for admins and responders. SysinternalsJoint work with @Mudpak. Mobile forensicsJoint project with @Mudpak.

Disclaimer

Some articles describe attacker techniques. Reproduce them only in a lab you own. Queries are hunting starting points: test and tune them before promoting them to analytics rules.