Microsoft 365Entra IDDefender XDRSentinelPurview

# From attack to detection

I'm Olivier, security architect at Wakers. This blog takes real attack techniques against Microsoft 365 and Entra ID and turns them into KQL hunts, detection rules and hardening you can apply on Monday morning.

[!button variant="primary" icon="shield-x" text="Explore the attack matrix"](/work/microsoft/m365_attacks/) [!button variant="light" icon="book" text="All articles"](/work/) ## Featured

REFERENCE · UPDATED 2026

Microsoft 365 & Entra ID attack matrix The attacker's view of a tenant, mapped by tactic: password spray, AiTM, OAuth backdoors, BEC, GoldenSAML, Copilot abuse...

## Explore by topic

Microsoft 365 & AzureIdentity, mailbox, OAuth, hybrid, Defender, Sentinel. PowerShellGuides and tooling for admins and responders. SysinternalsJoint work with @Mudpak. Mobile forensicsJoint project with @Mudpak.

!!!warning Disclaimer Some articles describe attacker techniques. Reproduce them only in a lab you own. Queries are hunting starting points: test and tune them before promoting them to analytics rules. !!!