Okan YILDIZ

The learning comes from creating the telemetry, writing the query, turning it into a detection, then explaining an alert you generated yourself. The value lies in the connected chain — data source, logs, KQL, detection, alert, incident, investigation, response, automation — rather than in any single feature.

The Microsoft Sentinel home lab moves step by step: create an Azure subscription and resource group, build a Log Analytics workspace, enable Sentinel, connect Windows security logs, learn tables and common Windows Event IDs, write basic KQL, hunt failed logins with Event ID 4625, turn that hunt into an analytics rule, trigger and validate an alert, investigate the incident, decide whether it is a true or false positive, then build automation rules and playbooks.

• The payoff is clear: the real skill is not creating an alert but explaining why it matters and what should happen next.
• The post also lists questions an analyst should practise answering: who generated the activity, which host was involved, how many attempts occurred, whether this is normal behaviour, what evidence supports the alert, and whether to close or escalate.

The post credits Blueteamers for the Sentinel roadmap, presenting the walkthrough as shared material rather than a lab Okan says they built. It focuses on how to learn the skills.

Read original

Individually manageable issues can connect into a route to privileged access or sensitive data; a report that never assembles that path leaves readers unable to judge the risk. A security team needs a report it can act on: one that shows where the attacker started, what enabled the path, and what exactly breaks it.

The post sets out the questions a strong report answers: where the attacker started, the final objective or impact, which weaknesses enabled the path, how each finding can be reproduced, what evidence supports the conclusion, what exact remediation breaks the chain, what could not be tested, which controls worked as expected, and whether a retest proved the path was closed.

• The post illustrates the argument with three “medium” issues that may look manageable individually but can combine into a direct path to privileged access or critical systems.
• The report sequence is scope, attack path, evidence, root cause, remediation, retest.
• Retesting should establish whether the attacker can still complete the original path, not simply whether tickets were closed.

Read original

An attacker-controlled domain can authenticate correctly, a convincing lookalike can pass SPF, DKIM and DMARC, and business email compromise may carry no malicious attachment or link. The method follows from this: preserve the original evidence, then parse, inspect and correlate before drawing a conclusion.

The phishing field notebook runs from saving the original .eml, reconstructing the Received path, and comparing envelope sender against From, Return-Path and Reply-To, through reviewing SPF, DKIM, DMARC and alignment, investigating display-name impersonation, looking for homoglyphs, punycode and lookalike domains, defanging and expanding URLs safely, and triaging attachments without opening them, to treating BEC as an identity and behaviour problem and hunting indicators across the wider environment.

• The sequence is preserve, parse, authenticate, inspect, analyse, correlate, hunt, report.
• Once one malicious email is confirmed, the post asks who else received it, who clicked, whether credentials were entered, whether the same infrastructure appeared elsewhere, whether an endpoint was affected, and what detection should be added before the next attempt.
• Deleting the message removes the artifact, not the incident.

Read original

Those questions turn one completed exercise into the next task — a validation into a detection, a finding into a debrief, a confirmed email into an environment-wide hunt. Two posts also point to a named, self-published working document, suggesting a priority on reusable artifacts rather than one-off explanations.

Each post opens by overturning a default assumption: you do not learn SOC operations by memorising what a SIEM does; a pentest report should not just tell you what is vulnerable; a phishing email can pass SPF, DKIM and DMARC and still be malicious.

• Each gives an ordered chain — data source to automation, scope to retest, preserve to report — then closes with practitioner questions and an invitation to say what the reader would focus on first.
• The pentest post gives security teams a debrief question: “which of the tester's actions should our security controls have detected?”
• It turns an offensive test into a detection-engineering task.

Read original · Original 2 · Original 3

It lays out an ordered path rather than a pile of disconnected tutorials, showing newcomers how the pieces of a security operations centre fit together before they work in a real one.

The post lays out a sequence for building a working Sentinel lab: create an Azure subscription and resource group; set up a Log Analytics workspace; enable Sentinel; turn on auditing and retention; connect Windows security logs; learn tables and common event IDs; write basic KQL; hunt failed logins with Event ID 4625; turn that hunt into an analytics rule; trigger and validate an alert; investigate the resulting incident; decide whether it is a true or false positive; then build automation rules and playbooks.

• Its central point is the chain itself: data source, logs, KQL, detection, alert, incident, investigation, response and automation.
• The post closes with questions an analyst should be able to answer, including who generated the activity, which host was involved, how many attempts occurred, whether the activity is normal and what evidence supports the alert.
• A credit line names Blueteamers as the guide's origin.
• The post ends by asking readers what they would focus on first.

For brands planning a campaign

A training company can use this sequence as a course syllabus: it takes learners from an empty cloud environment through a complete investigation and response cycle, rather than touring portal buttons. The closing analyst questions work as assessment prompts, while the choice of KQL, detection engineering, investigation or automation offers a way to split learners into beginner and advanced tracks.

It explains the difference between a list of weaknesses and a story of how an attacker gets in—a useful starting point for newcomers reading a report.

The post argues that a vulnerability rating describes a single finding, while an attack chain explains the risk: three medium issues can combine into a path to privileged access or sensitive data.

• It describes an 18-page field manual the author calls their own, organised around where the attacker started; the final objective or impact; which weaknesses enabled the path; how to reproduce each finding; what supports the conclusion; what exact remediation breaks the chain; what could not be tested; which controls worked; and whether a retest proved the path closed.
• The structure runs from scope and attack path through findings, root cause, remediation and retest.
• The post says a retest should establish whether an attacker can still complete the original path, not merely whether tickets were closed.
• It also proposes a debrief question for security teams: which of the tester's actions should their controls have detected?

For brands planning a campaign

This is a reporting and communication module, not an exploitation module, making it a strong fit for buyers who already run pentests and want more from them. A course could use the distinction between an attack path and a finding as its teaching spine, then use the debrief question to connect offensive testing with detection engineering—a cross-sell between red-team and blue-team audiences.

It explains why authentication is not the finish line and gives readers an order of operations for handling suspicious email.

The post starts with a key point: a phishing email can pass SPF, DKIM and DMARC and still be malicious.

• Analysis should begin with the full message, not the authentication result.
• The process is to preserve first, analyse safely and correlate everything: save the original .eml; reconstruct the Received path; compare the envelope sender with From, Return-Path and Reply-To; review SPF, DKIM, DMARC and alignment; investigate display-name impersonation; look for homoglyphs, punycode and lookalike domains; defang and expand URLs safely; triage attachments without opening them; treat business email compromise as an identity and behaviour problem, not only a malware problem; and hunt indicators across the wider environment.
• The post draws a clear distinction: authentication proves something about sending infrastructure, not the trustworthiness of the message.
• Once a malicious email is confirmed, it asks who else received it, who clicked, whether credentials were entered, whether the same infrastructure appeared elsewhere, whether an endpoint was affected and what detection should be added before the next attempt.

For brands planning a campaign

This suits a triage lab in which learners work through a suspicious message end to end.

• The post provides both the ordered steps and follow-up questions for turning one email into an environment-wide hunt.
• The line that deleting a message removes the artifact but not the incident is a strong hook for a module on containment and detection gaps.
• Its framing of BEC as behaviour also lets a course reach non-technical fraud and identity teams alongside SOC analysts.

The stated point is that the value lies in the connected workflow — data source, logs, KQL, detection, alert, incident, investigation, response, automation — rather than knowing where the portal buttons are.

• The post also lists questions analysts should practice answering: who generated the activity, which host was involved, how many attempts occurred, whether the behaviour is normal, what evidence supports the alert, and whether to close or escalate.
• It closes with expansion paths: Microsoft 365 logs, Entra ID telemetry, more detection rules, MITRE ATT&CK mapping, workbooks, automation and attack simulations.

A numbered roadmap with an explicit pipeline diagram, plus analyst questions attached to each stage rather than left as an abstract checklist.

The post credits Blueteamers for the guide, presenting the walkthrough as shared material rather than a lab Okan YILDIZ says they built.

For brands planning a campaign

This is the most course-ready example in the material: a named platform, a defined progression, specific event IDs and query types, and clear module boundaries across detection engineering, incident investigation and automation. A hands-on SOC analyst course could reuse the data-source-to-response spine and assess students on the listed analyst questions, rather than adding new structure.

Examples: Source 1

The post sets out the questions a strong report answers: where the attacker started, what the final objective or impact was, which weaknesses enabled the path, how each finding can be reproduced, what evidence supports the conclusion, what exact remediation breaks the chain, what could not be tested, which controls worked as expected, and whether the retest proved the path was closed.

• The central distinction is that a vulnerability rating describes a finding, while an attack chain explains the risk: three individually manageable "medium" issues could combine into a route to privileged access, sensitive data or critical systems.
• The post gives a report sequence — scope, attack path, evidence, root cause, remediation, retest — and insists that retesting establish whether the attacker can still complete the original path, not just whether tickets were closed.
• It also poses a debrief question for SOC teams: which of the tester's actions should our security controls have detected?

Presents report writing as a repeatable structure, with a fixed sequence and questions the document must answer.

For brands planning a campaign

Useful for a course spanning offensive testing and detection.

• The material links red-team findings to blue-team controls through the debrief question, making it suitable for a purple-team module or an assessment in which students rewrite a weak report as an attack chain and specify the detection that should have caught it.
• Ask to review the field manual before using it as course text; its exact page content is not included here.

Examples: Source 1

The steps run from saving the original .eml, reconstructing the Received path and comparing envelope sender, From, Return-Path and Reply-To, through reviewing SPF, DKIM, DMARC and alignment; investigating display-name impersonation; looking for homoglyphs, punycode and lookalike domains; defanging, expanding and safely inspecting URLs; and triaging attachments without opening them, to treating BEC as an identity and behaviour problem and hunting indicators across the wider environment.

• The argument is that authentication proves something about the sending infrastructure, not that the message is trustworthy: an attacker-controlled or lookalike domain can authenticate correctly, and a BEC email may have no attachment or link at all.
• The post gives the sequence Preserve, Parse, Authenticate, Inspect, Analyse, Correlate, Hunt, Report, then asks follow-up questions after confirming one malicious email: who else received it, who clicked, whether credentials were entered, whether the same infrastructure appeared elsewhere, whether an endpoint was affected, and what detection should be added before the next attempt.

An ordered eight-stage workflow, with evidence checks attached to each stage.

The BEC warning explicitly separates authentication results from trust, challenging the common first question: did the message pass authentication?

For brands planning a campaign

This maps directly onto an email security or SOC investigation module: each stage is an artefact a student can produce, and the closing questions provide ready-made detection-engineering exercises. Ask for the notebook itself before reusing the material as written; its contents are not included here.

Examples: Source 1

Each opens by correcting a common assumption: you do not learn SOC operations by memorising what a SIEM does; a pentest report should not just say what is vulnerable; a phishing email can pass SPF, DKIM and DMARC and still be malicious.

• Each then gives an ordered pipeline: data source to automation in the Sentinel post, scope to retest in the pentest post, and preserve to report in the phishing post.
• Each lists questions a practitioner should be able to answer and ends with a discussion prompt, save and repost requests, and a hashtag block.
• Two of the three describe a named self-published working document — an 18-page pentest field manual and a phishing field notebook — while the Sentinel post is a roadmap credited to Blueteamers.

Consistent structure across posts: assumption correction, numbered or arrowed workflow, practitioner questions and audience prompt.

For brands planning a campaign

The consistency helps with course production: the same template can be applied to new modules, but may limit variety across a programme. The three posts also cover different disciplines — detection and blue-team operations, offensive testing and reporting, and email investigation — so a training company would need to decide whether to build one hands-on SOC track with the others as electives or a multi-track programme.

Examples: Source 1 · Source 2 · Source 3

They later name Microsoft 365 logs and Entra ID telemetry as extensions.

• Microsoft is the subject of the tutorial; the post does not state whether there is a sponsorship, partnership, or client relationship.
• Ask Okan to confirm any commercial ties before booking.

View example

It does not state whether the guide involved payment, sponsorship, or another commercial connection. Ask Okan to clarify before booking.

View example

Garton examines living-off-the-land techniques using SMB, WMI and WinRM, and identity attacks such as session hijacking, OAuth abuse, MFA fatigue and token replay.

• They urge defenders to baseline admin behaviour, watch service accounts and fuse identity signals with endpoint and network data.
• Okan YILDIZ takes a similar behavioural-detection approach, asking which tester actions a security control should have caught.

Garton writes commentary on published advisories and adversary tradecraft, linking to the CISA and Mandiant material under discussion. Okan YILDIZ instead publishes structured exercise material—a lab roadmap, a report field manual and an email analysis notebook—so readers can follow a sequence end to end rather than read commentary on current reporting.

Read original · Original 2

Karanjalkar argues that attackers can quickly swap malware, domains and infrastructure while their behaviour remains constrained by the same objectives. That reasoning underpins the handling advice in Okan YILDIZ's pentest and phishing posts.

Karanjalkar's posts are conceptual and standards-focused: they cover representing behaviour in a vendor-neutral, machine-readable form using STIX 2.1, and the difference between anomaly-based behaviour analytics and behavioural threat intelligence. Okan YILDIZ focuses on practitioner steps—what to do, in what order, and what question to answer next—rather than data models or interoperability.

Read original · Original 2

Faruque describes an indirect prompt injection in Salesforce Agentforce with no malware, privilege escalation or suspicious network traffic, where activity looks like legitimate approved-domain traffic.

• Okan YILDIZ raises a similar problem: a phishing email can pass SPF, DKIM and DMARC and still be malicious.
• Both recommend detection and logging rather than relying on a verdict from a single check.

Faruque covers the AI attack surface—autonomous agents, their tools and memory, AI-generated code, and AI-accelerated exploitation—with tooling recommendations at free and paid tiers, drawing in part on conference and panel context. Okan YILDIZ's published material focuses on SIEM-centred SOC work, penetration-test reporting and email investigation rather than AI systems.

Read original · Original 2

Their posts cover Volt Typhoon's living-off-the-land persistence inside critical infrastructure and turn it into operator questions a course can score: are you logging and correlating lateral movement over SMB, WMI and WinRM; alerting on anomalous service-account use; baselining admin behaviour and flagging deviations; and hunting credential access and token abuse instead of payloads?

• A second post covers the identity shift—session hijacking, OAuth abuse, MFA fatigue and token replay—and argues that defenders who keep pace focus on token lifetime reduction and session revocation, MFA-abuse telemetry rather than checkbox MFA, and identity signals fused with endpoint and network data.
• For a module on behavioural detection, identity telemetry or purple-team validation of adversary tactics, this framing offers a sharper threat picture and more advanced operator questions than the Sentinel lab sequence, which starts lower down the stack.

The material frames arguments and detection strategies rather than a build sequence: it offers no environment setup, query walkthrough or alert-to-incident cycle.

• A training company would need to build the lab and exercises, and pull the primary CISA Volt Typhoon advisory and Mandiant identity-attack guidance, confirming reuse rights.
• Learners who need to stand up a SIEM and work an alert end to end will get less from this than from the published lab workflow.

Examples: Source 1 · Source 2

The OCA Indicators of Behaviour post explains a vendor-neutral way to describe attacker behaviour using STIX 2.1—initial access, privilege escalation, credential access, lateral movement, persistence, command and control, staging and exfiltration—and argues that behaviour is far harder for attackers to change than infrastructure or tooling.

• The follow-up distinguishes behaviour analytics, which answers only whether activity is unusual, from behavioural threat intelligence, which places activity within an attack objective and wider campaign.
• It names Microsoft Defender, CrowdStrike Falcon, Splunk, Exabeam, Darktrace and Google Chronicle as platforms doing the former.
• That gives a standards, CTI-sharing, XDR-interoperability or AI-assisted-detection module a usable spine and a vendor landscape buyers will ask about.

There is no hands-on component: no lab, telemetry, detections or investigation.

• The material is conceptual and standards-oriented, longer and more abstract than the ordered Sentinel workflow; platforms appear as examples, not tools being taught.
• It also assumes some fluency in threat-intelligence vocabulary.
• Ask for a completed incident or portable exercise if learners need to practise those skills.

Examples: Source 1 · Source 2

The posts examine AI-native attacks through a named case—the ForcedLeak vulnerability in Salesforce Agentforce, where indirect prompt injection turned an autonomous agent into a CRM data-leak path—and break down the agent attack surface (knowledge bases, executable tools, memory and autonomous workflows) and why it produces no malware, privilege escalation or suspicious network traffic to alert on.

• The second post adds attack economics and a concrete controls stack: delimiter spotlighting to isolate inputs; a security-code-review checklist for every AI feature pull request; basic request logging with three anomaly alerts on free-tier tooling; open-source guardrails including Guardrails AI, Llama Guard and NeMo; and a growth path of Lakera Guard or Azure Prompt Shields, behavioural anomaly detection, output filters and monthly automated red teaming against the OWASP LLM Top 10 with Garak.
• A live attack case and that level of named tooling give a module on securing AI features practical detail.

It does not cover SOC operations, KQL, SIEM setup or phishing analysis, so it adds an AI-security track to a SOC course rather than replacing one.

• The ForcedLeak details come from another firm's research; ask for the primary write-up and re-check the claims.
• The posts also promote a New York panel, so verify dates, event references and figures before use.

Examples: Source 1 · Source 2