Skip to main content

Security Insights

Research, tutorials, and analysis to help you become a more effective security analyst.

All articles

Page 2 of 4

Abstract dark illustration of numbered authentication paths converging on a single Windows security log entry

Tutorials

Windows Logon Types: A Triage Guide for Every 4624 Value

Every Windows logon type, what produces it in a healthy environment, what it means when it appears where it should not, and the queries to hunt it.

Astrid Lindqvist17 min read
Abstract dark illustration of a glowing authentication code fracturing into token shards drifting toward a shadowed terminal

Tutorials

Device Code Phishing: How to Detect the MFA Bypass

Device code phishing gives attackers OAuth tokens after the victim passes real MFA. See the Entra sign-in signals that catch it and how to block the flow.

Astrid Lindqvist11 min read
Abstract dark illustration of a shattered screen with glowing amber binary code bursting through it

Tutorials

Redline Stealer Detection: SOC Analyst Checklist

Detect Redline Stealer by its traces: non-browser reads of Login Data, reflective .NET loads, screen capture calls, SOAP C2 traffic, then a 6-step triage.

Astrid Lindqvist14 min read
Abstract layered rows of translucent amber panels flowing left to right against a dark background, suggesting data moving through sequential stages

Tutorials

Kusto Query Language (KQL): A SOC Analyst's Practical Tutorial

Kusto Query Language (KQL) is how you query Microsoft Sentinel and Defender XDR logs. Learn to read a KQL query, write one, and run two real triage examples.

Astrid Lindqvist17 min read
Abstract rows of dark ridged slats curving across a black background, lit by a warm orange glow, evoking parallel paths fanning out from one source

Tutorials

Sigma Rules Explained: Read, Write, and Convert One

Sigma rules are vendor-agnostic YAML detections. Read one rule field by field, then see its real sigma-cli output in Splunk SPL and Microsoft Sentinel KQL.

Astrid Lindqvist16 min read
Abstract rows of dark glass slats receding diagonally with a warm orange glow, evoking scrolling log lines

Tutorials

Windows Event Logs: Where They Live and How to Read Them

Windows event logs are .evtx files in C:\Windows\System32\winevt\Logs. Read the channels that matter to a SOC and preserve a copy as evidence.

Astrid Lindqvist20 min read
Abstract dark grid of glass panels receding into shadow, lit by a warm orange glow, evoking the MITRE ATT&CK matrix

Tutorials

MITRE ATT&CK for SOC Analysts: Tactics, IDs, Examples

All 15 Enterprise tactic IDs (Lateral Movement is TA0008), how techniques nest under them, and a worked alert chain mapped to ATT&CK step by step.

Astrid Lindqvist24 min read
Person at a MacBook Pro with a messaging app open in a cafe, simultaneously scrolling on a smartphone, iced drink on the table

Tutorials

Phishing Email Examples: 15 Analyzed by a SOC Analyst

Phishing email examples analyzed with real analyst eyes: red flags, header tells, and the patterns every security-aware person should recognize.

Astrid Lindqvist23 min read
Dual-monitor workstation in a dark room showing code on an iMac and a landscape wallpaper on a second display, lit by a desk lamp

Best Practices

Best EDR Tools in 2026: What Each Console Shows You

Eight EDR tools compared on what each console shows an analyst, with plan names, public prices checked October 2026, and free and open source options.

Astrid Lindqvist21 min read