Blue team notes
Detection ideas, investigation prompts, and operational reminders designed to be useful during real work.
Look beyond process names to encoded content, parent-child relationships, and network behavior.
Useful pivots include EncodedCommand, IEX, hidden window flags, browser or Office parents, and connections immediately after launch.
A new authentication method can be a persistence mechanism rather than normal account maintenance.
Correlate registration events with password resets, helpdesk tickets, device posture, location, and privileged role changes.
New source infrastructure or resource access may expose misuse of application credentials.
Build a baseline by principal, source network, resource, and time. Investigate first-seen combinations and privilege changes.
Malicious applications can gain access without collecting a user’s password.
Review consent events, requested scopes, publisher verification, redirect URIs, and subsequent API activity.