Heider Albadawi
SC-100, SC-400, SC-200, SC-300, AZ-500
Heider leads Detection Engineering, specialising in Microsoft Sentinel analytics, KQL development and security architecture. His expertise spans SIEM optimisation, analytics rule development and the Microsoft security stack, supported by SC-100 (Cybersecurity Architect) and SC-400 (Information Protection Administrator) alongside SC-200, SC-300 and AZ-500.
23 articles
What Is GDAP? Granular Delegated Admin Privileges Explained, And How To Review Your Partners' Access
GDAP gives Microsoft partners time-limited, role-based admin access to your tenant. How it works, how it differs from DAP, and how to review it.
Microsoft SecurityWhat Is LDAP? How It Works In Active Directory, And How Attackers Use It For Reconnaissance
LDAP is how applications read and search Active Directory. How it works, LDAPS, signing and channel binding, and how attackers use it to map your domain.
Threat ResearchYour VPN Read Your LAPS Passwords: Hunting The Ivanti Connect Secure Chain From Active Directory
The Ivanti zero-day chain left no implant, so a clean appliance scan proves little. Hunt the LAPS, BitLocker and Kerberos activity on your DCs instead.
Microsoft SecurityWhat Is AD CS? Active Directory Certificate Services, ESC1 And ESC8 Explained, And How To Harden Them
AD CS issues the certificates your Windows estate trusts. How it works, why ESC1 and ESC8 turn it into a route to domain admin, and how to audit and harden it.
Threat ResearchFrom A Teams Call To A Domain Controller Certificate: Hunting Help Desk Impersonation Into AD CS (ESC1 And ESC8)
A fake help desk call, a Quick Assist code, then certificates for domain admins. How the ESC1 and ESC8 intrusions worked, and Defender hunts for each step.
Microsoft SecurityWhat Is Microsoft Secure Score? What It Measures, What It Misses, And How To Raise It Safely
Microsoft Secure Score measures your Microsoft 365 security configuration. How it is calculated, what it misses, and how to raise it safely.
FundamentalsWhat Is Credential Stuffing? How It Works, How It Differs From Password Spraying, And How To Stop It In Microsoft Entra
Credential stuffing replays leaked username and password pairs at scale. How it works, how it differs from spraying and how to spot and stop it in Entra.
Microsoft SecurityWhat Is Secure Boot? How It Works, Why It Matters, And How Bootkits Still Get Past It
Secure Boot only lets signed, trusted software start before Windows. How it works, what it misses, the 2026 certificate changes and how to check it.
Threat ResearchValid Password, Stolen Session: Hunting The Microsoft 365 Token Spray-And-Replay Campaign
An attacker replayed post-MFA tokens into 79 organisations. How it worked, what it left behind, and KQL to hunt for it in Sentinel and Defender.
Microsoft SecurityWhat Is Device Code Phishing? How It Works In Microsoft 365, And How To Block It
Device code phishing tricks users into signing in on Microsoft's real page for an attacker's device. How it works, how to detect it and how to block it.
Threat ResearchAccept, Then Sign In: Hunting The Calendar-Invite Phishing Surge In Microsoft 365
Fake meeting invites hit 740,000+ in two weeks of October, aimed at Microsoft 365 logins. Why they get through, and how to hunt them in Defender.
GovernanceThe October Update Didn't Break Your Wi-Fi. It Found Your NTLM Debt.
Since October, Windows blocks NTLMv1-derived single sign-on by default and some Wi-Fi and VPN logins broke. The quick fix, the real fix, and what's next.
Microsoft SecurityWhat Is NTLM? How It Works, Why Microsoft Is Retiring It, And How Attackers Abuse It
NTLM is Windows' older challenge-response authentication. How it works, how it differs from Kerberos, how attackers abuse it, and how to find and reduce it.
Microsoft SecurityWhat Is A Service Principal? App Registrations, Enterprise Apps And How To Secure Them In Entra
A service principal is an app's identity in your Entra tenant. How it relates to app registrations, where secrets live, and how to secure and monitor them.
Threat ResearchOne Trusted App, 173 Tenants: Hunting A Compromised Third-Party App In Entra ID
A backup app's identity was used to sign in to 173 Microsoft 365 tenants. Why session revocation won't help, and how to hunt it in Entra and Sentinel.
Microsoft SecurityWhat Is Privileged Access Management (PAM)? How It Works In Microsoft Entra, And Where It Fails
Privileged access management controls who holds admin rights, when and how. How PAM works in Microsoft Entra with PIM, and where it usually fails.
Threat ResearchYour Tenant, Their Storefront: Hunting The Phishing Crew That Resells Microsoft 365 Tenants
Microsoft has disrupted a phishing operation that hijacked Microsoft 365 tenants and sold them as hosting. How the takeover works and how to hunt for it.
Microsoft SecurityWhat Is Business Email Compromise (BEC)? How It Works And How To Stop It In Microsoft 365
Business email compromise uses a hijacked or spoofed mailbox to divert payments. How BEC works, the signs in Microsoft 365, and how to stop it.
Threat ResearchReal Microsoft Links, Hostile Destinations: Hunting OAuth Redirect Abuse In Entra ID
Phishing that starts on a genuine login.microsoftonline.com link and ends on an attacker's site. How the redirect trick works and how to hunt it.
Microsoft SecurityWhat Is OAuth? How It Works In Microsoft Entra ID, And How Attackers Abuse It
OAuth lets apps access data on your behalf without your password. How tokens, scopes and consent work in Entra ID, and how attackers abuse them.
Microsoft SecurityWhat Is Password Spraying? How It Works And How To Detect It In Microsoft Entra ID
Password spraying tries a few common passwords across many accounts to dodge lockouts. How it works, why MFA gaps matter and how to spot it in Entra ID.
SIEMBest SIEM Tools in 2022 — And What Has Changed Since
Most of the 2022 SIEM shortlist has since been acquired, merged or absorbed. What actually changed, what did not, and how to choose one now.
SIEMThe Difference Between SIEM and Log Management
Every SIEM contains a log manager. No log manager contains a SIEM. What each one is for, why the distinction gets blurred, and which you actually need.
Talk to the people
who do the work.
A demo against your own estate rather than a canned one, run by an analyst rather than a salesperson.