Heider Albadawi
SC-100, SC-400, SC-200, SC-300, AZ-500
Heider leads Detection Engineering, specialising in Microsoft Sentinel analytics, KQL development and security architecture. His expertise spans SIEM optimisation, analytics rule development and the Microsoft security stack, supported by SC-100 (Cybersecurity Architect) and SC-400 (Information Protection Administrator) alongside SC-200, SC-300 and AZ-500.
7 articles
What Is Business Email Compromise (BEC)? How It Works And How To Stop It In Microsoft 365
Business email compromise uses a hijacked or spoofed mailbox to divert payments. How BEC works, the signs in Microsoft 365, and how to stop it.
Threat ResearchYour Tenant, Their Storefront: Hunting The Phishing Crew That Resells Microsoft 365 Tenants
Microsoft has disrupted a phishing operation that hijacked Microsoft 365 tenants and sold them as hosting. How the takeover works and how to hunt for it.
Microsoft SecurityWhat Is OAuth? How It Works In Microsoft Entra ID, And How Attackers Abuse It
OAuth lets apps access data on your behalf without your password. How tokens, scopes and consent work in Entra ID, and how attackers abuse them.
Threat ResearchReal Microsoft Links, Hostile Destinations: Hunting OAuth Redirect Abuse In Entra ID
Phishing that starts on a genuine login.microsoftonline.com link and ends on an attacker's site. How the redirect trick works and how to hunt it.
Microsoft SecurityWhat Is Password Spraying? How It Works And How To Detect It In Microsoft Entra ID
Password spraying tries a few common passwords across many accounts to dodge lockouts. How it works, why MFA gaps matter and how to spot it in Entra ID.
SIEMThe Difference Between SIEM and Log Management
Every SIEM contains a log manager. No log manager contains a SIEM. What each one is for, why the distinction gets blurred, and which you actually need.
SIEMBest SIEM Tools in 2022 — And What Has Changed Since
Most of the 2022 SIEM shortlist has since been acquired, merged or absorbed. What actually changed, what did not, and how to choose one now.
Talk to the people
who do the work.
A demo against your own estate rather than a canned one, run by an analyst rather than a salesperson.