Hello, world. This is the first writeup on my site, and mostly a test that everything works.
What you’ll find here
I’m a Security Analyst at Orange Cyberdefense, working on threat detection and investigation every day. This section is where I’ll share things I learn along the way:
- CTF writeups: how I approached and solved challenges, including the dead ends.
- Detection engineering: queries and ideas for spotting attacker behaviour in tools like Microsoft Sentinel, Defender XDR and Splunk.
- Study notes: what helped me prepare for certifications such as GDAT and BTL1.
A first query
Since this is a security blog, a “hello world” deserves a query. This KQL snippet lists the most common process names seen on endpoints in the last day, a simple starting point for getting to know an environment:
DeviceProcessEvents
| where Timestamp > ago(1d)
| summarize Executions = count() by FileName
| top 10 by ExecutionsMore to come. If there’s a topic you’d like me to write about, get in touch.