Field Notes
Field notebook
Quick technical observations that don't need a full post — findings, one-liners, detection queries and things worth remembering. Rougher and more frequent than the blog.
Detection
A Defender KQL query for rare parent–child process pairs
Surface unusual process ancestry (e.g. Office spawning a shell) by scoring parent–child pairs against their historical frequency.
Azure
One-liner: pull an Azure IMDS token from a compromised VM
A quick reminder of the Instance Metadata Service call that turns VM access into an Azure AD token — and why egress filtering matters.