A skill, applied

Microsoft Defender XDR

I built detection logic for unusual SMB probing using Defender XDR DeviceNetworkEvents, looking for one source IP contacting multiple devices over a short interval. This formed part of selected follow-through from Red Team findings.

Experience at UK Water Utility

UK Water Utility

From Red Team findings to SQL and SMB detections

Threat-Informed Detection Engineering

Built SQL Server command execution and SMB enumeration alerts, alongside credential hunting and identity hardening. Selected delivery from a broader 26-item engineering backlog.

Read the story

Related skills

MITRE ATT&CK Detection use-case development Attack-path analysis Telemetry requirements Security risk prioritisation KQL SQL Server security SMB enumeration detection Credential exposure hunting Threat hunting Active Directory NTLM authentication

Microsoft Defender XDR

From Red Team findings to SQL and SMB detections

Viewed history

Ask about my work.