A skill, applied

SMB enumeration detection

I built a Defender XDR detection for an unusual source IP probing SMB on multiple devices within a short window, using DeviceNetworkEvents to identify the network pattern.

Experience at UK Water Utility

UK Water Utility

From Red Team findings to SQL and SMB detections

Threat-Informed Detection Engineering

Built SQL Server command execution and SMB enumeration alerts, alongside credential hunting and identity hardening. Selected delivery from a broader 26-item engineering backlog.

Read the story

Related skills

MITRE ATT&CK Detection use-case development Attack-path analysis Telemetry requirements Security risk prioritisation KQL Microsoft Defender XDR SQL Server security Credential exposure hunting Threat hunting Active Directory NTLM authentication

SMB enumeration detection

From Red Team findings to SQL and SMB detections

Viewed history

Ask about my work.