Azure SOC lab: Sentinel, Defender, and an Auth Abuse Hunting workbook

A cloud-native SOC lab in Azure, built around Microsoft Sentinel and Defender, to practice the actual workflow of an analyst seat rather than just read about it.

What’s in it

Simulated malware execution, C2 beaconing, and data exfiltration scenarios, investigated inside Sentinel and Defender the way a real alert would get triaged.

Detections

Wrote custom KQL detection analytics against the telemetry these scenarios generate, plus an Auth Abuse Hunting workbook for spotting unusual authentication patterns across the environment.

Full queries and workbook are in the repo linked above.