KQL Detection of the Week: The Query That Wrote Itself Eight Times
A write-up on detecting SharePoint RCE through KQL, examining how a detection query evolved across multiple iterations and the challenge of building reliable correlations when baselines shift. Relevant for defenders writing detections in Microsoft environments who need to think through query stability and what makes a signal hold up under real-world noise.