http://mattswann.dev/tags/defender/2026-07-07T09:00:00-06:00http://mattswann.dev/series/detection-deep-dive/2026-07-07T09:00:00-06:00http://mattswann.dev/posts/detection-deep-dive-encoded-powershell/2026-07-07T09:00:00-06:00http://mattswann.dev/tags/detection-deep-dive/2026-07-07T09:00:00-06:00http://mattswann.dev/tags/kql/2026-07-07T09:00:00-06:00http://mattswann.dev/2026-07-07T09:00:00-06:00http://mattswann.dev/tags/mitre-attack/2026-07-07T09:00:00-06:00http://mattswann.dev/posts/2026-07-07T09:00:00-06:00http://mattswann.dev/tags/powershell/2026-07-07T09:00:00-06:00http://mattswann.dev/series/2026-07-07T09:00:00-06:00http://mattswann.dev/tags/2026-07-07T09:00:00-06:00http://mattswann.dev/tags/detection-engineering/2026-06-11T21:29:58-06:00http://mattswann.dev/posts/eviltokens-kql-phishing/2026-06-11T21:29:58-06:00http://mattswann.dev/tags/phishing/2026-06-11T21:29:58-06:00http://mattswann.dev/tags/sentinel/2026-06-11T21:29:58-06:00http://mattswann.dev/posts/appdomainmanager-injection/2026-02-12T23:26:36-07:00http://mattswann.dev/series/deobfuscation-lab/2026-02-12T23:26:36-07:00http://mattswann.dev/tags/deobfuscation-lab/2026-02-12T23:26:36-07:00http://mattswann.dev/tags/dotnet/2026-02-12T23:26:36-07:00http://mattswann.dev/tags/malware-analysis/2026-02-12T23:26:36-07:00http://mattswann.dev/posts/5-kql-queries-containment/2026-01-05T09:18:38-07:00http://mattswann.dev/tags/incident-response/2026-01-05T09:18:38-07:00http://mattswann.dev/series/kql-kata/2026-01-05T09:18:38-07:00http://mattswann.dev/posts/advent-of-cyber-2025-day21-bonus/2025-12-21T23:39:55-07:00http://mattswann.dev/tags/base64/2025-12-21T23:39:55-07:00http://mattswann.dev/tags/tryhackme/2025-12-21T23:39:55-07:00http://mattswann.dev/tags/vbscript/2025-12-21T23:39:55-07:00http://mattswann.dev/tags/xor/2025-12-21T23:39:55-07:00http://mattswann.dev/about/http://mattswann.dev/tools/