Matt Swann — Detection Engineering & Threat Intel

Matt Swann — Detection Engineering & Threat Intelhttp://mattswann.dev/Recent content on Matt Swann — Detection Engineering & Threat IntelHugoen-usTue, 07 Jul 2026 09:00:00 -0600Detection Deep Dive: Encoded PowerShell Commands (T1059.001)http://mattswann.dev/posts/detection-deep-dive-encoded-powershell/Tue, 07 Jul 2026 09:00:00 -0600http://mattswann.dev/posts/detection-deep-dive-encoded-powershell/The first entry in the Detection Deep Dive series: mapping encoded PowerShell execution to detection logic in Microsoft Defender, tuning out the false positives, and knowing what the detection can’t see.How a Single KQL Query Stopped an Entire EvilTokens Phishing Campaignhttp://mattswann.dev/posts/eviltokens-kql-phishing/Thu, 11 Jun 2026 21:29:58 -0600http://mattswann.dev/posts/eviltokens-kql-phishing/An AI-powered PhaaS campaign leaned on legit-vendor redirects and device-code phishing — but spoofing left a fingerprint. One KQL query plus a 5-minute MDE automation loop neutralized over 1,200 malicious emails in 48 hours.Abouthttp://mattswann.dev/about/Mon, 01 Jan 0001 00:00:00 +0000http://mattswann.dev/about/About Matt Swann