Sentinel on Matt Swann — Detection Engineering & Threat Intelhttp://mattswann.dev/tags/sentinel/Recent content in Sentinel on Matt Swann — Detection Engineering & Threat IntelHugoen-usThu, 11 Jun 2026 21:29:58 -0600How a Single KQL Query Stopped an Entire EvilTokens Phishing Campaignhttp://mattswann.dev/posts/eviltokens-kql-phishing/Thu, 11 Jun 2026 21:29:58 -0600http://mattswann.dev/posts/eviltokens-kql-phishing/An AI-powered PhaaS campaign leaned on legit-vendor redirects and device-code phishing — but spoofing left a fingerprint. One KQL query plus a 5-minute MDE automation loop neutralized over 1,200 malicious emails in 48 hours.