Whose endpoint is this… kali?!

This report outlines practical methods to detect post-exploitation activity and unauthorized devices by correlating rich telemetry from Windows Event Logs and Microsoft Defender XDR. It explains how stealthy frameworks (e.g., LOLBins, in-memory execution) can still leave traces such as workstation names and remote session metadata, and provides SPL/KQL prototypes for identifying anomalous origins and rogue hosts via baselining and CMDB lookups. The piece emphasizes high-fidelity, late-stage detections and offers considerations to minimize false positives and operational noise.