I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: dirkjanm.io/obtaining-gl...

Did you ever asked yourself: What does Swiss cheese and Conditional Access have in common? Either way, if you want to learn about (un)documented Conditional Access Bypasses, then join me on Monday at the Workplace Ninja Summit 25 #WPninjas wpninjas25.sched.com/event/27VE4/...

Sentinel UEBA got a welcome set of new data sources ◽Defender XDR device logon events ◽Entra ID managed identity signin logs ◽Entra ID service principal signin logs ◽AWS CloudTrail ◽GCP audit logs ◽Okta MFA techcommunity.microsoft.com/blog/microso...

Token Protection in Microsoft Entra Conditional Access for Windows is now GA! 🎉 #EntraID #Token learn.microsoft.com/en-us/entra/...

Two years ago I published a two part series on #MSGraph logs and how to use them for threat hunting. Now comes part 3 and the logs are finally available to the masses. #EntraID #KQL #Security cloudbrothers.info/en/detect-th...

Recently, we announced the finalists for the most special of the #GoldenClippyAwards The #ChuckNorris award is for heroes in multiple areas: @nathanmcnulty.com @fabian.bader.cloud @bindertech.se @knudsenm.bsky.social@mortenknudsen.net Congratulate them/reshare for these rockstars! #MVPBuzz #WPNinjas

Defender AV Platform v4.18.25070.5 ◽Enhanced Passive Mode Scanning Behavior ◽Improved Tamper Protection Handling ◽Digital Signature Verification Performance Boost ◽Refined ASR Rule Exclusion Processing #MDAV #MDE #ASR

A rare, but highly welcome change. Microsoft changed the license requirement for Token protection from Entra ID P2 to P1. This will protect more customers in the long run and lead to a more secure ecosystem. learn.microsoft.com/en-us/entra/...

🚨 PSA - Zero day in SharePoint on-prem is actively exploited! ◽ Have Defender AV active ◽ Don't disable AMSI integration of SharePoint ◽ Keep an eye out for the alerts outlined in the article ◽ Look for post exploitation with the hunting query msrc.microsoft.com/blog/2025/07...

Part 8053 of eleventy billion on our path to killing NTLM: way way way way way better auditing. support.microsoft.com/en-us/topic/...

What r u doing while cooking? That’s my distraction …. #PSConfEU 2915

The latest on the Azure AD Graph retirement mentions two temporary outage tests and more guidance. If something stops working it might be because of those tests. #Entra #AADGraph techcommunity.microsoft.com/blog/microso...

One of the results of the joined research with @dirkjanm.io is entrascopes.com Basically the yellow pages for Microsoft first party apps. #TROOPERS25

"One thing we have learned over years is that the world moves quickly, and building is easy but supporting is hard...." Sydney Smith 2025 #StateOfTheShell #PSConfEU 2025

Rerunning my test scenarios for the #TROOPERS25 presentation...

Pizza 🍕

Microsoft trying to be like @vxunderground, smh 😂

Suspicious domain m365sessionlogin[.]com was registered through Njalla on 5/18/25. Domain itself does not resolve, but subdomains login, logon, and office365 indicate hosting at 80.78.30[.]154.

The unified IdentityInfo table is the most comprehensive way to identify users and their attributes in the unified SOC experience. You have to onboard your Sentinel workspace AND enable UEBA to take advantage of this in advanced hunting. #xdr #sentinel

First time I made it on the @msftsecresponse leaderboard 🍾 msrc.microsoft.com/leaderboard

Planning for some days off from work. What to put in the duffle back beside a good book and some sunscreen? My new favorite card game of course. #FOCI #FamilyOfClientID

Application Based Authentication on Microsoft Entra Connect Sync is near. With this change you will be able to use a TPM backed certificate in Entra Connect Sync for authentication. This is a welcome change to prevent the compromise of this high privileged account. #Entra #Certificate

I made an Azure version microsoftedge.microsoft.com/addons/detai...

Here's (finally!) what I've found about this 😉 bsky.app/profile/cnot...

👀 Who is Nova? We will find out tomorrow 😉

Here's another Maester v1.2 teaser. We just added Severity for test results plus the ability to filter by Severity.

Looks like Lifecycle Workflows just added the ability to revoke session tokens 💪 Previously, we had to create our own custom extension (Logic App) to do this, so really nice to see it as a built-in task now :) learn.microsoft.com/...

Two new ASR rules are now generally available: ◽Block rebooting machine in Safe Mode ◽Block use of copied or impersonated system tools learn.microsoft.com/en-us/defend...

Microsoft XDR Automatic attack disruption just got better. It now takes into account the device role and criticality to preserve key network functionality while protecting the assets. Plus IP address based containment of undiscovered devices! #XDR techcommunity.microsoft.com/blog/microso...

Happy to join the Workplace Ninja Summit 2025 together with @naunheim.cloud @oudendorp.nl @harjit.bsky.social interviewed us at the #MVPSummit youtu.be/DSYu-4tXaxI #WPNinjaSummit2025

Only 4️⃣ days until we come together for an epic PowerShell + DevOps experience! 🎉 💡 Learning ✅ 🤝 Networking ✅ 🚀 Growth ✅ 📢 Like, comment, and share to spread the excitement! #seattle #bellevue #powershell #techconference #devops #ai #innovation

This is awesome! Microsoft is killing off the ability for multi-tenant applications to authenticate in directories where a service principal has not been registered. learn.microsoft.com/... I'd like to automate discovery and remediation for admins, but I need help testing :)

Since it's already April, let's have a look at the top 10 passwords in Q1 2025. If yours is not part of the list, good for you 😅

Transition to enhanced modeling of Threat Intelligence data in Microsoft #Sentinel by 31 July 2025 That's a tight schedule, better get started soon.

Now in the official documentation. Session ID was long missing from the Entra Signin Logs outside of XDR but since early February 25 we can use it. It already has proven a powerful addition in detecting token theft.

It's time to prepare some content for the next @kqlcafe.bsky.social . I will discuss #KQL, Logic Apps and hunting through the available APIs. The session is on April 29th and is completely free to attend online. 🗓️Event registration & details: www.meetup.com/kql-cafe/

Excited to be at @specterops.bsky.social SO-CON this week!! If you're around, I'll be presenting "Abusing AUs, Confusing the SOC" tomorrow bright & early:

💡 Here's a tip to customize the Microsoft 365 password reset page that your users see. Show your company logo plus your local language (optional). ⛳ You are going to want to bookmark this for future reference. 🧵👇

The DEATHCon 2025 Call for Workshops is now open! If you have a great idea for teaching people how to do #detectionengineering or #threathunting or an adjacent skill through hands-on experience in our lab, we'd love to hear it! deathcon.io/cfp.html Submit before June 1

The MVP wall of names is always a nice experience. So many great people on there. #MVPBuzz #MVPsummit

Seattle Sounders versus Houston Dynamo #mvpbuzz @marvinbangert.bsky.social @fabian.bader.cloud @naunheim.cloud

#MVPSummit we are coming @ugurkoc.de Oliver Kieselbach Christoph Burmeister

Ever wondered what DNS, LDAP, Kerberos and TLS connections when you request a certificate in an on-prem environment with Certificate Enrollment Web Services in the mix? I certainly did at some point and found this nice diagram when "migrating" my drawing to draw[.]io

This is huge!!! We can now see the impact a policy would have had historically without ingesting sign in logs to Azure Monitor 🤯 There's a new Preview on CA policies that provides insights on a per-policy basis, and the way they implemented this is so elegant and fast. I love it! :)

Purple Elbe Security Meetup bei uns, der HAFN mit @fabian.bader.cloud und Tobias Fiedler. Mal wieder on-site! 🙂

Export as Bicep is available on the Azure Portal! 💪 🔗 Read more on Export as Bicep here: learn.microsoft.com/en-us/azure/... #azurebicep #mvpbuzz

I'll be speaking live tomorrow at 8pm CET about automating device offboarding in Intune, Entra ID, and Autopilot. We'll also explore the Device Offboarding Manager, its future plans, and upcoming MDE support. Looking forward to seeing you there! 📅 Register here: discord.ms-ems.community

This year, 100% of the proceeds from merch sales will go to support KC7 Foundation to help them bring more free training through games to people who want to learn cyber security skills!

DEATHCon.io is updated with the 11 confirmed locations for in-person events, our dedication to making it affordable with pay-what-you-can pricing, why and how we're valuing diversity and representation, and more! Check it out!