Dec 1Have you heard about passkeys and AAGuids?With the availability of passkeys the FIDO2 standards become more accessible in the form of password managers, web-browsers and (mobile) operating systems — without the need for dedicated hardware such as FIDO2 keys. Microsoft is currently in the process of developing support for passkeys and shipping the public preview in…Identity6 min readIdentity6 min read
Nov 17Enriching Microsoft Sentinel tables with eligible Entra directory rolesMicrosoft 365 Defender and Sentinel provide an IdentityInfo table that contains various information that is helpful for threat hunting and detections. One key piece are also the assigned Entra directory roles for a specific identity. …Microsoft Sentinel6 min readMicrosoft Sentinel6 min read
Nov 13Maintaining Microsoft Sentinel Analytic Rules in JSON and YAML with GitHub ActionsMicrosoft Sentinel Analytic Rules can be shared in both the YAML and ARM format, whereas the ARM format leverages JSON as file type. …Microsoft Sentinel4 min readMicrosoft Sentinel4 min read
Nov 8Have you heard of workload identity access token replay?Microsoft recently made the Microsoft Graph Activity Logs available as part of the Microsoft Entra ID diagnostic settings. This means we can use the MicrosoftGraphActivityLogs Table to enrich custom detections and analytic rules. Within this post I want to elaborate closer on an attack scenario for workload identities that leverage…Itdr6 min readItdr6 min read
Sep 24Entra Connect Account HardeningMicrosoft Entra Connect Sync (aka Azure AD Connect) allows establishing hybrid identity scenarios by interconnecting on-premises Active Directory and Entra ID (aka Azure AD) and leveraging synchronisation features in both directions. …Microsoft Entra Id6 min readMicrosoft Entra Id6 min read
Sep 7Why you should use Entra Workload Identity FederationMicrosoft Entra Workload Identity Federation is a hidden gem when dealing with app registrations and service principals because it will significantly improve the security posture of your workload identities. While I already blogged about the more technical and implementation specific details in my GitHub Actions with Entra Workload Identity Federation…Entra Id5 min readEntra Id5 min read
May 10Retrieving Windows LAPS Azure AD Passwords with PowerShellDid you know that for the new Windows LAPS Azure AD is also maintaining the password history? The built in PowerShell commandlet relies on the Microsoft Graph PowerShell SDK and within this post I want to show you how to work with the Get-LapsAADPassword cmdlet. Kudos to Niklas Tinner as…Windows3 min readWindows3 min read
Apr 11Provoking Defender for Identity suspicious certificate usage alertsMicrosoft Defender for Identity (MDI) has announced a new capability back in February to detect suspicious certificate usage for Kerberos authentication. It is already well-known, that Active Directory Certificate Services (ADCS) is a lucrative target for adversaries to achieve persistence in Active Directory as ADCS can be easily misconfigured resulting…Defender For Identity8 min readDefender For Identity8 min read
Mar 12You must not touch my endpoint security settings!Intune Endpoint Security Configuration Settings have become the way to go for configuring security features on various platforms. What did start with Microsoft Defender for Endpoint settings for Windows clients has evolved to settings for macOS, Windows Servers and is treated like a first class citizen. So it is important…Sentinel4 min readSentinel4 min read
Feb 22Optimising Microsoft Graph PowerShell scriptsWe all have probably been there and developed a PowerShell script that took some fair amount of time until the execution completed, weren’t we? Of course one could argue and say that as long a script ‘works’ it is good enough but depending on the use case and environment a…Microsoft Graph9 min readMicrosoft Graph9 min read
