Danny Cooke

I work with computery things. All opinions are strictly my own

[Matt Zorich @reprise_99]

For those that missed it the Active Directory tier model documentation recently had a huge uplift, and even more importantly, the scripts used to configure your AD in line with this tiered model (tier 0-1-2) have been fully open sourced for your use.

The updated repo also contains scripts to audit drift from the baselines, and a detailed FAQ to help you deploy the model.

https://t.co/GekeweZioe

[Danny Cooke @CookeDanny]

@PyroTek3 The "old days" of ESAE and domain joined PAWs has changed towards "protect cloud". Deploying PAWs and being able to manage cloud and on-prem from the same box isn't necessarily straightforward

[Danny Cooke @CookeDanny]

@PyroTek3 Would be interesting to see an extension of that blog that talks about PAWs.......Tier 0 only, physical or in AVD/W365, hardening steps and all of that jazz. I feel there is lots said around "use a PAW" but very little docs or guidance on the "how".

[🕳 @sekurlsa_pw]

Windows Security Events reference
https://t.co/4nTspWRL0S

[Danny Cooke @CookeDanny]

@ZackKorman Take a look at these guys. Not free but looks like an interesting platform ... https://t.co/m8yjawFY2m

[MSEndpointMgr @MSEndpointMgr]

Blog post: Implementing Privileged Access Workstations (PAWs) – Benefits, Challenges, and #Security Considerations https://t.co/D52x3xnSD6 #PAW #Client

[Danny Cooke @CookeDanny]

@NathanMcNulty Haha, yeah.... All comes back to the "don't just blindly apply...." I guess👍

[Danny Cooke @CookeDanny]

@NathanMcNulty Another L2

Assume lots of orgs adopting L2 will have heavy reliance on on-premise environments and no fancy cloud nonsense ;)

[Danny Cooke @CookeDanny]

@offbeat @NathanMcNulty The L2 are mainly concerned with additional hardening and minimizing "data leakage" IIRC......I've only ever applied L1

[Danny Cooke @CookeDanny]

@NathanMcNulty More secure, yes. Practical if you like your users to be productive, maybe not so much 🙂. That said, I'm sure in highly regulated environments, there is a place for L2

[Danny Cooke @CookeDanny]

@NathanMcNulty I didn't say it made sense ;)

[JS0N Haddix @Jhaddix]

Introducing MSFTrecon -

MSFTRecon is a reconnaissance tool designed for red teamers and security professionals to map Microsoft 365 and Azure tenant infrastructure. It performs enumeration without requiring authentication, helping identify potential security misconfigurations and attack vectors.

https://t.co/LYXjnOGIoF

[Martin Bengtsson @mwbengtsson]

🚀 New Blog Post Alert! 🚀

Automate Sysmon installation and configuration with PowerShell!

🔹 Step-by-step guide
🔹 Custom Sysmon config
🔹 Install
🔹 Uninstall

https://t.co/eOnYC9frss

#Sysmon #PowerShell #Automation #CyberSecurity

[Virus Bulletin @virusbtn]

Sophos researcher Andrew Brandt writes about Scalable Vector Graphics (SVG) files used in phishing & malware. The attacks, which begin with email messages that have .svg attachments, started in late 2024 and have ramped up significantly since mid-January. https://t.co/WXMGdkxcd5

[🛡️ CHARBEL NEMNOM🇨🇭| MVP | MCT | CCSP | CISM @CHARBELNEMNOM]

Another Learning Opportunity! Monitor Microsoft Entra ID Emergency Accounts with Microsoft Sentinel https://t.co/WDo0Jsiqkk #Microsoft #Azure #Blog > Please RP if you like it!

[Danny Cooke @CookeDanny]

@MENnewsdesk Why bother posting links when your ad-riddled abomination of a website makes it impossible to actually read the article you've linked?

[ARCHIVED: Jen Easterly @CISAJen]

A year ago, @CISAgov launched Logging Made Easy (LME) to help small/medium orgs, gov’ts, and critical infrastructure detect cyber threats. Introducing LME 2.0—featuring advanced threat detection. #LoggingMadeEasy https://t.co/mMzVQFXDBi

[Merill Fernando @merill]

@SwiftOnSecurity If there is one software that I wish existed in macOS, it would be Notepad++