1% better each day| IT Professional| certs: CompTIA trifecta done, AZ-104,900, MS-102 currently working for CCNA|Praise The Fool (LOM) | My views are mine alone
Major cheat code for life: Become difficult to rush. The world will pressure you to rush into everything. Rushed decisions. Rushed conversations. Rushed relationships. Rushed timelines. There's immense power in rejecting that trend. Slow down. Create space to think clearly.
According to the Stoics, you wake up with a set amount of energy every day. The whole game is noticing where it drains
Marcus Aurelius constantly reminded himself to stop pouring his into other people's opinions. Maybe the ones with the most energy aren't making more of it; they just stopped leaking it to the noise
You really should require assignment for Azure CLI, Azure PowerShell, Graph Command Line Tools, etc.
Assign a group so that only members of that group can use them, and if licensed, gate access behind PIM/Access Packages
I even have setup scripts here:
https://t.co/4d2PNP04gQ
JUST IN: 80-year-old woman with advanced Alzheimer’s reportedly briefly regained speech, bladder control, & memory after taking psilocybin mushrooms.
You can remove preinstalled Microsoft Store apps such as Clipchamp, Xbox, Weather, and Feedback Hub. Follow our guide to learn more:
https://t.co/ag8YAaQSle
#MSIntune#Microsoft#Apps#SCDudes
New @rapid7 observed exploitation of PAN-OS GlobalProtect auth bypass vulnerability CVE-2026-0257 which allows authentication bypass cookies to be forged for VPN access. Full details, technical analysis, PoC , IOCs and remediation guidance in the blog: https://t.co/Bye7K5gzKO
Azure Virtual Desktop just removed the last major reason you still need a domain controller.
FSLogix profile containers for cloud-only and external identities are now Generally Available.
Pooled host pools. Persistent profiles. Zero AD DS required. 🧵 #AzureVirtualDesktop
Conditional Access policies won’t stop token theft—and standard MFA won't fix it either.
When teams roll out Microsoft Authenticator push codes or SMS, some assume the cloud perimeter is safe. But sophisticated actors have moved completely past brute-forcing passwords. They use Adversary-in-the-Middle (AiTM) phishing frameworks like Evilginx.
The attack flow is clean: The proxy site mirrors your Entra ID login page. The user enters credentials and solves the genuine MFA challenge.
Once Entra ID validates the session, it issues an ESTSAUTH session cookie. The malicious proxy server snatches that cookie before passing it back to the victim’s browser.
The Result: The attacker drops that stolen cookie into their own machine. Because the session has already passed the MFA verification loop, they gain instant access to the mailbox or cloud apps. They bypass standard Conditional Access rules seamlessly.
, when an identical session jumps between network or device contexts
Advanced features like Continuous Access Evaluation (CAE), Token Protection session controls, or strict device compliance rules can mitigate this. But they are rarely part of an organization’s "default" browser-based setups.
Because a stolen token completely bypasses the sign-in loop, you cannot hunt for it by looking for failed logins. You have to hunt for Session Anomalies—specifically when an identical session jumps network or device context mid-lifecycle.
From Sentinel or Entra ID Advanced Hunting, you can run the below KQL query to identify active token replays across interactive and non-interactive sign-ins:
Stop writing detection rules for "lsass.exe" and processes by name.
Adversaries rename binaries in seconds.
If your SOC relies on simple string matches on filenames to detect credential dumping, you're functionally blind.
Here is the underlying behavior you need to track instead: (1/3)
Windows Hotpatch lets you deploy security updates without rebooting devices every Patch Tuesday. We published a quick guide on how to configure it with Microsoft Intune.
Take a look:
https://t.co/AW8aGfcOWI
#MSIntune#WindowsAutopatch#Hotpatch#Windows