David

1% better each day| IT Professional| certs: CompTIA trifecta done, AZ-104,900, MS-102 currently working for CCNA|Praise The Fool (LOM) | My views are mine alone

[David @Davidc_2667]

A new day is another opportunity to improve yourself😎

[Mysteries @LOTM_WORLD]

Same energy

[lotmsarvin @lotmsarvin93142]

‼️|LOTM SEASON 2 TRAILER

[Sahil Bloom @SahilBloom]

Major cheat code for life: Become difficult to rush. The world will pressure you to rush into everything. Rushed decisions. Rushed conversations. Rushed relationships. Rushed timelines. There's immense power in rejecting that trend. Slow down. Create space to think clearly.

[conduct|r @conductr_]

According to the Stoics, you wake up with a set amount of energy every day. The whole game is noticing where it drains

Marcus Aurelius constantly reminded himself to stop pouring his into other people's opinions. Maybe the ones with the most energy aren't making more of it; they just stopped leaking it to the noise

[Nathan McNulty @NathanMcNulty]

You really should require assignment for Azure CLI, Azure PowerShell, Graph Command Line Tools, etc.

Assign a group so that only members of that group can use them, and if licensed, gate access behind PIM/Access Packages

I even have setup scripts here:
https://t.co/4d2PNP04gQ

[Treyarch @Treyarch]

It's official: the original Black Ops and Black Ops 2 are being ported to PlayStation in July, courtesy of our partners at @IronGalaxy. 🤝

[David @Davidc_2667]

@CoinDesk As if the state wasnt already in bad shape with its current management.

[David @Davidc_2667]

@SasStu @Micke_K_72 Nice!

[David @Davidc_2667]

@NathanMcNulty This is evil asf lmao

[Polymarket @Polymarket]

JUST IN: 80-year-old woman with advanced Alzheimer’s reportedly briefly regained speech, bladder control, & memory after taking psilocybin mushrooms.

[Blockchain Backer @BCBacker]

As is tradition with all past Bitcoin bear market bottom builds, more coins have finally reached into a loss than in a profit.

[SystemCenterDudes @scdudes]

You can remove preinstalled Microsoft Store apps such as Clipchamp, Xbox, Weather, and Feedback Hub. Follow our guide to learn more:
https://t.co/ag8YAaQSle

#MSIntune #Microsoft #Apps #SCDudes

[spencer @techspence]

To all the IT Admins out there. Things are getting wild. Strap in. Keep fighting the good fight. I’m rooting for you. 💪🙏

[Stephen Fewer @stephenfewer]

New @rapid7 observed exploitation of PAN-OS GlobalProtect auth bypass vulnerability CVE-2026-0257 which allows authentication bypass cookies to be forged for VPN access. Full details, technical analysis, PoC , IOCs and remediation guidance in the blog: https://t.co/Bye7K5gzKO

[Kevin Kaminski @kkaminsk]

Azure Virtual Desktop just removed the last major reason you still need a domain controller.

FSLogix profile containers for cloud-only and external identities are now Generally Available.

Pooled host pools. Persistent profiles. Zero AD DS required. 🧵 #AzureVirtualDesktop

[Ridgeline Cyber @RidgelineCyber]

Conditional Access policies won’t stop token theft—and standard MFA won't fix it either.

When teams roll out Microsoft Authenticator push codes or SMS, some assume the cloud perimeter is safe. But sophisticated actors have moved completely past brute-forcing passwords. They use Adversary-in-the-Middle (AiTM) phishing frameworks like Evilginx.

The attack flow is clean: The proxy site mirrors your Entra ID login page. The user enters credentials and solves the genuine MFA challenge.

Once Entra ID validates the session, it issues an ESTSAUTH session cookie. The malicious proxy server snatches that cookie before passing it back to the victim’s browser.

The Result: The attacker drops that stolen cookie into their own machine. Because the session has already passed the MFA verification loop, they gain instant access to the mailbox or cloud apps. They bypass standard Conditional Access rules seamlessly.
, when an identical session jumps between network or device contexts
Advanced features like Continuous Access Evaluation (CAE), Token Protection session controls, or strict device compliance rules can mitigate this. But they are rarely part of an organization’s "default" browser-based setups.

Because a stolen token completely bypasses the sign-in loop, you cannot hunt for it by looking for failed logins. You have to hunt for Session Anomalies—specifically when an identical session jumps network or device context mid-lifecycle.

From Sentinel or Entra ID Advanced Hunting, you can run the below KQL query to identify active token replays across interactive and non-interactive sign-ins:

[Ridgeline Cyber @RidgelineCyber]

Stop writing detection rules for "lsass.exe" and processes by name.

Adversaries rename binaries in seconds.

If your SOC relies on simple string matches on filenames to detect credential dumping, you're functionally blind.

Here is the underlying behavior you need to track instead: (1/3)

[Mysteries @LOTM_WORLD]

🚨OFFICIAL🚨

LORD OF MYSTERIES NEW GAME TRAILER REVEAL

HOLY PEAK THIS LOOKS INSANE

[David @Davidc_2667]

@merill @SeguraOSD Merill! You have been an inspiration when it comes to cloud security and everything IT!

[SystemCenterDudes @scdudes]

Windows Hotpatch lets you deploy security updates without rebooting devices every Patch Tuesday. We published a quick guide on how to configure it with Microsoft Intune.

Take a look:
https://t.co/AW8aGfcOWI

#MSIntune #WindowsAutopatch #Hotpatch #Windows