cog

[CAPE Sandbox @CapeSandbox]

10 years ago today CAPE Sandbox was released...

Today we are proud to announce its desktop partner-project CAPEsolo: https://t.co/1voRdgbqOb 🎉

All the power of the sandbox in a desktop application 💪

pip install capesolo

[cog @Jason_DFIR]

Fkin goddam AI bullshit... Making me write fkin PYTHON on a GD SATURDAY fkin hate all of this shit

[cog @Jason_DFIR]

Remember to avoid those x_mitre_deprecated = True and revoked = True

[cog @Jason_DFIR]

How many is one more? 🤔

[Maxim Suhanov @errno_fail]

My story of recovering cleared RDP logs from a completely unrelated EVTX file: https://t.co/MUxfObI5c8 #DFIR

[cog @Jason_DFIR]

@domchell Relax - I doubt it's that bad - they probably just got breached nbd

[cog @Jason_DFIR]

1> meet Jason, he works in cyber security
2> oh Kool, my clients don't care about security
Me: lol yea that's how it starts

[cog @Jason_DFIR]

someone has been slacking off

[cog @Jason_DFIR]

Oh you do detection engineering? Name every detection

[cog @Jason_DFIR]

How tf does eBPF work?

[cog @Jason_DFIR]

Tell someone they put the artificial in intelligence and watch them take a second to process the burn

[cog @Jason_DFIR]

@AnthropicAI No you didn't

[Merill Fernando @merill]

👋 How do you find all the global admins in an M365 tenant?

You are going to want to bookmark this 💀

✍️ Answer

If you use the portal it's easy (just go to the Roles blade)

But if you need to use the API (take a deep breath 👇)

1️⃣ Check the license on the tenant

2️⃣ In an Entra ID Free or P1 tenant
→ /roleAssignments

3️⃣ In Entra ID Premium tenants

3️⃣•1️⃣ Get all PIM Eligible global admins
→ /roleEligibilityScheduleInstances

3️⃣•2️⃣ Get all PIM Permanently Active users and use assignmentType = Assigned to filter out 'Eligible' users that are currently activated.
→ /roleAssignmentScheduleInstances

4️⃣ If any of these are groups, then iterate through the group to get all members inside the group

We use this frequently in Maester for finding privileged users.

Full code at https://t.co/zwME9aPAl1

Or you can simply use this in your scripts 👇

🔥 Install-Module Maester -AllowPrerelease

🌟 Get-MtRoleMember -Role GlobalAdministrator

[cog @Jason_DFIR]

The most concise definition of cybersecurity is the following:

Cybersecurity is a thing nerds do with computers.

[Dirk-jan @_dirkjan]

I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: https://t.co/jD6EaGtsn3

[cog @Jason_DFIR]

@1336_0ff_by_0ne @vxunderground My favorite - but they stopped making them 💔

[cog @Jason_DFIR]

No more pain ❤️🕊️

[vx-underground @vxunderground]

Someone actually put it on their fridge 😭😭😭

[cog @Jason_DFIR]

@_Dwyer_ @HackingLZ 👊🔥🏄

[Panos Gkatziroulis 🦄 @ipurple]

A lightweight tool that injects a custom assembly proxy into a target process to silently bypass ETW scanning by redirecting ETW calls to custom proxy https://t.co/sK15dRqCMD