Elizabeth Tyler

Fighting the good Cyber fight and helping to protect our customers. Opinions expressed are my own.

[Elizabeth Tyler @MSetyler]

Your double-take attention please: *5* October revision to Exchange guidance https://t.co/O8C0GXQR6f

[Elizabeth Tyler @MSetyler]

Your attention please: 4 October revision to Exchange guidance https://t.co/O8C0GXQR6f

[Microsoft Exchange @MSFTExchange]

33 DaysToGo - If Basic Auth remains enabled in your tenant, your data is at risk, and so your role is to get your clients and apps off Basic Auth, move them to stronger and better options, and then secure your tenant, before we do.

[Elizabeth Tyler @MSetyler]

NOBELIUM are at it again. Or maybe they never stopped.
https://t.co/1LJKb718du

[Elizabeth Tyler @MSetyler]

The bigger the org is, the slower it can be to respond but some excellent work was done on a US holiday to get this out to our customers #follina
https://t.co/Z6UJ4RrAJl
https://t.co/dIC2NXFMJu

[Elizabeth Tyler @MSetyler]

@SecGuru_OTX @wgoderis @DebugPrivilege Yes, fixed and released 19 May.
CU:
WS 2022: KB5015013
WS, version 20H2: KB5015020
WS 2019: KB5015018
WS 2016: KB5015019
Standalone:
WS 2012 R2: KB5014986
WS 2012: KB5014991
WS 2008 R2 SP1: KB5014987
WS 2008 SP2: KB5014990

[Elizabeth Tyler @MSetyler]

@wgoderis @DebugPrivilege @SecGuru_OTX We're aware (as you can imagine). We know the root cause is the subject name is incorrectly used to map the cert to a machine account in AD rather than the DNSHostname in the subject alternative name on DCs that have installed 5b and we're working it.

[Elizabeth Tyler @MSetyler]

@tia_louden @blowdart Beans on toast! You’re still an Englishwoman

[Elizabeth Tyler @MSetyler]

Spring4Shell has generated lots of questions.
There are detections and hunting to be done in this article. But overall the exploit attempts really are low

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft is currently assessing the impact associated with the Spring Framework for Java vulnerabilities. Sharing our analysis and guidance here: https://t.co/2mA1r82gMl

[Elizabeth Tyler @MSetyler]

Enabled MFA? Yay! But threat actors who get past the first gate can wear down users with MFA requests. Expose it for where it’s from https://t.co/z1LVmwSaVG

[Elizabeth Tyler @MSetyler]

Please read this one, I know folks have wanted to know what’s happening with Microsoft and lapsus$ https://t.co/U8s4OT4JQX

[Elizabeth Tyler @MSetyler]

Just how do you get into a container? How do you troubleshoot apps running in containers? No RDP here. It's more like Server Core only it's not. You'll get the idea.
https://t.co/8UQHELDhKK

[Elizabeth Tyler @MSetyler]

Fun things to do in your spare time! This is legit from someone that doesn't know the meaning of the words "I know enough"

[Elizabeth Tyler @MSetyler]

Actionable info released quarterly https://t.co/vhIsFTCdTc

[Elizabeth Tyler @MSetyler]

January Patch Tuesday regressions are available
https://t.co/aYjH8AJj9E

[Elizabeth Tyler @MSetyler]

User has access. But how long should user keep that access? What if their account is revoked/deleted, pwd changes, their location changes or their risk level increases? Continuous Access Evaluation in AAD is now enabled for all tenants https://t.co/bfTWthREiH

[Microsoft Threat Intelligence @MsftSecIntel]

We have observed a China-based ransomware operator that we’re tracking as DEV-0401 exploiting the CVE-2021-44228 vulnerability in Log4j 2 (aka #log4shell) targeting internet-facing systems running VMWare Horizon. https://t.co/6GOdRwRTjk

[Elizabeth Tyler @MSetyler]

On prem AD needs basic checks done every so often. CE Paul Harrison came up with some great PS scripts to to monitor known problems like any forgotten computers in the Computers container: https://t.co/lTjLigL5EC

[Elizabeth Tyler @MSetyler]

Betty White, Y2K22, it better get better from here. 2010 and 2013 unaffected, 2016 and 2019 you have some work this morning (remember this is On Prem only)

https://t.co/LctAkZGVfC

[Nathan McNulty @NathanMcNulty]

Azure AD Password Protection provides coverage for this as well as character substitution (P@ssw0rd is normalized to password)

It also prevents admins from setting or resetting passwords to known bad/weak passwords

If you have Azure AD P1+, check it out:
https://t.co/gPdwC4SO9Q