Paula Januszkiewicz

Security Expert | Penetration Tester | CQURE Owner | @CQUREAcademy

[Paula Januszkiewicz @PaulaCqure]

Our 15 Days of Practical Security Skills series continues with Skill #3/15: Microsoft Entra ID Security: Protecting Hybrid Identity Infrastructure 🛡️

Protecting hybrid identity starts with understanding how on-premises Active Directory and Microsoft Entra ID connect, how privileges are assigned, and where those connections create opportunities for attackers.

Developing this skill will help you:
➡️ Protect privileged accounts and reduce unnecessary access.
➡️ Identify and close attack paths across on-premises and cloud environments.
➡️ Test Conditional Access policies for gaps and unintended exclusions.
➡️ Monitor suspicious sign-ins and changes to roles and permissions.

See one of these gaps in practice in CQURE Hack #82, where me & Team explore a Microsoft Entra ID Conditional Access bypass via a User-Agent policy gap. The demo shows how a specific policy configuration can leave access open even when the admin portal is blocked.

Read the hack ➡️ https://t.co/XJ8Ez8xryb

Want to learn more skills that you'll need in 2027? Explore AMSC 2027:
🔗 https://t.co/sUZp22KzZV

#CyberOctober #CQUREHacks #ArtificialIntelligence #IdentitySecurity #EntraID #CloudSecurity #CyberSecurity #MicrosoftSecurity #AMSC #CQUREAcademy

@CQUREAcademy @Azure @MSCloud @Microsoft @MsftSecIntel @MicrosoftLearn @samilaiho @Amr_Thabet

[Paula Januszkiewicz @PaulaCqure]

The rules of cyber defense are changing. Are we ready for what comes next?

Tomorrow, I’ll be joining Craig Birch, Principal Technologist at @Cayosoft, for a live discussion on The Next Era of Cyber Defense.

We’ll talk about identity-based attack paths, hidden trust relationships, and the challenges security teams face when trying to maintain visibility and control across their environments.

October 20, 1 PM ET

Save your spot and join us live: https://t.co/jhJcto0WXM

#Cybersecurity #CyberDefense #Cayosoft @Microsoft @msftsecurity @CQUREAcademy

[Paula Januszkiewicz @PaulaCqure]

Your enterprise is only as secure as its weakest workstation. Build it secure. Configure it right. Defend it better 🔐

Want a preview of our flagship AMSC course? 😉 Join @samilaiho, Artur Kalinowski, and me for a free live session 𝐎𝐜𝐭𝐨𝐛𝐞𝐫 𝟐𝟏: 𝐒𝐞𝐜𝐮𝐫𝐞 𝐔𝐬𝐞𝐫𝐬: 𝐃𝐞𝐬𝐢𝐠𝐧𝐢𝐧𝐠 𝐖𝐨𝐫𝐤𝐬𝐭𝐚𝐭𝐢𝐨𝐧𝐬 𝐟𝐨𝐫 𝐓𝐡𝐫𝐞𝐚𝐭 𝐑𝐞𝐬𝐢𝐬𝐭𝐚𝐧𝐜𝐞

🦝 Privileged Access Workstation (PAWs) design and deployment
🦝 Secure passkey implementation across enterprise environments
🦝 Catching identity misconfigurations and validating alert triggers

You leave with a concrete, actionable checklist covering PAW architecture, passkey setup, workstation hardening and monitoring validation using native controls you already own.

🎟️ Register for free: https://t.co/gQiNQe1Brr

#Cybersecurity #PAW #IdentitySecurity #WindowsSecurity #Passkeys #CQUREAcademy

@CQUREAcademy @Microsoft @MSCloud @Azure @MsftSecIntel @MicrosoftLearn @msftsecurity

[Paula Januszkiewicz @PaulaCqure]

Relying on generic tools while leaving identity boundaries unmonitored is one of the biggest false comforts in modern security. When a real incident hits your infrastructure, your team will fall directly to the level of their hands-on lab practice.

𝐓𝐡𝐢𝐬 𝐌𝐨𝐧𝐝𝐚𝐲, 𝐎𝐜𝐭𝐨𝐛𝐞𝐫 𝟏𝟗𝐭𝐡, we are kicking off two of our most intensive programs at @CQUREAcademy. This is your final call to join us live before registration closes.

𝐇𝐞𝐫𝐞 𝐢𝐬 𝐰𝐡𝐚𝐭 𝐢𝐬 𝐬𝐭𝐚𝐫𝐭𝐢𝐧𝐠 𝐭𝐡𝐢𝐬 𝐌𝐨𝐧𝐝𝐚𝐲:

🍁 𝐀𝐮𝐭𝐮𝐦𝐧 𝐈𝐧𝐟𝐫𝐚𝐬𝐭𝐫𝐮𝐜𝐭𝐮𝐫𝐞 𝐏𝐞𝐧𝐭𝐞𝐬𝐭𝐢𝐧𝐠 𝐁𝐨𝐨𝐭𝐜𝐚𝐦𝐩 (𝐎𝐜𝐭 𝟏𝟗–𝟐𝟑): five days of intense, practical work led by Artur Kalinowski, @Amr_Thabet, Damian Kędzierski, and myself. You will master Active Directory and Entra ID exploitation, Identity Attacks, how exploit key enterprise services and maintain persistence within compromised networks.

Don't miss the discount: https://t.co/0AljOE8rim

🦝 𝐌𝐚𝐬𝐭𝐞𝐫𝐜𝐥𝐚𝐬𝐬: 𝐒𝐲𝐬𝐭𝐞𝐦 𝐅𝐨𝐫𝐞𝐧𝐬𝐢𝐜𝐬, 𝐈𝐧𝐜𝐢𝐝𝐞𝐧𝐭 𝐇𝐚𝐧𝐝𝐥𝐢𝐧𝐠 𝐚𝐧𝐝 𝐓𝐡𝐫𝐞𝐚𝐭 𝐇𝐮𝐧𝐭𝐢𝐧𝐠 (𝐎𝐜𝐭 𝟏𝟗–𝟐𝟑): five days focused on reconstructing attack timelines, investigating anomalies, and extracting critical evidence to catch adversaries before they cause irreversible damage.

Check the special price: https://t.co/CvOhFROKuh

Your engineers gain in house threat hunting, investigation and incident response capabilities, reducing reliance on costly outside consultants.

To keep direct interaction with our instructors at the highest level, seats in our dedicated cloud labs are strictly limited!

#cybersecurity #ActiveDirectory #EntraID #CQURE #CQUREAcademy #PaulaJanuszkiewicz

@Microsoft @msftsecurity @Azure @MSCloud

[Paula Januszkiewicz @PaulaCqure]

Were continuing our 𝟏𝟓 𝐃𝐚𝐲𝐬 𝐨𝐟 𝐏𝐫𝐚𝐜𝐭𝐢𝐜𝐚𝐥 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐒𝐤𝐢𝐥𝐥𝐬 series, highlighting the techniques and knowledge every cybersecurity professional should have in their toolkit 🛡️

🦝 𝐒𝐤𝐢𝐥𝐥 #𝟐/𝟏𝟓: 𝐀𝐜𝐭𝐢𝐯𝐞 𝐃𝐢𝐫𝐞𝐜𝐭𝐨𝐫𝐲 𝐔𝐧𝐝𝐞𝐫 𝐀𝐭𝐭𝐚𝐜𝐤: 𝐏𝐫𝐞𝐯𝐞𝐧𝐭𝐢𝐧𝐠 𝐃𝐨𝐦𝐚𝐢𝐧 𝐂𝐨𝐦𝐩𝐫𝐨𝐦𝐢𝐬𝐞
One of the most important skills for defenders is understanding how attackers exploit #ActiveDirectory. Developing this skill will help you understand modern tiering, privileged access controls, and security hardening techniques that reduce the risk of domain compromise.

𝐂𝐡𝐞𝐜𝐤 𝐨𝐮𝐭 𝐂𝐐𝐔𝐑𝐄 𝐇𝐚𝐜𝐤 #𝟖𝟑, where I explore an AD CS ESC16 misconfiguration and demonstrate how certificate abuse can lead to privilege escalation and ultimately contribute to domain compromise. Understanding these attack paths is essential for securing modern Active Directory environments. Check out the hack ➡️
https://t.co/gFlxcuS1uk

𝐄𝐱𝐩𝐥𝐨𝐫𝐞 𝐀𝐌𝐒𝐂 𝐜𝐨𝐮𝐫𝐬𝐞 𝟐𝟎𝟐𝟕:
🔗 https://t.co/sUZp22KzZV

[Paula Januszkiewicz @PaulaCqure]

Next week, we're back with another live cybersecurity webinar!

On October 21, I'll be hosting Secure Users: Designing Workstations for Threat Resistance together with @samilaiho and Artur Kalinowski.

We'll talk about what it takes to build workstations that can better withstand attacks, from securing administrative access and implementing passkeys to workstation hardening and security monitoring.

We'll also look at common configuration mistakes, how to identify potential security gaps, and how to check whether your monitoring actually works when you need it. You'll leave with a practical checklist to help you assess your own environment and identify areas for improvement.

Register here: https://t.co/kpnvr6k3VX

#Cybersecurity #WindowsSecurity #WorkstationSecurity #Passkeys #PrivilegedAccess

[Paula Januszkiewicz @PaulaCqure]

This October, were launching a series focused on 15 practical cybersecurity skills every security professional should develop, featuring @CQUREAcademy Hacks, techniques, and real-world insights into how attackers operate and defenders respond 🛡️

🦝 𝐒𝐤𝐢𝐥𝐥 #𝟏/𝟏𝟓: 𝐈𝐧-𝐃𝐞𝐩𝐭𝐡 𝐈𝐧𝐯𝐞𝐬𝐭𝐢𝐠𝐚𝐭𝐢𝐨𝐧 𝐚𝐧𝐝 𝐈𝐧𝐜𝐢𝐝𝐞𝐧𝐭 𝐑𝐞𝐬𝐩𝐨𝐧𝐬𝐞:
From Evidence to ActionOne of the most valuable cybersecurity skills is the ability to turn scattered evidence into a clear picture of what actually happened. Developing this skill will help you build the ability to analyze evidence, reconstruct what happened, and turn findings into action.

𝐂𝐡𝐞𝐜𝐤 𝐨𝐮𝐭 𝐂𝐐𝐔𝐑𝐄 𝐇𝐚𝐜𝐤 #𝟖𝟒, where we explore Event ID 4624 and demonstrate how proper log analysis helps investigators reconstruct attacker activity, validate findings, and build an accurate picture of what really happened during an incident ➡️ https://t.co/gor5uiTEH3

𝐖𝐚𝐧𝐭 𝐭𝐨 𝐥𝐞𝐚𝐫𝐧 𝐦𝐨𝐫𝐞 𝐬𝐤𝐢𝐥𝐥𝐬 𝐲𝐨𝐮𝐥𝐥 𝐧𝐞𝐞𝐝 𝐢𝐧 𝟐𝟎𝟐𝟕?
𝐄𝐱𝐩𝐥𝐨𝐫𝐞 #𝐀𝐌𝐒𝐂 𝟐𝟎𝟐𝟕 🔗 https://t.co/gzEIxxNDXh

@Microsoft @MSCloud @Azure @MsftSecIntel @MicrosoftLearn

[Paula Januszkiewicz @PaulaCqure]

🚨 LAST CALL 🚨

We’re starting next week!

From October 19-23, I’ll be joining Artur Kalinowski, @Amr_Thabet, and Damian Kędzierski for the Autumn Infrastructure Pentesting Bootcamp.

We have five days to work through reconnaissance, identity attacks, Active Directory and Entra ID exploitation, Windows services, and post-exploitation. And, of course, plenty of time in the labs.

The idea is simple: understand how these techniques work, learn to recognize weaknesses and see how different parts of an enterprise environment connect.

And if five days aren’t enough, you’ll have another three weeks of lab access after the bootcamp to keep practising.

We kick off on October 19. If you’re planning to join us, this is your last call.

Details and registration: https://t.co/SCLgvu56nW

[Paula Januszkiewicz @PaulaCqure]

The USN Journal is incredibly useful in forensics, but it can also be painfully noisy.

That is exactly why tools that help you see the pattern instead of just the records matter.

In our latest CQURE Hacks video, we demonstrate CQUSNDeepAnalyzer on an actual journal dump.
The best part is the visualization. You get an interactive timeline, heatmaps, Sankey flows, path treemaps, searchable records, and CSV export.

This is the kind of workflow that can save a huge amount of time during incident response.

Full demo on the CQURE blog:
https://t.co/P3huqhyLfL

Want to learn more from me and other top #CybersecurityExperts? Join AMSC, our flagship course: 👉 https://t.co/sUZp22KzZV

Want a sneak peek at our AMSC course? Join our LIVE webinar on October 21, where you'll meet three of our AMSC trainers, gain valuable cybersecurity insights, and learn something new - all completely free! 👉 Save your spot today: https://t.co/kpnvr6k3VX

#Cybersecurity #DFIR #DigitalForensics #IncidentResponse #ThreatHunting #CQURE @CQUREAcademy

[Paula Januszkiewicz @PaulaCqure]

Thank you to everyone who joined me for Uncovering New Identity Theft Vectors and How to Mitigate Them! ❤️

It was lovely to share this session with you, and I hope you took something useful away from it.

If you couldn't make it live, don't worry! Here's a short demo from the session, and the full recording is still available.

Watch the webinar here: https://t.co/p8Vbopm4pb

And if you'd like to keep building your Microsoft security skills, take a look at our Advanced Microsoft Security Course for 2027.

Find out more: https://t.co/sUZp22KzZV

#Cybersecurity #IdentitySecurity #IdentityTheft #MicrosoftSecurity @CQUREAcademy

[Paula Januszkiewicz @PaulaCqure]

@NICconf starts tomorrow!

Tomorrow, October 14, I’ll be in Norway for two technical sessions focused on Windows security, identity and forensics.

1. Breaking Identity at Scale: From DPAPI & TBAL Secrets to Full Domain Compromise
2. Windows Knows What You Did: Deep Dive into Automatic Destinations

Looking forward to both sessions and catching up with everyone in Oslo. See you there!

If you’re joining NIC26, get your ticket here: https://t.co/CJHYm88H3T

And if you’d like to take your Microsoft security knowledge further, check out our Advanced Microsoft Security Course for 2027.

Ready to level up your skills? Learn more and join us:
https://t.co/sUZp22KzZV

#NIC26 #Cybersecurity #WindowsSecurity @CQUREAcademy

[Paula Januszkiewicz @PaulaCqure]

Thank you to everyone who joined us live on 8th of October for our deeply technical session on new identity theft vectors! The engagement and questions in the chat were phenomenal! ❤️‍🔥

During the session, we live-demonstrated Pass-The-TBAL, an original attack path researched by the @CQUREAcademy Team showing how an adversary can pivot from local endpoint access straight to a full cloud identity takeover. We exposed how attackers extract credentials like #SHA1 of Entra ID account from the juicy local cache, access local vaults like #KeePass, and completely evade traditional #EDR/XDR visibility.

𝐈𝐟 𝐲𝐨𝐮 𝐦𝐢𝐬𝐬𝐞𝐝 𝐭𝐡𝐞 𝐥𝐢𝐯𝐞 𝐬𝐭𝐫𝐞𝐚𝐦, 𝐝𝐨𝐧𝐭 𝐰𝐨𝐫𝐫𝐲 - 𝐰𝐞’𝐯𝐞 𝐠𝐨𝐭 𝐲𝐨𝐮 𝐜𝐨𝐯𝐞𝐫𝐞𝐝. 𝐖𝐞 𝐚𝐫𝐞 𝐜𝐮𝐫𝐫𝐞𝐧𝐭𝐥𝐲 𝐩𝐫𝐞𝐩𝐚𝐫𝐢𝐧𝐠 𝐭𝐡𝐞 𝐬𝐞𝐬𝐬𝐢𝐨𝐧 𝐫𝐞𝐜𝐨𝐫𝐝𝐢𝐧𝐠 𝐚𝐥𝐨𝐧𝐠𝐬𝐢𝐝𝐞 𝐨𝐮𝐫 𝐭𝐞𝐜𝐡𝐧𝐢𝐜𝐚𝐥 𝐫𝐞𝐬𝐨𝐮𝐫𝐜𝐞𝐬, 𝐚𝐧𝐝 𝐰𝐞’𝐥𝐥 𝐛𝐞 𝐬𝐞𝐧𝐝𝐢𝐧𝐠 𝐭𝐡𝐞 𝐝𝐢𝐫𝐞𝐜𝐭 𝐚𝐜𝐜𝐞𝐬𝐬 𝐥𝐢𝐧𝐤 𝐯𝐢𝐚 𝐞𝐦𝐚𝐢𝐥 📹

𝐖𝐡𝐚𝐭 𝐲𝐨𝐮’𝐥𝐥 𝐠𝐞𝐭 𝐢𝐧 𝐭𝐡𝐞 𝐫𝐞𝐜𝐨𝐫𝐝𝐢𝐧𝐠:
You’ll learn the exact mechanics behind the Pass-The-TBAL attack path and walk away with a concrete change list. Your team gets actionable hardening steps and mitigation controls you can deploy on your existing infrastructure immediately.

Didnt register before the webinar? Fill out the form here to get the full recording and materials delivered to your inbox: https://t.co/p8Vbopm4pb

#Cybersecurity #IdentitySecurity #ActiveDirectory #CQURE
@MSCloud @Azure @Microsoft @MsftSecIntel @msdev

[Paula Januszkiewicz @PaulaCqure]

Want to level up your cybersecurity skills? Here's an extra reason to do it this October.

October is Cybersecurity Awareness Month!
Subscribe to the CQURE newsletter and get up to 10% off CQURE Academy courses.

It's a great way to stay informed about upcoming trainings, new learning opportunities, and the latest cybersecurity insights, while saving on your next course.

📩 Sign up here and get your discount: https://t.co/AmpLgsWQZ2
The offer excludes AMSC, which already has a separate October promotion. If you're already subscribed to our newsletter, keep an eye on your inbox for a special email with an exclusive discount code just for you!

#CybersecurityAwarenessMonth #CybersecurityMonth #Cybersecurity #CQUREAcademy @CQUREAcademy

[Paula Januszkiewicz @PaulaCqure]

What happens when the device protecting your network becomes the way attackers get in?

Two critical @citrix NetScaler vulnerabilities are being actively exploited, both with a CVSS score of 9.5.

CVE-2026-88771 and CVE-2026-88772 affect NetScaler ADC and Gateway and can lead to remote code execution. @CISAgov has added both vulnerabilities to its Known Exploited Vulnerabilities catalog.

But there is another important part of this story.

If a NetScaler appliance may already be compromised, patching or rebooting it immediately can destroy valuable forensic evidence. Before closing the vulnerability, you need to understand whether someone has already made their way in.

If you use NetScaler, this is worth looking at now.

I’ve covered the vulnerabilities, affected versions and what defenders should do next in the full article.

Read the full article: https://t.co/rvqWgATID2

[Paula Januszkiewicz @PaulaCqure]

@vntxsyeko @cryptonewt333 Oh yes, exactly 🙌

[Paula Januszkiewicz @PaulaCqure]

Microsoft Entra ID can look completely locked down and still let you in through an Xbox.

We started with a standard low-privileged account. MFA on. Entra portal blocked. Conditional Access apparently doing its job.
But CA trusts the device platform based on the User-Agent, something the client fully controls. Windows, Linux, iPhone: all blocked. Xbox Series X: access token for Microsoft Graph, no MFA prompt.
From there it's Graph directly, users, groups, roles, and a clear-text password sitting in a group description. It belonged to a break-glass account with Global Administrator.

One policy gap. One badly stored secret. Full cloud compromise.

Want to see how we pulled this off? Read the full breakdown on our blog.
https://t.co/XJ8Ez8xryb

[Paula Januszkiewicz @PaulaCqure]

@bpauwels @cryptonewt333 This 🙌

[Paula Januszkiewicz @PaulaCqure]

@paulchen507 Thanks for sharing! 🦝 🦝🦝🦝🦝

[Paula Januszkiewicz @PaulaCqure]

@NathanMcNulty Thanks for sharing! 🦝