Q.B 🛡️

Security Engineer | Blue Teamer

[Q.B 🛡️ @QuentinBrusa]

Hi Security community ! I would like to share with you my project https://t.co/yyQ4nJYroC ! This repository provide a json and CSV file for all #Windows #Security Event IDs with lot of useful informations (Categories, GPO, Recommandations, Baseline, tags, etc.).

[Insomni'hack @1ns0mn1h4ck]

🚀 The countdown is on! Insomni'hack is approaching fast

⏳ Less than a month and a half left to submit your talk, don’t miss your chance to contribute to this great event.

👉 Apply now: https://t.co/k3d55j2MnJ

#CyberSecurity #CFP #InfoSec

[Dave McCollough @davemccollough]

Microsoft’s Agent Governance Toolkit is worth checking out.

Don’t put your trust the prompt to enforce policy, put controls around the actions: tool calls, identity, approvals, and audit logs.
https://t.co/L4Izz4QQZu

[Insomni'hack @1ns0mn1h4ck]

🎙️ Don't forget, our Call for Talks is still open until August 23rd. This is your chance to share your cybersecurity expertise.

📅 The conference will take place on February 4th and 5th.

👉 Submit your proposal now: https://t.co/UWazilJ8gN

#CyberSecurity #CFP

[Fabian Bader @fabian_bader]

Entra Connect v2.6.79.0 was just released and contains undisclosed security fixes and @Microsoft recommends to update fast. On the bright side, it will finally support FIDO2 based authentication!

[Nathan McNulty @NathanMcNulty]

Did you know SSPR for admins is always enabled even if you have SSPR set to None?

It also doesn't honor your authentication methods - all of these are enabled

And currently email and phone are consumed from directory attributes..

This is an unnecessary risk - disable it

[Kevin Kaminski @kkaminsk]

Microsoft Entra ID just flipped a switch: passwordless is now the default sign-in experience for millions of users. Here's what changed and why IT leaders need to pay attention. 🧵 #MicrosoftEntra

[Merill Fernando @merill]

Entra Hardening Tip #9 🔐

Don’t use client secrets for app authentication.

Use this decision tree when a developer or vendor asks for an app registration to be created in your tenant. 👇
1/14

[Ridgeline Cyber @RidgelineCyber]

Conditional Access policies won’t stop token theft—and standard MFA won't fix it either.

When teams roll out Microsoft Authenticator push codes or SMS, some assume the cloud perimeter is safe. But sophisticated actors have moved completely past brute-forcing passwords. They use Adversary-in-the-Middle (AiTM) phishing frameworks like Evilginx.

The attack flow is clean: The proxy site mirrors your Entra ID login page. The user enters credentials and solves the genuine MFA challenge.

Once Entra ID validates the session, it issues an ESTSAUTH session cookie. The malicious proxy server snatches that cookie before passing it back to the victim’s browser.

The Result: The attacker drops that stolen cookie into their own machine. Because the session has already passed the MFA verification loop, they gain instant access to the mailbox or cloud apps. They bypass standard Conditional Access rules seamlessly.
, when an identical session jumps between network or device contexts
Advanced features like Continuous Access Evaluation (CAE), Token Protection session controls, or strict device compliance rules can mitigate this. But they are rarely part of an organization’s "default" browser-based setups.

Because a stolen token completely bypasses the sign-in loop, you cannot hunt for it by looking for failed logins. You have to hunt for Session Anomalies—specifically when an identical session jumps network or device context mid-lifecycle.

From Sentinel or Entra ID Advanced Hunting, you can run the below KQL query to identify active token replays across interactive and non-interactive sign-ins:

[Horizon Secured @horizon_secured]

When was the 𝗹𝗮𝘀𝘁 𝘁𝗶𝗺𝗲 𝘆𝗼𝘂 𝗰𝗵𝗲𝗰𝗸𝗲𝗱 𝘆𝗼𝘂𝗿 𝗔𝗰𝘁𝗶𝘃𝗲 𝗗𝗶𝗿𝗲𝗰𝘁𝗼𝗿𝘆 for threats and misconfigurations?

➡️ You should do it regularly - because most of the “dangerous stuff” isn’t created by attackers. It’s 𝗰𝗿𝗲𝗮𝘁𝗲𝗱 𝗼𝘃𝗲𝗿 𝘁𝗶𝗺𝗲 𝗯𝘆 𝗮𝗱𝗺𝗶𝗻𝘀, tools, legacy projects, and forgotten delegations.

❓But what if you don’t want to blindly trust a 𝟯𝗿𝗱-𝗽𝗮𝗿𝘁𝘆 𝘁𝗼𝗼𝗹?

𝗧𝗵𝗮𝘁’𝘀 𝘄𝗵𝘆 𝗜 𝗯𝘂𝗶𝗹𝘁 𝗔𝗗𝗣𝗿𝗼𝗯𝗲.

And yes - this still fits the “no 3rd party trust” idea, because 𝗔𝗗𝗣𝗿𝗼𝗯𝗲 𝗶𝘀 𝗷𝘂𝘀𝘁 𝗮 𝗣𝗼𝘄𝗲𝗿𝗦𝗵𝗲𝗹𝗹 𝘀𝗰𝗿𝗶𝗽𝘁. If you don’t want to run it as a tool, you can simply copy out the exact AD queries for each check and run them directly in your environment.

✅ 𝗖𝘂𝗿𝗿𝗲𝗻𝘁 𝘀𝘁𝗮𝘁𝗲: 51 security checks for Active Directory
(If you run it fully, you also get a clear HTML report with explanations.)

🆕 𝗡𝗲𝘄 𝗽𝗿𝗮𝗰𝘁𝗶𝗰𝗮𝗹 𝘂𝘀𝗲-𝗰𝗮𝘀𝗲: turn it into continuous monitoring
Pick the checks you care about, run them daily (e.g., 9:00 AM), compare results with yesterday, and alert on changes. 𝗦𝗶𝗺𝗽𝗹𝗲 - 𝗮𝗻𝗱 𝘀𝘂𝗿𝗽𝗿𝗶𝘀𝗶𝗻𝗴𝗹𝘆 𝗲𝗳𝗳𝗲𝗰𝘁𝗶𝘃𝗲.

It won’t replace enterprise detection platforms, but it’s free, fast, and easy to start.

If you want the 𝘀𝘁𝗲𝗽-𝗯𝘆-𝘀𝘁𝗲𝗽 way to build this “daily AD detection” approach, I created a short course for it. It’s currently 𝗰𝗹𝗼𝘀𝗲𝗱 𝘁𝗼 𝘁𝗵𝗲 𝗽𝘂𝗯𝗹𝗶𝗰 - but if you’re interested, 𝗰𝗼𝗺𝗺𝗲𝗻𝘁 𝗼𝗿 𝗗𝗠 me and I’ll send details.

#ActiveDirectory #WindowsSecurity #ADSecurity #BlueTeam #CyberSecurity #HorizonSecured #PowerShell

[Dashrath Mundkar @dashmundkar]

Your new Azure VM can't reach the internet.

That's not a bug → it's the new default.

After March 31, 2026, every new VNet ships private by default.
No NAT Gateway = no apt update, no Windows Update. Nothing. 👇

Why Microsoft killed default outbound:
❌ IP owned by Microsoft — could change anytime
❌ No ICMP, no fragmented packets
❌ Inconsistent across NICs & VMSS
❌ Zero Trust violation by design

Your 4 fixes (in order):

✅ NAT Gateway ← do this
Standard LB + outbound rules
Instance-level public IP
Firewall/NVA + UDR
Why NAT Gateway wins:
→ 64,000 SNAT ports per IP (vs ~64)
→ Scales to 1M+ ports
→ You own the egress IP
→ Attach once per subnet. Done.

The migration (don't skip step 4):

Find affected NICs → Advisor → Operational Excellence
Attach NAT Gateway to the subnet
Set defaultOutboundAccess = false
Stop + deallocate the VMs ← everyone forgets
Start. Verify egress IP.
Gotchas:
⚠️ Old Terraform AzureRM → still permissive
⚠️ LB backend pool by IP → leaks default outbound
⚠️ Windows Activation/Update → silently fails

The lesson:
Implicit defaults feel free. They're never free.
You pay at 3 AM when an IP rotates or SNAT ports dry up.

Explicit > implicit. Always.

[Cyber Security News @The_Cyber_News]

⚠️ Azure AD Conditional Access Bypassed Via Phantom Device Registration and PRT Abuse

Source: https://t.co/ewHl9UnrRn

Cloud identity security relies heavily on Microsoft Entra ID (formerly Azure AD) Conditional Access. It acts as the primary digital gatekeeper, checking user locations, calculating risk scores, and verifying device health before granting access.

Starting with a single set of valid credentials, often purchased for just a few hundred dollars on cybercriminal markets, researchers successfully compromised a production tenant containing over 16,000 users.

This attack required no interaction with corporate endpoints. It deployed no malware, highlighting severe gaps in default device registration and compliance validation.

#cybersecuritynews #Azure

[Mehmet Ergene @Cyb3rMonk]

Historical moment for red and blue teamers 🛡️
Azure Active Directory Graph Activity logs are now available🥳

[Horizon Secured @horizon_secured]

🔒 Secure Bits 💡
𝗕𝗿𝗲𝗮𝗸-𝗴𝗹𝗮𝘀𝘀 𝗮𝗰𝗰𝗼𝘂𝗻𝘁𝘀: 𝗳𝘂𝗹𝗹 𝗴𝘂𝗶𝗱𝗲 (𝗣𝗗𝗙)

In my last post I talked about the “worst day” scenario: CA misconfig → admins locked out. Most orgs think they’re covered… until they test it.

As promised, 𝗵𝗲𝗿𝗲’𝘀 𝘁𝗵𝗲 𝗳𝘂𝗹𝗹 𝗣𝗗𝗙 𝗴𝘂𝗶𝗱𝗲 that walks you through a practical break-glass setup:
▪️ Naming
▪️ Permissions
▪️ Role-Assignable Security Group
▪️ Custom Break-glass Administrator role (Optional)
▪️ Restricted Management Administrative Unit (RMAU)
▪️ Authentication Methods
▪️ Conditional Access Configuration
▪️ Monitoring & Alerting
▪️ Operational Procedures

📎 Download the PDF here:
https://t.co/Q4h9BikrDV

𝘈𝘶𝘵𝘩𝘰𝘳: Martin Strnad

💬 When was the last time you tested your break-glass access?

#EntraID #IdentitySecurity #ConditionalAccess #SecureBits #HorizonSecured

[AWS Security Digest @AwsSecDigest]

Stop Enabling Every AWS Security Service
By: Sena Yakut

Turning everything on by default creates thousands of untriaged alerts and dashboards nobody looks at. Sena argues you should threat-model your actual architecture, find the real breaking points, and pick controls that map to those risks.

🧭 Start with threat modeling: map assets, attack paths, and where detection actually matters.
💸 Cost and overlap matter: many AWS services duplicate third‑party tools and generate redundant telemetry.
🔐 Prefer IAM Identity Center + short‑lived credentials over piling on more continuous monitoring — it reduces signal noise and blast radius.
⚙️ Practical tips on rule tuning, prioritizing high‑fidelity alerts, and aligning monitoring to business‑critical components.

This was first mentioned in AWS Security Digest Issue #251: https://t.co/1rrdVmwRuZ

Read the full piece here: https://t.co/z72QIDbfye

[Shoko ARAKI @shokoaraki]

Microsoft Entraの廃止予定・破壊的変更・プレビュー・新機能が確認できる「Entra Change Tracker」はありがたい。
https://t.co/mJ9gAMRnJv

Entra IDの変更を個人の努力だけで追随するのは限界。
これからは、運用が破綻しない形でを変更管理を維持していけるかが重要だと改めて実感。

IT技術者には、変化が起きても安全性と業務継続を崩さない運営能力が求められる時代になってしまったなぁ…と思いつつ、実は、昔からずっとそうだったような気もしてきた（スピード感は違うかもしれないけど）😅

[Fabian Bader @fabian_bader]

Suspicious MFA authentication approval was added to Entra ID risk protections.

Limited to P2 customers 😢

[Horizon Secured @horizon_secured]

🔒 Secure Bits 💡
𝗬𝗼𝘂𝗿 𝘁𝗲𝗻𝗮𝗻𝘁 𝗵𝗮𝘀 𝗖𝗔 𝗺𝗶𝘀𝗰𝗼𝗻𝗳𝗶𝗴𝘂𝗿𝗮𝘁𝗶𝗼𝗻. 𝗘𝘃𝗲𝗿𝘆 𝗮𝗱𝗺𝗶𝗻 𝗶𝘀 𝗹𝗼𝗰𝗸𝗲𝗱 𝗼𝘂𝘁. 𝗗𝗼 𝘆𝗼𝘂 𝗵𝗮𝘃𝗲 𝗮 𝘄𝗮𝘆 𝗯𝗮𝗰𝗸 𝗶𝗻?

Most organizations don’t — or think they do, until they discover their break-glass accounts are untested, unmonitored, or built on outdated guidance. You don’t want to find that out the hard way, and you definitely don’t want to go through Microsoft’s Tenant Recovery process.

🤔 𝗪𝗵𝘆 𝗰𝗮𝗿𝗲?
A lockout from a bad CA policy, a compromised admin, or a personnel emergency means opening a support ticket with Microsoft and waiting. In urgent situations, you don’t have 14 days for that process.

🧠 𝗪𝗵𝗮𝘁 𝘄𝗲 𝘀𝗲𝗲 𝗶𝗻 𝘁𝗵𝗲 𝗳𝗶𝗲𝗹𝗱
•𝗕𝗿𝗲𝗮𝗸-𝗴𝗹𝗮𝘀𝘀 𝗮𝗰𝗰𝗼𝘂𝗻𝘁𝘀 𝗮𝗿𝗲 𝗺𝗶𝘀𝘀𝗶𝗻𝗴 — Two geographically separated accounts is the baseline.
•𝗚𝗲𝗻𝗲𝗿𝗶𝗰 𝗻𝗮𝗺𝗲𝘀 — admin@…, info@… are not break-glass accounts.
•𝗙𝘂𝗹𝗹 𝗖𝗔 𝗲𝘅𝗰𝗹𝘂𝘀𝗶𝗼𝗻 𝗶𝘀 𝗱𝗲𝗮𝗱 — MFA is now enforced by Microsoft regardless.
•𝗪𝗲𝗮𝗸 𝗮𝘂𝘁𝗵 𝗺𝗲𝘁𝗵𝗼𝗱𝘀 — Phone or certificate-based auth will fail exactly when you need it.
•𝗨𝗻𝗽𝗿𝗼𝘁𝗲𝗰𝘁𝗲𝗱 𝗮𝗰𝗰𝗼𝘂𝗻𝘁𝘀 — Any admin can edit or delete them.
•𝗡𝗼 𝗺𝗼𝗻𝗶𝘁𝗼𝗿𝗶𝗻𝗴 — If someone touches these accounts, you should know immediately.

🛠️ 𝗖𝗿𝗲𝗮𝘁𝗲 𝘁𝘄𝗼 𝗮𝗰𝗰𝗼𝘂𝗻𝘁𝘀
Use descriptive names on onmicrosoft[.]com with a random string — e.g. [email protected]. Assign 𝗚𝗹𝗼𝗯𝗮𝗹 𝗔𝗱𝗺𝗶𝗻𝗶𝘀𝘁𝗿𝗮𝘁𝗼𝗿 as a direct, permanent, active role. No eligibility.

🛠️ 𝗟𝗼𝗰𝗸 𝘁𝗵𝗲𝗺 𝗱𝗼𝘄𝗻
Place both accounts and their group inside an 𝗥𝗠𝗔𝗨 (requires Entra P1). Manage access via a custom PIM role — max 1-hour activation, approval required, auth context enforced (requires Entra P2).

🛠️ 𝗖𝗼𝗻𝗳𝗶𝗴𝘂𝗿𝗲 𝗮𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗶𝗼𝗻
Scope a passkey profile to the break-glass group with specific AAGUIDs for your hardware keys (YubiKey, Token2). Enforce via a custom authentication strength in a dedicated CA policy. Exclude the group from all other CA policies — run a What If to verify only your two break-glass policies apply.

🛠️ 𝗦𝗲𝘁 𝘂𝗽 𝗮𝗹𝗲𝗿𝘁𝗶𝗻𝗴
Stream AuditLogs and SignInLogs to a Log Analytics Workspace (requires Azure subscription). KQL alert rule on the break-glass Object IDs — any event fires immediately.

🛡️ 𝗦𝘁𝗼𝗿𝗲, 𝘁𝗲𝘀𝘁, 𝗱𝗼𝗰𝘂𝗺𝗲𝗻𝘁
Each passkey + PIN in a separate physical location. Define who can trigger the procedure and under what circumstances. Test end-to-end at minimum every 180 days — Microsoft recommends 90. Pick your cadence, but validate.

💬 When was the last time you tested these accounts?

𝘈𝘶𝘁𝘩𝘰𝘳: Martin Strnad

PS: We will soon 𝗽𝘂𝗯𝗹𝗶𝘀𝗵 𝗳𝘂𝗹𝗹 𝗴𝘂𝗶𝗱𝗲 on this topic!

#EntraID #IdentitySecurity #ConditionalAccess #SecureBits #HorizonSecured

[Merill Fernando @merill]

Entra Hardening Tip #2: Require MFA for device join & device registration using 'User Action'

If you don’t enforce a Conditional Access policy for “Register or join devices”, you’re leaving a gap.

Attackers can take advantage of this and register new devices without MFA.

Once they’re in, they can:

🚩 Stay persistent
🚩 Bypass controls that rely on trusted devices

From there, it opens the door to:

🚩 Data exfiltration
🚩Dropping malicious apps
🚩 Moving laterally across your environment
🚩Recon of your device configuration and compliance policies

The fix:
Create a CA policy
→ Include: All users
→ Target: User Action = Register or join devices
→ Grant access: Require authentication strength - MFA

[ALI TAJRAN @alitajran]

Security recommendation: Enable Tenant Isolation in Power Platform!

Starting March 30, 2026, Microsoft enabled tenant isolation by default for new tenants.

This is great news for new tenants. But not really for existing tenants.

For existing tenants, this setting will not be enabled automatically, and you must turn it on manually.

Microsoft strongly recommends enabling tenant isolation for existing tenants to improve your Microsoft tenant security posture.

Learn more: https://t.co/kVyRebnkIw

#Microsoft365 #PowerPlatform #Cybersecurity

[Fabian Bader @fabian_bader]

Building custom graphs in Microsoft Sentinel will be a game changer for many security operations. While KQL supported graph for a long time, this finally solves the gap in integration.

https://t.co/IsJt123tyQ