Colin Wilkins

Security Engineer. Ex-MEM and Jamf Pro admin. Passionate about empowering and reducing friction for end users.

[Colin Wilkins @SysBehr]

LinkedIn

[Grummz @Grummz]

I don't mean to alarm anyone, but there is now a social media site for bots.

They are already talking and posting.

Humans welcome.

[Colin Wilkins @SysBehr]

@MSFT365Status our mac fleet is only 1/12th of our environment but in the last 24 hours has produced more process create events than our entire windows estate has in the same time period. For the love of God please terminate office patching for macOS from yesterday’s release.

[Colin Wilkins @SysBehr]

Anyone else seeing the macOS office auto update helper call /bin/test against office patch files hundreds of thousands of times related to 16.105.1 installing???

[Colin Wilkins @SysBehr]

@IAMERICAbooted 💯 We got caught out by this (impacting Teams Phones when we first rolled out the block for Device Code Auth) because we had turned off noninteractive sign-in logs going to Log Analytics (for CAP Impact Reporting) due to outrageous storage costs🥲

[Colin Wilkins @SysBehr]

@IAMERICAbooted @mwheatfill “Happy to hop on a call to configure it with y’all if you need more context” is my go-to

[Colin Wilkins @SysBehr]

@IAMERICAbooted @mwheatfill Request the team that has permissions/owns Entra set it up instead 😁

[Colin Wilkins @SysBehr]

@IAMERICAbooted MFW tasks are delegated but the outcome is still micromanaged with unclarified expectations 🥹

[Colin Wilkins @SysBehr]

Yeah so turns out this is working as intended. Sessions need to be revoked for re-prompt. Guess what isn’t available as an automatic response/control feature for sign-in risk? Revocation. Even if you’re leveraging a SIEM/SOAR action to revoke via API, it’s coming 15 min delayed.

[Colin Wilkins @SysBehr]

https://t.co/uhhJnCNo17

Requiring new sessions for Medium Risk Sign-ins does nothing to stop Session Token Replay attacks in practice according to live tests. What is the deal?

How does this protect anything if Anomalous Token EIDIP alerts only flag the sign-in risk as Medium?

[Colin Wilkins @SysBehr]

*Disgruntled Notes from the Field. Bah.*

Inb4 device compliance and passwordless purists enter the chat.

Defense in Depth is *Key* but not when you have to play politics despite demonstrating the facts.

[Colin Wilkins @SysBehr]

Really would be swell to have a Token Revocation action on Conditional Access policies for risk mitigation. Built-in policy/manual sign-in risk policies don’t work to re-auth risky sign-ins at any level. Sign-in frequency and persistent browser session controls just don’t work…

[Colin Wilkins @SysBehr]

I mean heck - even changing a password doesn’t revoke tokens on its own. What’s the point without automatic revocation? Sure, CAE-aware apps can supposedly kill sessions but what does that matter when nothing stops the attacker at the door? Or at least makes them re-auth?

[Colin Wilkins @SysBehr]

Authentication strength is great but the problem is a new session is never interactively prompted and sign-in logs indicate it's stil being satisfied by the replayed token.

[Colin Wilkins @SysBehr]

https://t.co/7r0VwdZ13S

This is exactly what we're seeing. Love that the MVP response just ignores the fact that this doesn't work.

[Colin Wilkins @SysBehr]

Narrator: he did not actually love that

Good thing their webs are distinguishable.

[Colin Wilkins @SysBehr]

I love that gardening has been made a life threatening activity since moving to Texas. 🕷️🩸💀

[Colin Wilkins @SysBehr]

Reminder that HTML banners are not bulletproof:

https://t.co/01sP3RDSLw

[Colin Wilkins @SysBehr]

Lol... Microsoft Viva Engage (Yammer) activity notifications inject CSS/HTML that overwite/bypass Exchange Transport Rule External Sender banners on Outlook Mobile.

Switch to the native Outlook External tag to eliminate external sender banner bypasses.

https://t.co/3vikbT5lrw