Katie Knowles

Senior Security Researcher @ Datadog. 🐕 Head in the (Azure) clouds.
Sometimes blogging, always curious.

[Katie Knowles @_sigil]

👀 Agents are quickly becoming part of the identity attack surface. Are you keeping an on them? We recently identified an issue where Copilot Studio didn't log key administrative modifications to agents.

Details & detections:
https://t.co/gMijtJ3lMI

[Katie Knowles @_sigil]

@Cyb3rMonk I used to think this, but was surprised how many folks don't follow cons closely. The blog, talk 1, talk 2 will all get slightly different outreach - especially if social algorithm traction wasn't great for whatever reason. I still try & hold off at 2 max.

[Katie Knowles @_sigil]

@sapirxfed You've got this!! 😁

[Eric Woodruff | MVP | CIDPRO @ericonidentity]

Seeing new attributes pop-up is a strong signal that something is brewing in Entra ID.

Ever wish this could be surfaced in an automated way?

Enter https://t.co/HlCiR9DXjn - An automated system that scrapes #Entra for changes on a daily basis.

#EntraID #infosec #mvpbuzz

[Katie Knowles @_sigil]

@sapirxfed Right?? Fantastic explanation as well. 😁

[Katie Knowles @_sigil]

This BlueHat talk from Dylan Ryan-Zilavy and Cameron Vincent (@SecretlyHidden1) is an awesome watch! Fantastic bug and explanation of overlooked OAuth 'aud' claim validation:
https://t.co/EyO58uU3nV

[Nick Frichette @Frichette_n]

Malicious skills are evolving, and attackers are finding ways to execute them before model-level defenses even activate.

In the first post of our new series, I’ll show you how dynamic context in coding agents can introduce new supply chain risks:
https://t.co/xdqgUo8xEA

[mdowd @mdowd]

CFP is open!! Submit your cool talks about AI hacking/defense/core tech. Gonna be awesome!! ☺️

[mthcht @mthcht2]

Launching https://t.co/Z3gUh4OCOA
Look up any OAuth app ID and find out what it actually is across thousands of legitimate, risky, and malicious apps (Entra, Google, GitHub).
Multiple feeds, API, detection ideas and remediation guidance. Still improving the detections a bit 🦾

[Katie Knowles @_sigil]

@cnotin What gave it away? 😂
It's such a fantastic reference for what's been seen "in the wild", hard to get posts that in depth for Azure!

[Katie Knowles @_sigil]

🚨 Hey!! Have you checked out Stratus Red Team lately? We've been busy adding new techniques in Azure/Entra and GCP! Full lists below:

GCP: https://t.co/XYW0QedTKa
Azure: https://t.co/hCewWFHjb1
Entra: https://t.co/IUZZBUgKFp

[Katie Knowles @_sigil]

A fantastic example on how "invisible" preview features can impact your Entra tenant by @chrispy_sec!

[ChrisPhilipov @chrisphilipov]

If you're curious to see how you can backdoor conditional access policies by using a legitimate hidden condition then have a gander here:
https://t.co/PcS4spbfCA

[Katie Knowles @_sigil]

@ericonidentity @Thomas_Live @rucam365 @vanhybrid @NathanMcNulty Looking forward to it!!

[Katie Knowles @_sigil]

@msftsecresponse @secbughunter @fromsteph2u @Yanir_ @nmdhkr @dhiralpatel94 @hoangnx99 @niraj1mahajan @adiivascu Have fun!! Looks awesome.

[Katie Knowles @_sigil]

@DanielatOCN Yes!! This was a surprise to see pop into roles this week.

[Nick Frichette @Frichette_n]

Datadog Security Research continues to push the boundaries of modern cloud security—including AI security!

@_sigil shares her finding on logging gaps affecting Copilot Studio, allowing adversaries to evade detection.

https://t.co/fx8KQrZe1k

[Katie Knowles @_sigil]

@OliviaGalluccii @datadoghq You crushed it!! Congrats. 🎉

[Katie Knowles @_sigil]

@Frichette_n Are you saying you *don't* believe in the heart of the cards?

[Katie Knowles @_sigil]

🤔 Ever wondered what Microsoft Graph's batch requests are doing? I've released a Burp Suite extension to help untangle them here:
https://t.co/Ly7iHL8FsG

[Katie Knowles @_sigil]

@stokfredrik Your energy and positivity are an inspiration to me!!
The algorithm can get bent on rage, & I'm sorry to hear some of that negativity got aimed at you. :(
Excited to see what you create whenever you're ready again, but zero rush.