Defender AV's ASR rules really are fantastic, great way to break attacker tools while still allowing your apps to work
I need to update my blog, but the core is there - KQL queries to help build your allow lists and get it done
https://t.co/Di1lfwkrWD
Some lessons learned 🧵
Detecting NTLM Leakage in Windows Search
Microsoft has closed this issue without assigning a CVE or releasing a patch, describing its triage process as “case‑by‑case”. According to Huntress’ latest blog — When “Moderate” Means “Sometimes” — this leaves defenders exposed.
https://t.co/rEOsDogU7y
I believe this warrants proactive detection: threat actors can abuse the Windows Search URI to silently collect NTLM hashes. Sharing detection logic to help spot and stop abuse before it escalates.
https://t.co/nAxSqlHPgn
#Cybersecurity #DefenderXDR #NTLMLeak #WindowsSearch
An attacker dumps LSASS on one endpoint. The local admin hash is the same across 800 machines, likely due to the use of golden images.
If you aren't already doing it, deploy Windows LAPS: each endpoint gets a unique, rotated password. One stolen hash, one machine, and not 800.
It's free and native; deploys in hours. Still one of the highest-ROI hardening wins in 2026.
I was recently reminded that this is a thing...
Then I read the docs to remind myself about these features and oh yeah, Microsoft themselves don't recommend deploying it in modern environments. 🙃
It's unfortunate that everything has moved to the cloud/entra. There's some neat features that if they got some love, would be killer.
https://t.co/99Q90Klmjx
I decided to publish my internal Azure Entra ID tool. There are a lot of these already available, but I've added some interesting features that have made a difference for me over the years. You can capture token through the browser using playwright
https://t.co/xiZaz0PKsC
#Azure
WSL now has built in Linux container support with both a CLI and an API, announced today and coming soon by the end of the month!
You can read more about it here (While our official docs are building :) )
https://t.co/o9RaROfswP
@ZackKorman Want to learn how to do Zero Trust for AI?
Especially in the Microsoft ecosystem.
https://t.co/76RMUTiwvi
Here's the latest guidance.
This quarter there will be automated tests available to check your M365 tenant's configuration.
Coming soon to https://t.co/FAdRZGrtXq
ACTIVE DIRECTORY GROUP POLICY: BLOCK NEW OUTLOOK
Download and update your Group Policy Central Store with the new ADMX files for Office 2024:
https://t.co/J0t6SBInwJ
From there, set:
Manage Automatic setup of classic Outlook accounts in new Outlook: DISABLED
It goes without saying that we should not have to opt out of the pilfering of our user's logon name, password, and entire mailbox contents up to the Microsoft Mother Ship.
But we do.😡
Experts Exchange Question by Don:
How to protect computers from the new computer attacks from software like Mythos?
My answer which is, I think, pretty good thus worth sharing!
:0)
[QUOTE]
Don,
TL;DR
Layers Don. Layers.
In the end, Train the Human™ is the best way to mitigate.
***
You have a bunch of really good answers.
But, I have a question for you, yes it is facetious bordering on sarcastic: Are you a praying man Don? ;-)
Firstly:
Humans are not perfect
Humans code
Therefore, code is not perfect.
^^^
Let's get that out of the way.
Secondly, let's talk about the two methods vulnerabilities appear in code:
1: As above - To err is human …
2: Deliberate
- See University of Minnesota Hypocrite Commits for a Linux variant
- SMBv1 (EternalBlue) - There's no way Microsoft didn't know that it had been weaponized
- SPECTRE (CPUs) - Backdoors in hardware and firmware
- vPro - Yeah, there's tinfoil hat here but do the research
So, where does that leave us?
1: Most certainly the Security Theatre folks will prey upon the more FUD oriented folks.
2: Buying up a bunch of RTX 3090s and getting our own models/Mythos going
3: Realizing that some of what we see in tech had creators, some being malicious, that never foresaw Crowd Sourced code fuzzing for vulnerabilities
IMNSHO, Crowd Source fuzzing is the best thing that has happened in tech because it's forcing, FORCING, vendors to actually clean up their code if #1 or realize that someone will find that SolarWinds code plant at some point.
[/QUOTE]
I am now of the mind that we need to build out some infrastructure here, which we are in the process of doing, to set up our own AI models/agents and more.
I've seen enough to see that there are benefits to be had so long as there are solid guardrails in place.
Though, Mythos does make those guardrails disappear doesn't it? ;-)
https://t.co/21zqmC97HV
.@ExpertsExhange
usbsnoop — sniff and decode USB device traffic system-wide with eBPF, for reversing proprietary protocols (control/SCSI/HID, no bus analyzer) https://t.co/gGDPHlR6gE
SharePoint and OneDrive "People in your organization" share links can finally expire automatically.
Two Set-SPOTenant parameters. Recommended default + hard max, 7 to 720 days, configured independently for SharePoint and OneDrive.
The cleanest oversharing control Microsoft has shipped this year.
Demo in the reply.
#SharePoint
I've collated 2400+ Microsoft architecture icons and published them for easy access at https://t.co/C1Zv6sIkzn 💙
For every icon, you can:
• Download the scalable SVG file
• Download the PNG of your desired size
• Embed the icon directly into your website or markdown
• Choose a light, dark or transparent background
You can can even compare different icons together and favourite multiple icons for bulk download!
#Microsoft
I bet Ryan means code review for existing code, but when creating new, code review is really too late to fix overly complex, sloppy AI code
I created this, using it with pretty good success:
https://t.co/8bPk24QqFA
It's workflow specific, so steal ideas, don't use wholesale ;)