Chris Fr.

Technology geek, Endpoint Management & Security practitioner, Frogger.

[Tom Wechsler - Microsoft Azure & CDM MVP @tomvideo2brain]

Microsoft Configuration Manager - Folge 19 - Windows Autopilot: Was es ist und wie es funktioniert
#Microsoft #ConfigurationManager #Intune #MDM #MAM #CoManagement #MicrosoftAzure #EntraID #mvpbuzz #coolstuff @MSConfigMgrTeam @MVPAward @MSIntune
👇👇👇👇
https://t.co/RrqamOlRPW

[Nicolas Krassas @Dinosn]

pentesterflow/agent: Agentic offensive-security in your terminal https://t.co/Asecl54gsu

[Nathan McNulty @NathanMcNulty]

Defender AV's ASR rules really are fantastic, great way to break attacker tools while still allowing your apps to work

I need to update my blog, but the core is there - KQL queries to help build your allow lists and get it done

https://t.co/Di1lfwkrWD

Some lessons learned 🧵

[Steven Lim @0x534c]

Detecting NTLM Leakage in Windows Search

Microsoft has closed this issue without assigning a CVE or releasing a patch, describing its triage process as “case‑by‑case”. According to Huntress’ latest blog — When “Moderate” Means “Sometimes” — this leaves defenders exposed.

https://t.co/rEOsDogU7y

I believe this warrants proactive detection: threat actors can abuse the Windows Search URI to silently collect NTLM hashes. Sharing detection logic to help spot and stop abuse before it escalates.

https://t.co/nAxSqlHPgn

#Cybersecurity #DefenderXDR #NTLMLeak #WindowsSearch

[Ridgeline Cyber @RidgelineCyber]

An attacker dumps LSASS on one endpoint. The local admin hash is the same across 800 machines, likely due to the use of golden images.

If you aren't already doing it, deploy Windows LAPS: each endpoint gets a unique, rotated password. One stolen hash, one machine, and not 800.

It's free and native; deploys in hours. Still one of the highest-ROI hardening wins in 2026.

[SystemCenterDudes @scdudes]

Understanding Microsoft Intune Logs files for Troubleshooting.
Start here:
https://t.co/7P4fJj4CBE

#MSIntune #Troubleshooting #ConfigMgr

[spencer @techspence]

I was recently reminded that this is a thing...

Then I read the docs to remind myself about these features and oh yeah, Microsoft themselves don't recommend deploying it in modern environments. 🙃

It's unfortunate that everything has moved to the cloud/entra. There's some neat features that if they got some love, would be killer.

https://t.co/99Q90Klmjx

[Mr.Un1k0d3r @MrUn1k0d3r]

I decided to publish my internal Azure Entra ID tool. There are a lot of these already available, but I've added some interesting features that have made a difference for me over the years. You can capture token through the browser using playwright

https://t.co/xiZaz0PKsC
#Azure

[Craig Loewen @craigaloewen]

WSL now has built in Linux container support with both a CLI and an API, announced today and coming soon by the end of the month!

You can read more about it here (While our official docs are building :) )

https://t.co/o9RaROfswP

[Merill Fernando @merill]

@ZackKorman Want to learn how to do Zero Trust for AI?

Especially in the Microsoft ecosystem.

https://t.co/76RMUTiwvi

Here's the latest guidance.

This quarter there will be automated tests available to check your M365 tenant's configuration.

Coming soon to https://t.co/FAdRZGrtXq

[Philip Elder @MPECSInc]

ACTIVE DIRECTORY GROUP POLICY: BLOCK NEW OUTLOOK

Download and update your Group Policy Central Store with the new ADMX files for Office 2024:
https://t.co/J0t6SBInwJ

From there, set:
Manage Automatic setup of classic Outlook accounts in new Outlook: DISABLED

It goes without saying that we should not have to opt out of the pilfering of our user's logon name, password, and entire mailbox contents up to the Microsoft Mother Ship.

But we do.😡

[spencer @techspence]

@NathanMcNulty @M_haggis neither, I guess, technically speaking lol https://t.co/Zj2USjucFH

[Philip Elder @MPECSInc]

Experts Exchange Question by Don:
How to protect computers from the new computer attacks from software like Mythos?

My answer which is, I think, pretty good thus worth sharing!
:0)

[QUOTE]
Don,

TL;DR
Layers Don. Layers.
In the end, Train the Human™  is the best way to mitigate.

***
You have a bunch of really good answers.

But, I have a question for you, yes it is facetious bordering on sarcastic: Are you a praying man Don? ;-)

Firstly:
Humans are not perfect
Humans code
Therefore, code is not perfect.
^^^
Let's get that out of the way.

Secondly, let's talk about the two methods vulnerabilities appear in code:
1: As above - To err is human …
2: Deliberate
- See University of Minnesota Hypocrite Commits for a Linux variant
- SMBv1 (EternalBlue) - There's no way Microsoft didn't know that it had been weaponized
- SPECTRE (CPUs) - Backdoors in hardware and firmware
- vPro - Yeah, there's tinfoil hat here but do the research

So, where does that leave us?
1: Most certainly the Security Theatre folks will prey upon the more FUD oriented folks.
2: Buying up a bunch of RTX 3090s and getting our own models/Mythos going
3: Realizing that some of what we see in tech had creators, some being malicious, that never foresaw Crowd Sourced code fuzzing for vulnerabilities

IMNSHO, Crowd Source fuzzing is the best thing that has happened in tech because it's forcing, FORCING, vendors to actually clean up their code if #1 or realize that someone will find that SolarWinds code plant at some point.
[/QUOTE]

I am now of the mind that we need to build out some infrastructure here, which we are in the process of doing, to set up our own AI models/agents and more.

I've seen enough to see that there are benefits to be had so long as there are solid guardrails in place.

Though, Mythos does make those guardrails disappear doesn't it? ;-)

https://t.co/21zqmC97HV

.@ExpertsExhange

[Nicolas Krassas @Dinosn]

usbsnoop — sniff and decode USB device traffic system-wide with eBPF, for reversing proprietary protocols (control/SCSI/HID, no bus analyzer) https://t.co/gGDPHlR6gE

[tetsuo @tetsuoai]

Stop using bulky GUIs. If you build software, live in the terminal.

neovim + AI auto-assist + grok-code-fast. Lock in. 🔒

The Setup:

Shell: zsh + oh-my-zsh + starship
Multiplexer: tmux
Monitor: btop + proc + duf + dust
Nav: yazi + zoxide + fzf + eza mag
Search: ripgrep + fd + bat
Git: lazygit + delta
Edit: neovim / emacs
Utils: jq + tldr + thefuck
Vibe: fastfetch

[Vlad Catrinescu @vladcatrinescu]

SharePoint and OneDrive "People in your organization" share links can finally expire automatically.

Two Set-SPOTenant parameters. Recommended default + hard max, 7 to 720 days, configured independently for SharePoint and OneDrive.

The cleanest oversharing control Microsoft has shipped this year.

Demo in the reply.

#SharePoint

[Daniel Bradley @DanielatOCN]

I've collated 2400+ Microsoft architecture icons and published them for easy access at https://t.co/C1Zv6sIkzn 💙

For every icon, you can:

• Download the scalable SVG file
• Download the PNG of your desired size
• Embed the icon directly into your website or markdown
• Choose a light, dark or transparent background

You can can even compare different icons together and favourite multiple icons for bulk download!

#Microsoft

[DirectoryRanger @DirectoryRanger]

“Evil VM”: From Guest Compromise To Entra Admin In 9 Easy Steps
https://t.co/Ft6du5X3Go

[DirectoryRanger @DirectoryRanger]

How You Can Impersonate Anyone in Active Directory (with Shikata!)
https://t.co/ecPqv56O2W

[Nathan McNulty @NathanMcNulty]

I bet Ryan means code review for existing code, but when creating new, code review is really too late to fix overly complex, sloppy AI code

I created this, using it with pretty good success:
https://t.co/8bPk24QqFA

It's workflow specific, so steal ideas, don't use wholesale ;)