Mrs.Robot

alts volat propriis #blueteamdefender #Windowssecurityfanatic #threathunting #incidentresponse #ELK I eat when am not hunting . Continues to learn infosec

[Huntress @HuntressLabs]

An attacker made 81M login attempts against Microsoft accounts in two weeks.

78 accounts were compromised, all with MFA on...but misconfigured.

We're breaking it all down in this month's Tradecraft Tuesday: https://t.co/1ShHosGDe2

Jul 14, 2026 | 1:00pm ET | 10:00am PT

[mthcht @mthcht2]

Microsoft Graph Permissions list classified by severity and privileged impact to detect risky OAuth consents, over-privileged apps, consent phishing, apps with dangerous access, and enrich SIEM detections/app reviews.

https://t.co/Aa0UHz8Ugj

[blackorbird @blackorbird]

By abusing the extended invocation of the system whitelisted utility Reg.exe, the adversary skillfully bypasses the detection and interception mechanism of antivirus solutions, evades EDR controls, and successfully performs credential hash dumping.
https://t.co/6ABfJj52Ph

[Fabian Bader @fabian_bader]

In my latest blog "Now You See Me: AADGraphActivityLogs" I explore the newly released Azure AD Graph logs and demonstrate how you can detect tools like ROADtools and AADinternals that rely on this API and have been under the radar for defender so far.

https://t.co/TXlkbsqKHa

[Nathan McNulty @NathanMcNulty]

If you're feeling nerdy and just have to know how browser SSO works, read this amazing write-up 😎

https://t.co/UBPOzzOZE2

For those feeling less nerdy, the browser makes calls to get PRT/device auth from CloudAP/WAM. Private mode doesn't allow those calls, so no device state.

[Threat Insight @threatinsight]

Threat researchers at @Proofpoint are tracking two ongoing, highly targeted campaigns combining OAuth redirection mechanisms with brand impersonation techniques, malware proliferation and #Microsoft365 themed #credential phishing for #Account Takeover (#ATO).

[Shanholo @ShanHolo]

🚨#Opendir #Malware🚨

hxxps://20.229.103.183/

⚠️#Blankgrabber #Stealer
☣️niox.exe➡️8333cfbd03a35fc6a741b3d87d5cc24a
📡https://t.co/SbpAEAV8O8

⚠️#AsyncRAT
☣️nioxxy.exe➡️40ca1ead3549731f411d3245b59f9c7b
📡tcp://20.229.103.183:4000/

🛑 @censysio Pivots points⤵️📸

[Cyber Team @Cyberteam008]

#Fofa Query for #Redline #Stealer (56 C2 servers found)

Query: header_hash="355811075" && port="1911"

Link: https://t.co/hffHu2dnGq

Infra: https://t.co/O0cNX6Ppwh

@500mk500 #Malware #ioc

[Dipo @dipotwb]

Suspected initial access malware spreading via fake captcha, utilising trycloudflare domains

[Jon Hencinski @jhencinski]

It's a good time to ask: do we have the ability to detect, investigate, and remediate the authorization of malicious third-party OAuth applications?

The team at Microsoft published a post detailing how to investigate and remediate risky OAuth apps (linked below).

A couple of other points:

- To respond, remove the OAuth app and revoke its permissions.
- You can restrict which users can authorize new OAuth apps, but in this campaign, it appears attackers targeted employees likely to have these permissions.

https://t.co/MNh0nWRZvn

[Jai Minton @CyberRaiju]

More details on current Cleo exploitation now available on the Huntress blog!

https://t.co/PKQcRj1nze

[blackorbird @blackorbird]

Malware download and use of the Wazuh SIEM agent for remote access and telemetry harvesting.
"remote_commands" option
https://t.co/Icb45EjDAh
ref:
https://t.co/Z5VGrUrDe6

[Elli @ellishlomo]

Unmasking the Shadow

https://t.co/nzgQz8Y7yO

[Clint Gibler @clintgibler]

📚 Awesome Threat Detection

A curated list of awesome threat detection and hunting resources

By @0x4d31 and contributors

https://t.co/8RWkDPdnAR

#cybersecurity

[FalconForce Official @falconforceteam]

Today, we introduce the Reply URL Brute tool that enumerates single and multitenant #Azure applications without user interaction. The tool helps blue teams exploring and enumerating the attack surface that multitenant applications have in a tenant.

https://t.co/crUXpScExZ

[Raghav Rastogi @raghav127001]

This one lit up like a Christmas tree on @anyrun_app
http://45.139.196.250 -> Verify -> mshta.exe 45.139.196[.]250/recaptcha-verify -> xdr.bat&auto-install-hrdp.bat
Install smbclient to add a new user , delete firewall rules and exfills data with ngrock
https://t.co/kO6Ccsdafw

[SEKTOR7 Institute @SEKTOR7net]

Dynamic Detection and Classification of Persistence Techniques in Windows Malware - master thesis by Jorik Jaromir van Nielen.

#redteam #maldev

https://t.co/s7EjBpam0M

[Aaron Jornet @RexorVc0]

#APT #Bitter #ManLinghua APT-Q-37 APT-C-08 #MiyaRAT

📍🇮🇳
💥🇨🇳🇵🇰

⛓️ #Phishing > #MSI > #MiyaRat > #C2 connection > Info collection > Upload Info to #C2 > Awaits execution from #C2

🔗Qianxin Threat Intelligence: https://t.co/hrFp3ZMrxg

[David das Neves @david_das_neves]

🚨 "New" #MicrosoftGraph attack vector exposed! 🚨

Discover how attackers can exploit PIM-related app permissions to gain unauthorized access & elevate privileges in your M365 tenant.

Read @emilien_socchi's great analysis now:
https://t.co/jEOWUXHw4R

#cybersecurity