ryan

just a guy that grew up interneting lots. loves: @ac1dgoddess, good people, socially responsible politics. also, fuck.

[ryan @notasockpuppet1]

friday

[Sam Erde @SamErde]

If you've ever struggled with getting the right settings and auditing for Microsoft Defender for Identity (MDI), you'll be pleased to know that @ThomasVrhydn wrote a nice graphical PowerShell wrapper called MDI Configurator. 🧑‍💻🥳 Check it out at https://t.co/bRyaJrNso6 👈

[ryan @notasockpuppet1]

name that dive bar

[ryan @notasockpuppet1]

name that dive?!

[ryan @notasockpuppet1]

@mcguirl @gabsmashh @ac1dgoddess weird

[ryan @notasockpuppet1]

name that dive bar

[Nathan McNulty @NathanMcNulty]

In case this is helpful for anyone doing risk-based Conditional Access policies, I uploaded templates for my 5 recommended starting policies (no IRM risk for now)

https://t.co/shqnbaRlYh

I'm sure similar already exist on other's repos / websites, but I do things the hard way :P

[Ze k CyberCynic @CynicLib]

@kaidja A tool from Microsoft. You cans do inventory of your azure resources …and create diagram of your MG/subs etc.

https://t.co/q4HgTAiRQc

[Matt Zorich @reprise_99]

If you are a Defender for Identity customer, please don't forget to install the agent to AD FS, Entra Connect and AD CS on top of your domain controllers. The coverage for Active Directory Certificate Services is especially valuable as it covers not only suspicious activities but will report on existing configuration issues.

In many AD environments a misconfigured certificate template can allow any domain user to enroll and authenticate with a certificate for a domain admin account - allowing complete domain dominance for an attacker in minutes. Weak certificate template ACL's are common too, allowing any user to manipulate them to achieve AD compromise.

Additional sensor deployments - https://t.co/hUF81VtliI

Example misconfiguration that will be detected - https://t.co/nYfroho0vk

[The Haag™ @M_haggis]

🎯 Introducing AD-ThreatHunting: ⚡ Supercharge Your AD Threat Hunting!

🛡️ Just Released: A comprehensive Active Directory PowerShell threat hunting tool that makes detecting suspicious activities easier than ever!

✨ Key Features:
• Real-time attack detection
• Advanced timing analysis
• Pattern recognition
• Multi-format reporting (CSV/JSON/HTML)
• Built-in attack simulation

🔍 Detects:
• Password spray attacks
• Brute force attempts
• Account lockouts
• Off-hours activity
• Geographically impossible logins
• Service account misuse
• Admin account abuse

⚡ Smart Analysis:
• Time-based attack correlation
• Activity pattern matching
• User behavior analysis
• Configurable business hours
• Customizable thresholds

🧪 Includes Test Framework:
• Simulate various attack scenarios
• Validate detection capabilities
• Test environment readiness
• Verify audit policies

🚀 Get started: https://t.co/VGfASkzzox

Made with ❤️ by defenders for defenders
Hunt smarter, hunt harder

#ActiveDirectory #InfoSec #BlueTeam #ThreatHunting #CyberSecurity

[The Haag™ @M_haggis]

🚨 If you haven’t tested your Microsoft 365 environment like an APT, the time is now! Introducing msInvader, an adversary simulation tool designed to emulate attack techniques within M365 and Azure environments.

🔑 Key Features:
•Versatile Authentication Simulation: 🔄 Supports multiple OAuth flows to mimic various attack scenarios, including compromised user credentials and service principals.
•Comprehensive Exchange Online Interaction: 📧 Engages with Exchange Online through Graph API, Exchange Web Services (EWS), and the REST API used by the Exchange Online PowerShell module.
•Diverse Technique Simulation: 🎯 Capable of simulating techniques such as reading emails, searching mailboxes, creating rules, and more, providing a thorough assessment of your security posture.

Enhance your detection capabilities by simulating real-world attacks with msInvader. 🛡️

Check it out here:
https://t.co/vekI5hkX3r

[Nathan McNulty @NathanMcNulty]

My automated configuration of Defender for Identity is close to done :)

We will be able to run a script, have it configure everything, get the access key, and download the MDI installer for us!

Let me know if there's anything specific you want built ;)

https://t.co/9EiraFbft9

[KATY PERRY @katyperry]

just
watch
idiocracy
the
movie
that’s
all

[Visual Studio Code @code]

Friendly reminder that you can go to any GitHub repo, press the . key, and the entire repo will open in the browser using @code

[ryan @notasockpuppet1]

@Cthulhu_Answers i see iron mike and i have similar taste

[IAM!ERICA @EricaZelic]

I cannot say enough great things about https://t.co/vmfzv1j1NC . I do want to caution people that if you are using a different primary IdP, the report will look a lot worse than your posture really is. Some food for thought

[ryan @notasockpuppet1]

@ImposeCost mandate that payments will only be made in doge?

[ARCHIVED: Jen Easterly @CISAJen]

🚨ICYMI: Foreign adversaries, especially Russia, are continuing to conduct influence operations to undermine confidence in our elections & stoke divisions among Americans. We can’t allow our adversaries to have a vote in our democracy: https://t.co/SsFDkYNpvD.