Thijs Lecomte

Microsoft MVP, #MEM, #Security and #Automation. Technical Editor for Security @ Tweets are my own

[Thijs Lecomte @thijslecomte]

I am happy to announce the newest version of the @m365security ebook! It contains multiple new chapters and significant updates in others.
The content covers both #MicrosoftDefender and #MicrosoftSentinel.
Foreword has been written by @rodtrent

https://t.co/gPfeVZcOjJ

[Thijs Lecomte @thijslecomte]

Excited to be speaking again at a live event!

Join me at MC2MC Connect in February next year!

[MC2MC @mc2mcbe]

We’re thrilled to welcome @thijslecomte as our next speaker at MC2MC Connect in Antwerp on February 5th 🎙️

➡️Curious about the agenda or ready to get your 🎟️ https://t.co/PlPmvZAVqp

#MC2MC #ConnectMC2MC #ConnectMC2MC2026 #Connect #Collaborate #Create

[Practical 365 @Practical365]

Protecting Effectively Against Ransomware https://t.co/vHi88hBRtZ #Ransomware #Security #ActiveDirectory @thijslecomte

[Thijs Lecomte @thijslecomte]

@rucam365 What role(s) do you use when doing assessments?

[Thijs Lecomte @thijslecomte]

@rucam365 As an admin, you cannot view GDAP delegations with global reaser

[Thijs Lecomte @thijslecomte]

Are you struggling to add the correct data into #MicrosoftSentinel? Check out my latest article on @Practical365, detailing some tips and tricks I use.

This is the first article of a small series, focusing on adding networking data into Sentinel.

[Practical 365 @Practical365]

Practical Sentinel: Adding Networking Data to Microsoft Sentinel 👉 https://t.co/rOwhajSiV1 @thijslecomte

#Sentinel #EntraID #Defender

[Thijs Lecomte @thijslecomte]

@tjmklaver With some delay, you can find them here: https://t.co/fptBfOlqse

[Thijs Lecomte @thijslecomte]

@rucam365 I have two 27" 4K myself. It's easier for me to share screens and keep an overview.

As an IT guy working from home, I share my screen multiple times a day

[Thijs Lecomte @thijslecomte]

Excited to be taking the stage again, together with @LouisMastelinck to talk about phishing in Microsoft Teams!

[MC2MC @mc2mcbe]

[1/2] 📢 Our next in-person event of 2024, MC2MC Live: The Final Frontier, is taking place on Wednesday, April 17th.

We are thrilled to introduce our event line-up, featuring Jens Du Four, Hanna Engel, @thijslecomte, and @LouisMastelinck

🎟️ https://t.co/FUhud3lxGV

#MC2MC

[Merill Fernando @merill]

🚀 This week's newsletter just went out!

Featuring posts from 👇

@charbelnemnom,@benoit_hamet,@msazureacademy,@ntfaqguy,@cloudfirstpod,@rbrayb,@12knocksinna,@shehanperera85,@shaunhardneck,@crookedbong,@nviso_labs,@fabian_bader,@crookedbong,@12knocksinna,@thijslecomte

🧵⬇️

[Thijs Lecomte @thijslecomte]

Just released a new blog talking about a new CA feature which I have been waiting on for a long time. This allows us to better protect our administrator users against token theft and opens up new ways to secure critical applications.
https://t.co/ftnQU1jHXs
#entraid #ca

[Thijs Lecomte @thijslecomte]

Going live with @LouisMastelinck in 10 minutes to talk about phishing attacks in Teams

Join here => https://t.co/X5NExdBwlj

[Thijs Lecomte @thijslecomte]

This weekend, I deep dived into the Microsoft hack to see how it happened and what we learned from it.

I linked it to the @ENowConsulting 's Application Governance, which provides insightful recommendations into some common misconfigurations

https://t.co/HqLIBXimI8

[Thijs Lecomte @thijslecomte]

Hey! Did you Activativate your Azure PIM role already??
#AzureActivity #MicrosoftSentinelSnafu

[Jani Vleurinck @JaniVleurinck]

Has anyone else noticed in the Sentinel table AzureActivity that if a role is assigned to a resource using PIM the field here has a massive typo under the Target JSON field? I can't get this out of my head.

[Thijs Lecomte @thijslecomte]

@rucam365 What's the source on this Ru? Haven't seen this article myself

[Thijs Lecomte @thijslecomte]

Excited to be speaking at @TeamsNation in February with @LouisMastelinck

We will be discussing a new type of Phishing using Microsoft Teams.

What it is, how to protect against it and how to detect it.

Join us in this free awesome event 👇

https://t.co/9FYqbxfb2b

[Thijs Lecomte @thijslecomte]

Apps within Entra ID remain a security risk in a lot of companies... Check out the blog below on how you can protect your organization against it!

[ENow Software @ENowConsulting]

💥App Registrations are highly privileged & often used by #threatactors for privilege escalation attacks in #EntraID
👉 Microsoft MVP @thijslecomte explains how you can protect your organization with the proper permissions in place for attack prevention: https://t.co/zDyNZKR22D

[Thijs Lecomte @thijslecomte]

If you like in-depth articles, check out this one below!
It covers, in great detail, how an attack in a cloud environment looks like and how to detect it. Including initial access, persistence, reconnaissance and privilege escalation.

[Robbe Van den Daele @RobbeVdDaele]

I wrote a blog post about how Entra ID Joined and Hybrid Joined devices can be used to move to #entraid and #cloudsolutions, how to detect it, and what preventive controls you can use.

📜https://t.co/BOn3abMu1c

#microsoftsecurity #hybridbrothers

[Thijs Lecomte @thijslecomte]

As the year is coming to an end, I take some time to look back at what has happened.

A lot of new products (outside of E5)
A lot of copilot
And some detection/reliability issues

Looking forward to what 2024 brings!

[Practical 365 @Practical365]

2023 Microsoft Security Wrap-Up https://t.co/Xrj2eYPG3m @thijslecomte

[Thijs Lecomte @thijslecomte]

With the announcement of #MicrosoftDefenderXDR, I wanted to share my thoughts on some of the current pain points in automation with #MicrosoftDefender and #MicrosoftSentinel in this blog 'My wishlist for automation within Microsoft Defender XDR'
https://t.co/Txrb064yDE