threat hunting Featured LOLBins / LOLBas Live Off the Land Binaries. These local binaries are often used in malicious campaigns. They will use these to help achieve their goals without relying on custom code or files.
azure Azure Conditional Access - Disable Security Defaults It looks like you're about to manage your organization's security configurations. That's great! You must first disable Security defaults before enabling a Conditional Access policy.
books Featured Kevin Mitnick - Ghost in the Wires Kevin Mitnick was the most elusive computer break-in artist in history. Every security newbie or pro should have this book on their shelf! He accessed computers and networks at the world's biggest companies.
azure Azure AZ-500 Modules These a the modules and labs you'll need to get through the AZ-500 course. Follow the URL through to GitHub for the latest edition.
azure Preparing for the AZ-500 Course The syllabus for the Azure AZ-500 course. This is what you need to get through in order to complete the exam.
aad Azure Active Directory: Threat Hunting - SPN Key Count Azure Service Principals in your tenant should be periodically reviewed just as app registration secrets and passwords should be, see post https://www.cyber.engineer/azure-active-directory-threat-hunting-app-registration-key-count as they both work hand-in-hand. What is a service principal? To access resources that are secured by an Azure AD tenant, the entity that
aad Azure Active Directory: Threat Hunting - App Reg Key Count As part of your organisation's proactive threat hunting, app registrations with secrets and passwords configured should be reviewed to look for any suspicious entries. The following Powershell script which I like to run in CloudShell will give you an overview within your tenant. Service principals work hand-in-hand with app registrations,
azure Featured Azure Defender: Unusual unauthenticated access to your storage account Investigating Azure Defender Unusual unauthenticated access to your storage account. What is the $web container?
o365 O365: Enable mailbox auditing for all mailboxes Mailbox auditing allows you to discover illicit activities performed in an Exchange Online mailbox, whether by an attacker because of a compromised account or by a malicious insider who has delegate access.
soa O365: Disable legacy authentication Using legacy authentication may, in some circumstances, increase the risk of account compromise due to how the password is transmitted and stored.
azure Featured Azure Sentinel: Adding Threat Indicators Manually You can either have an automated Cyber Threat Intelligence feed (STIX/TAXII) or your threat indicators can be added manually in the form of IP, Domain, URL File hash. Let's run through the manual process.
azure Azure Sentinel: Querying for your Cyber Threat Indicators All CTI entries aren't just available to view in the "Threat Intelligence" page - they are stored in the Log Analytics Workspace table "ThreatIntelligenceIndicator". Here you will find the manually submissions, but also any automated feeds from STIX/TAXII.
sentinel Featured General Availability of Azure Sentinel Threat Intelligence in Public and Azure Government cloud General Availability of Azure Sentinel Threat Intelligence in Public and Azure Government cloud
major update Saying goodbye to Exchange Online basic auth A recent announcement from Microsoft regarding Exchange Online and Basic Auth - finally making that last push to get it removed.
kql KQL Cheatsheet A page full of useful KQL queries when you need to look for some quick ideas Searching // Search all tables and all data for a keyword. This will look across everything. It's very useful, but can be intensive and may even time out. Make sure to squash the time span
m365 Featured Microsoft 365 Defender: Threat Explorer - Permissions Find out what permissions you need in M365 Defender in order to use Threat Explorer for soft/hard delete of emails.
powershell Powershell: Some Must-Know Commands for Cyber-Folk These Powershell commands are popular among cyber security folk. You must know these!
perl Permutations with Perl #!/usr/bin/env perl use strict; use warnings; my %permution = ( "a" => [ "a", "A", "4"], "b" => "bB8", "c" => "cC", "d" => [ "d", "D"], "e" => "eE3", "f" => "fF", "g" => "gG9", "h" => "hH", "i" => "iI1", "j" => "jJ", "k" => [ "k", "K"], "l" => [ "l", "L", "7", "1"], "m" => [ "m", "M"], "n" => [ "n", "N"], "o" => [ "o", "O"
books Book Recommendations Here's a list of books I've read and would recommend Ghost in the Wires: Kevin Mitnick Ghost in the Wires: My Adventures as the World’s Most Wanted HackerShared via Kindle. Description: In this “intriguing, insightful and extremely educational” novel, the world’s most famous hacker teaches you easy cloaking
network tapping Featured Inline Ethernet Tapping & Data Exfiltration I usually have some crazy research ideas and like to run with them sometimes. In this experiment I have managed to tap the inline physical RX and TX (receive and transmission) wires of an ethernet cable of a target computer or system using sewing needles. This research experiment was not
mcas Featured Whitelisting your client's IP Range in MCAS How to whitelist corporate IP range in Microsoft Cloud App Security. Ultimately reducing false positives in your SOC.
