Cloudbrothers

In my series “Detect threats using *GraphActivityLogs” I covered a lot of the basics on how to use different methods to detect certain reconnaissance tooling based on fingerprinting the specific sequence of requests or the volume of requests made to the M…

In Entra ID, Conditional Access acts as the gatekeeper to any token material.

When Nathan and I released XDRInternals one of the biggest shortcomings for me was the lack of workload identity support.

In Microsoft Entra, Conditional Access is, after the Authentication itself, the most crucial part of defense against attackers.

This blog post is a sleeper.

For a long time now, defenders had the ability to monitor behavior of human- and workload identities in Entra tenants not only through AuditLogs but with high level of insight with the MicrosoftGraphActivityLogs logs.

Ho, ho, ho… In Germany on the 6th of December we celebrate “Nikolaus”.

For red teams and adversary alike it’s important to stay hidden.

Entra ID Multifactor Authentication is on everyone’s mind, as Microsoft will enforce the usage of MFA for most of the Admin portals starting October 2024.

Graph databases offer great insights into existing data, that relational databases cannot or can only solve with more resources.