D Lind retweeted
Whoa!
Ubuntu 26.10 supports new authentication flows for Microsoft identity services, along with 26.04 LTS and 24.04 LTS. ๐
Learn more: canonical.com/blog/canonicalโฆ
D Lind retweeted
Microsoft Threat Intelligence is tracking an active supply chain attack in which a threat actor compromised the trusted OAuth App of the backup application ConnectWise Cloud Backup (AppId: 506e08f9-6e9a-4da4-942b-a099a03644ae), formerly SkyKick Backup, to obtain access tokens across customer tenants.
ConnectWise Cloud Backup is a multitenant vendor application; customers grant consent for the application to operate in their tenants. We assess that the threat actor likely abused permissions previously granted by customers to the application, including highly elevated permissions like Directory.ReadWrite.All.
On October 15, 2026, we observed broad successful service principal authentication originating from the IP address 144.172.64[.]128. Follow-on activity included Microsoft Graph API reconnaissance and attempts to add additional credentials on the related service principal in target tenants to maintain direct access as a backdoor.
Microsoft Defender detects post-exploitation activity with the following alerts:
- Any alert related to "Suspicious sign-in"
- Graph API activity from a Microsoft threat intelligence IP address
- Verified Threat Actor IP
Defenders should review service principal sign-ins from unrecognized IP addresses, app credential changes, and OAuth grant activity associated with this specific OAuth AppId. In addition, we recommend looking for Threat Intelligence alerts on matching of IP against the Graph API activity and service principal activities.
We will continue to monitor this incident and will share updates as they become available. We encourage customers to check ConnectWise advisory for more information and additional guidance: msft.it/6013aQBvV.
Indicators of compromise (IOCs):
- App name: ConnectWise Cloud Backup
- AppId: 506e08f9-6e9a-4da4-942b-a099a03644ae
- Publisher name: SkyKick
- Source IP: 144.172.64[.]128
- User agents: Python-urllib/3.12, python-requests/2.31, python-requests/2.34.2
D Lind retweeted
Folks, if you have Entra ID P1, you already own a fix for stolen refresh tokens.
You may never have turned it on.
New Entra Chat with Alex Pavlovsky and Marilee Turscak, both PMs on Microsoft Entra, on Global Secure Access and compliant network.
1/7
D Lind retweeted
I had the domain for quite some time and the website was already up - but finally it's where I wanted it to be.
โฝ๏ธFull XDR and Sentinel schema coverage
โฝ๏ธDocumentation of XDRInternal modules by @NathanMcNulty and me
โฝ๏ธTable column relations (partly)
xdrinternals.com/
D Lind retweeted
We have been made aware of further info, which we are sharing. We had no idea Citrix sysadmins were like GTA6 fans - so friendly ๐ค
Please, direct further questions to Citrix. We are not Citrix PSIRT (despite it occasionally looking that way).
Citrix comms & patches are expected early next week.
Two vulnerabilities - both RCE.
Unpatched, 0days.
Exploited in-the-wild - discovered during forensics.
As always, watchTowr Platform customers have access to this information and already have the information needed to reduce exposure.
D Lind retweeted
New blogpost where I explain my take on shortcomings in Microsoft #PIM that need fixing.
learningbydoing.cloud/blog/pโฆ
D Lind retweeted
Ensure you have at least 2 emergency (break glass) accounts for Entra ID. These should have long passwords and FIDO2 keys. Monitor and alert when logon to either of these accounts occurs.
learn.microsoft.com/en-us/enโฆ
D Lind retweeted
Folks, Maester 2.2 is here!!
It was just a couple of months ago when we launched Maester 2.0 and the amazing Maester community has been SUPER busy.
The biggest news is support for Active Directory is now in preview thanks to Mike Soule and we have some really cool plans for Active Directory with @PrzemyslawKlys and his awesome TestimoX AD suite. Stay tuned on this.
We've added tests for so many new products (and sorry you need to sign in more times because not every Microsoft product uses Graph anymore ๐คทโโ๏ธ).
That includes Copilot config, Dataverse, SharePoint, Github (as more folks move agentic devlops to GitHub this is going to be super important), new Intune and Entra ID checks and so much more.
Here are the highlights
๐ฅ 269 Active Directory checks across identity, policy, infrastructure, DNS, trusts, replication, and access control
๐ฅ 5 Microsoft Purview checks to get your data security foundations ready for Copilot and AI
๐ฅ 12 new SharePoint Online checks across the CIS and CISA baselines, now cross-platform with PnP.PowerShell
๐ฅ 5 CIS GitHub organization controls and first-class GitHub connectivity
๐ฅ 9 Global Secure Access checks for Private Access, forwarding profiles, Compliant Network, and Internet Access
๐ฅ 4 Intune endpoint security checks for LAPS, attack surface reduction, App Control for Business, and Managed Installer
๐ฅ New Entra ID checks covering agent risk, directory sync safeguards, Conditional Access gaps, legacy MSOnline, and privileged first-party apps
๐ฅ A sharper report with markdown summaries, per-test durations, and critical findings sorted first
๐ฅ Contributor credits across maester.dev, so the people writing these tests get the recognition they deserve
Huge thanks to our contributors Artem Borodai, @BrianReidC7, @cbrhh, Christopher Edwards, @fabian_bader, Henrik Piecha, @janbakker_, Jean-Philippe George, Jon Gross, Jonathan Hope, Loรฏc Michel, Massimo Mazzariol, Matthias F., Mike Soule, Morten Mynster Kristensen, Ofir Gavish, @SamErde, Simon Albers, Stephan van Rooij, @thomas_live, Thomas Schmidt, Travis McDade, Truls Dahlsveen
(PS Please let me know if I've missed anyone)
Plus a huge personal thank you from me to all the maester.cloud founding sponsors maester.cloud/founders who have helped me go full time on Maester. This release wouldn't have been possible without you.
Learn all about this release at maester.dev/blog/maester-2-2
D Lind retweeted
If you want to hunt for signs of Certighost (CVE-2026-54121) by @h0j3n and @aniqfakhrul in your #XDR environment try this query.
1. Exclude DCs
2. Identify ADCS servers
3. Check for LDAP or SMB connectivity to any non DC from ADCS
BP for SMB possible!
gist.github.com/f-bader/8c44โฆ
D Lind retweeted
Do not enroll your personal devices in your company's MDM...
They will have full access to your files and browsing activity, and security tools, like EDR, will likely be installed without a way to remove it
And honestly, IT should not give that sensitive offboarding file to you
This came up twice today, so it gets a blog post.
Recently-departed MSFT employees who used BYOD devices might want to read this one.
textslashplain.com/2026/07/2โฆ
D Lind retweeted
Why did I leave Microsoft?
To work full time on ๐ฅ Maester.
Over 40,000+ tenants today rely on Maester to monitor their tenants daily.
I wanted to make sure that the tests they are running continue to be relevant and evolve as Microsoft 365 and the security landscape evolves.
So today I'm announcing the launch of Maester.Cloud
Maester Cloud is the portal companion to Maester that lets you track your results over time. It is multi tenant, runs in your cloud (or ours) and more โ check out the site for all the features.
More importantly Maester Cloud is a way for me to fund the continued development of the open source Maester core and the tests in Maester.
That is our mission. In fact I worked with the core team @fabian_bader , @Thomas_Live , @MySnozzberries and @SamErde to create the Maester Manifesto (maester.cloud/manifesto). It is our promise to the community.
If you value Maester and would like to support and ensure that Maester continues to grow and be healthy, I would be beyond thrilled if your organisation can sponsor this effort.
I would also appreciate it very much if you can share this post with your network to spread awareness.
Thanks!
ALT Screenshot of Maester Cloud
D Lind retweeted
๐ Stop bypassing MFA by adding your Office IP addresses to Conditional Access exclusions ๐
Read this now on why you shouldn't do this > ourcloudnetwork.com/why-you-โฆ
Modern threats have evolved, and your justification for why you have done this no longer matters.
๐๐จ๐ฎ ๐ฆ๐๐ฒ ๐ญ๐ก๐ข๐ง๐ค ๐ข๐ญ ๐๐๐๐ฌ ๐ญ๐จ ๐ฆ๐ฎ๐๐ก ๐๐ซ๐ข๐๐ญ๐ข๐จ๐ง ๐ฐ๐ก๐ข๐ฅ๐ ๐ข๐ง ๐ญ๐ก๐ ๐จ๐๐๐ข๐๐?
No, misconception. Microsoft invented their own token to solve this, called a PRT (or Primary Refresh Token). It works for AD Joined, Hybrid, or Entra-only devices, so no excuses.
๐๐จ๐ฎ ๐ฆ๐๐ฒ ๐ญ๐ก๐ข๐ง๐ค ๐ฎ๐ฌ๐๐ซ๐ฌ ๐๐จ๐ง'๐ญ ๐ก๐๐ฏ๐ ๐ฌ๐ฎ๐ฉ๐ฉ๐จ๐ซ๐ญ๐๐ ๐๐๐ฏ๐ข๐๐๐ฌ (๐จ๐ซ ๐ข๐ญ๐ฌ ๐ญ๐จ๐จ ๐ข๐ฆ๐ฉ๐๐๐ญ๐๐ฎ๐ฅ)
No, misconception. Plenty of platforms let you to federate your logins to offer custom authentication options. Like QR code badges, which satisfy MFA through your webcam.
๐๐ข๐ ๐ฒ๐จ๐ฎ ๐๐จ๐ซ๐ ๐๐ญ ๐๐๐จ๐ฎ๐ญ ๐ฉ๐จ๐ฐ๐๐ซ๐๐ฎ๐ฅ ๐๐๐ฏ๐ข๐๐-๐๐๐ฌ๐๐ ๐๐จ๐ง๐๐ข๐ญ๐ข๐จ๐ง๐๐ฅ ๐๐๐๐๐ฌ๐ฌ ๐๐๐๐ญ๐ฎ๐ซ๐๐ฌ?
Requiring device compliance in Conditional Access is non-interruptive for users, but acts as a highly impactful "second factor".
#Entra #Microsoft
D Lind retweeted
๐
๐ Quick update on public projects before summer
๐งฟ ๐๐ป๐๐ฟ๐ฎ ๐๐ ๐๐ป๐๐ถ๐ด๐ต๐ โ fresh round of bug fixes for a cleaner, sharper and more reliable solution โ github.com/emiliensocchi/entโฆ
(1/4)
D Lind retweeted
Another day, another bad set of CIS recommendations
Here are the items you do not want to do in this list:
5.1.5.6 - Ensure maximum certificate lifetime for applications does not exceed 180 days
โ ๏ธ This will silently break cert renewal for all of your SAML based SSO apps...
D Lind retweeted
Entra Connect v2.6.79.0 was just released and contains undisclosed security fixes and @Microsoft recommends to update fast. On the bright side, it will finally support FIDO2 based authentication!
D Lind retweeted
Folks, I just released Lokka 2.0 today!
The world's first Microsoft Graph MCP server is now a full blown MCP App.
First up multi-tenant support. You can now sign into more than one tenant.
What does it mean?
1/16
D Lind retweeted
1/ We are sharing additional details regarding our investigation into unauthorized access to GitHub's internal repositories.
Yesterday we detected and contained a compromise of an employee device involving a poisoned VS Code extension. We removed the malicious extension version, isolated the endpoint, and began incident response immediately.
D Lind retweeted
Entra App Proxy continues to be one of the biggest hidden gems of Entra P1
For over a decade, we've been able to stop exposing risky apps to the Internet by routing through agents with outbound connections to Azure
I don't care what vendor you use, just get it off the Internet
