Russ

Next to token theft for bypassing MFA, this should be your next legitimate concern in the cloud. - residential proxies can give attackers leverage to do unlimited amounts of password spraying. - Blended attacks can be very difficult to detect because the attacker can reside in the same geolocation as the victim. What can you do about it? - require device compliance in CAP - if on AD required hybrid Entra ID join - FIDO2 all admins with RBAC roles. - if using P2 implement identity protection in CAP - emergency accounts with elevated privileges should be the only ones excluded from CAP - lock down service accounts where they can only operate from trusted IPs in CAP. - block unknown and unsupported devices Identity protection has some cool features such as suspicious API abuse protection. Yes, attackers are abusing graph API for reconnaissance purposes. So if you have P2 use it. Why do all this? Attackers will conduct their early operations from the outside to gain a foothold on an internal environment. So if an attacker calls the helpdesk to reset an employee with privileged access, they still won’t get in since they lack a device requirement to satisfy conditional access. Phishing attacks will be in the same boat. This will ultimately cause an attacker to pivot with a C2 implant which could be risky if an enterprise is doing all the above. 😎