bit-ronin.bsky.social
@bit-ronin.bsky.social
Reposted
Red Teamers, I'm starting off my bsky tips with a banger: using pending file change operations in the Registry to rename executables and indirectly disable AV/EDR!

If the EDR has tamper protection, make a junction to the EXE first!

Here's your PowerShell command: pastebin.com/Jikaicm1
AV/EDR Disable via File Rename Operations in the Registry - Pastebin.com
Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.
pastebin.com
January 23, 2025 at 4:35 PM
Reposted
In this video, I share a PowerShell script to back up CA policies. Protect your configurations—stay safe from accidental changes or cyberattacks!

Take control of your security and stay prepared! 🔒

youtu.be/3zgsyWFhAnM

#EntraID #Microsoft #Security #YouTubeVideo
Entra ID - Export Conditional Access Policies
YouTube video by Julian Rasmussen MVP
youtu.be
February 28, 2025 at 2:38 PM
Reposted
Miss last week's Defender and Sentinel newsletter? Catch up now!

Microsoft SIEM and XDR Weekly Wrap - Issue #21 microsoftdefender.su...

#MicrosoftSentinel #Cybersecurity #MicrosoftSecurity #Security #DefenderXDR #MicrosoftDefender #MicrosoftThreatIntelligence
January 14, 2025 at 8:00 AM
Reposted
January 10, 2025 at 12:30 PM
Reposted
Entra Private Access: Creating New Connectors Made Easy
Full video: https://buff.ly/40k4S8t
#Microsoft #Azure #EntraID #CloudComputing #NetworkSecurity #TechTutorial #MVPBuzz
January 10, 2025 at 4:00 PM
Reposted
Why should you do this?

You get the option to protect your resources behind the compliant network control by configuring a Conditional Access policy
-> learn.microsoft.com/en-us/entra/...

This policy is regarding to my tests really powerful to protect against replayed tokens.

3/4
Enable Compliant Network Check with Conditional Access - Global Secure Access
Learn how to require known compliant network locations in order to connect to your secured resources with Conditional Access.
learn.microsoft.com
January 10, 2025 at 7:09 PM
Reposted
Global Secure Access and Token Replay - a thread...

Did you know that "Microsoft Entra Internet Access for Microsoft" is included in your Entra ID P1 license?
-> learn.microsoft.com/en-us/entra/...

1/4
What is Global Secure Access? - Global Secure Access
Learn how Microsoft's Security Service Edge (SSE) solution, Global Secure Access, provides network access control and visibility to users and devices inside and outside a traditional office.
learn.microsoft.com
January 10, 2025 at 7:09 PM
Reposted
Cybersecurity for Beginners – a curriculum

🔗 microsoft.github.io/Security-101...

This course is designed to teach you fundamental cyber security concepts to kick-start your security learning. It is vendor agnostic and is divided into small lessons.

#Security #CyberSecurity #MicrosoftSecurity
January 11, 2025 at 4:08 PM
Reposted
ADFS — Living in the Legacy of DRS

ADFS (Active Directory Federation Services) is still widely used despite Microsoft's efforts to move customers to Entra ID. ADFS has an OAuth2 provider under the hood, which is often overlooked in favor of SAML token generation. To set…

#hackernews #microsoft #ml
ADFS — Living in the Legacy of DRS
ADFS (Active Directory Federation Services) is still widely used despite Microsoft's efforts to move customers to Entra ID. ADFS has an OAuth2 provider under the hood, which is often overlooked in favor of SAML token generation. To set up an OAuth2 integration in ADFS, you create an Application Group and configure a client and server. The Client Identifier is used to identify the client configuration, and you need to configure CORS to allow the client to make requests to ADFS. Device Registration Services (DRS) is a feature in ADFS that allows devices to register and authenticate with the service. DRS is often used in Entra ID Hybrid Join scenarios, but it can also be used standalone on-premises. To enable DRS, you need to deploy the prerequisites in Active Directory and configure the Device Authentication method. ADFS has different authentication methods, including Forms Authentication, Windows Authentication, and Device Authentication, which can be enabled or disabled depending on the configuration. The Device Authentication method can be enumerated by making requests to the ADFS endpoint with specific parameters. The msDS-Device object in LDAP stores information about registered devices, including the public key of the Device Authentication certificate and the SID of the user account used to create the device registration.
securityboulevard.com
January 11, 2025 at 5:15 PM
Reposted
🚀 I've written a #Azure #Automation #Runbook to check expiring #Clientsecrets and #Certificates on #Entra #Applications with #Email notification to owners
bit.ly/4gPjBhs
January 11, 2025 at 7:14 AM
Reposted
Reposted
Do you have to do everything in cybersecurity right away?

No!

Security is a journey and something that you do (not something you have).

There is (and always will be) more to be done than anyone can plan and execute in the short term.
November 24, 2024 at 4:56 PM
Reposted
🚨Local Administrator Protection

This new feature introduces a hidden, just-in-time elevation mechanism that unlocks admin rights only when needed instead of using the legacy admin approval mode (Spit-Token AKA Clark Kent mode).Curious how it works?

patchmypc.com/local-admini...

#Intune #Windows11
November 9, 2024 at 10:49 AM
Reposted
I wrote a blog for Practical 365 about the Conditional Access Blueprint; an open-source security framework I developed. Check it out!

practical365.com/four-practic...
Four Practical Tools and Strategies for Success with Conditional Access Policies
Many organizations still find it challenging to implement Conditional Access effectively. Luckily, there is a solution for this. In this blog, we share a new open-source framework, introducing 4 tools...
practical365.com
November 9, 2024 at 7:05 AM
Reposted
Microsoft Zero Trust Workshop - Youtube PlayList

A comprehensive technical guide to help customers and partners adopt a Zero Trust strategy and deploy security solutions end-to-end to secure their organizations.

#MicrosoftSecurity

youtube.com/playlist?lis...
Microsoft Zero Trust Workshop - YouTube
youtube.com
November 9, 2024 at 5:13 PM