Sami Lamppu
@samilamppu.bsky.social
Pinned
Sami Lamppu
@samilamppu.bsky.social
· Nov 26
Microsoft Entra ID Attack & Defense Playbook with Sami Lamppu
YouTube video by Thomas Naunheim
youtu.be
Celebrating 4 years of the "#MicrosoftEntra Attack & Defense Playbook" 🔐 ☁️ community project! Last week, we (@naunheim.cloud & I) were in Chicago, and we took the opportunity to record a video about this project's journey.
#MVPBuzz #TechCommunity
youtu.be/fBD1ftf0PbA?...
#MVPBuzz #TechCommunity
youtu.be/fBD1ftf0PbA?...
Reposted by Sami Lamppu
Had the great privilege and a lot of fun joining 🎙️#EntraChat together with my friend and MVP fellow @samilamppu.bsky.social!
🙏 Big thanks to @merill.net for having us - it was a pleasure to be part of the podcast. I hope everyone listening enjoyed it as much as we did recording it!
🙏 Big thanks to @merill.net for having us - it was a pleasure to be part of the podcast. I hope everyone listening enjoyed it as much as we did recording it!
Thomas Naunheim and Sami Lamppu quietly built one of the most useful open projects for Entra ID defenders.
The Entra ID Attack & Defense Playbook
It’s free, community-driven, and packed with real detection logic and KQL queries.
🧵👇
The Entra ID Attack & Defense Playbook
It’s free, community-driven, and packed with real detection logic and KQL queries.
🧵👇
November 2, 2025 at 10:15 AM
Had the great privilege and a lot of fun joining 🎙️#EntraChat together with my friend and MVP fellow @samilamppu.bsky.social!
🙏 Big thanks to @merill.net for having us - it was a pleasure to be part of the podcast. I hope everyone listening enjoyed it as much as we did recording it!
🙏 Big thanks to @merill.net for having us - it was a pleasure to be part of the podcast. I hope everyone listening enjoyed it as much as we did recording it!
Great chat with Merill Fernando on Entra Chat! We (Thomas Naunheim & I) shared some favorite findings and stories from the past years working with Entra ID Attack & Defense Playbook. Link to the full episode below👇
Thomas Naunheim and Sami Lamppu quietly built one of the most useful open projects for Entra ID defenders.
The Entra ID Attack & Defense Playbook
It’s free, community-driven, and packed with real detection logic and KQL queries.
🧵👇
The Entra ID Attack & Defense Playbook
It’s free, community-driven, and packed with real detection logic and KQL queries.
🧵👇
November 1, 2025 at 3:07 PM
Great chat with Merill Fernando on Entra Chat! We (Thomas Naunheim & I) shared some favorite findings and stories from the past years working with Entra ID Attack & Defense Playbook. Link to the full episode below👇
Reposted by Sami Lamppu
Thomas Naunheim and Sami Lamppu quietly built one of the most useful open projects for Entra ID defenders.
The Entra ID Attack & Defense Playbook
It’s free, community-driven, and packed with real detection logic and KQL queries.
🧵👇
The Entra ID Attack & Defense Playbook
It’s free, community-driven, and packed with real detection logic and KQL queries.
🧵👇
November 1, 2025 at 11:14 AM
Thomas Naunheim and Sami Lamppu quietly built one of the most useful open projects for Entra ID defenders.
The Entra ID Attack & Defense Playbook
It’s free, community-driven, and packed with real detection logic and KQL queries.
🧵👇
The Entra ID Attack & Defense Playbook
It’s free, community-driven, and packed with real detection logic and KQL queries.
🧵👇
Whoop!, Whoop 🎉 I've earned my 5th consecutive MVP award! Now is a great time to start my vacation and think about security and AI stuff next time in August!
July 11, 2025 at 5:08 AM
Whoop!, Whoop 🎉 I've earned my 5th consecutive MVP award! Now is a great time to start my vacation and think about security and AI stuff next time in August!
New in #DefenderXDR advanced hunting: Automatic Attack Disruption events are now in the DisruptionAndResponseEvents table! 🛡️
- Includes both block & policy-application events from disruption policies, plus auto-response actions across related workloads
- Boost visibility into complex attacks
- Includes both block & policy-application events from disruption policies, plus auto-response actions across related workloads
- Boost visibility into complex attacks
July 4, 2025 at 2:21 PM
New in #DefenderXDR advanced hunting: Automatic Attack Disruption events are now in the DisruptionAndResponseEvents table! 🛡️
- Includes both block & policy-application events from disruption policies, plus auto-response actions across related workloads
- Boost visibility into complex attacks
- Includes both block & policy-application events from disruption policies, plus auto-response actions across related workloads
- Boost visibility into complex attacks
Spent the week test-driving the Microsoft Learn Docs MCP server with the Claude desktop. Fast, precise document look-ups make it easy to ground answers in official Microsoft content.
Links:
- github.com/microsoftdoc...
- techcommunity.microsoft.com/blog/azurede...
Links:
- github.com/microsoftdoc...
- techcommunity.microsoft.com/blog/azurede...
Building an MCP Server for Microsoft Learn | Microsoft Community Hub
So why Microsoft Learn? Well, it's a treasure trove of knowledge for developers and IT pros. Secondly, because it has search page with many filters, it lends...
techcommunity.microsoft.com
June 26, 2025 at 11:30 AM
Spent the week test-driving the Microsoft Learn Docs MCP server with the Claude desktop. Fast, precise document look-ups make it easy to ground answers in official Microsoft content.
Links:
- github.com/microsoftdoc...
- techcommunity.microsoft.com/blog/azurede...
Links:
- github.com/microsoftdoc...
- techcommunity.microsoft.com/blog/azurede...
I tried #Lokka MCP server made by @merill.net . Lokka bridges Claude to Entra/Azure via Microsoft Graph.
I exported Entra security settings through APIs, parsed CA policies, and drafted a report with the Claude desktop. Early days, but looks promising! #CloudSec #MCP
lokka.dev/docs/intro/
I exported Entra security settings through APIs, parsed CA policies, and drafted a report with the Claude desktop. Early days, but looks promising! #CloudSec #MCP
lokka.dev/docs/intro/
June 24, 2025 at 9:57 AM
I tried #Lokka MCP server made by @merill.net . Lokka bridges Claude to Entra/Azure via Microsoft Graph.
I exported Entra security settings through APIs, parsed CA policies, and drafted a report with the Claude desktop. Early days, but looks promising! #CloudSec #MCP
lokka.dev/docs/intro/
I exported Entra security settings through APIs, parsed CA policies, and drafted a report with the Claude desktop. Early days, but looks promising! #CloudSec #MCP
lokka.dev/docs/intro/
Storm-2372 conducts a device code phishing campaign.
Update on Feb 14, 2025: 'Within the past 24 hours, MS has observed Storm-2372 shifting to using the specific client ID for MS AuthBroker in the device code sign-in flow. Read the full story below 👇
www.microsoft.com/en-us/securi...
Update on Feb 14, 2025: 'Within the past 24 hours, MS has observed Storm-2372 shifting to using the specific client ID for MS AuthBroker in the device code sign-in flow. Read the full story below 👇
www.microsoft.com/en-us/securi...
Storm-2372 conducts device code phishing campaign | Microsoft Security Blog
Microsoft Threat Intelligence Center discovered an active and successful device code phishing campaign by a threat actor we track as Storm-2372. Our ongoing investigation indicates that this campaign ...
www.microsoft.com
February 17, 2025 at 7:07 AM
Storm-2372 conducts a device code phishing campaign.
Update on Feb 14, 2025: 'Within the past 24 hours, MS has observed Storm-2372 shifting to using the specific client ID for MS AuthBroker in the device code sign-in flow. Read the full story below 👇
www.microsoft.com/en-us/securi...
Update on Feb 14, 2025: 'Within the past 24 hours, MS has observed Storm-2372 shifting to using the specific client ID for MS AuthBroker in the device code sign-in flow. Read the full story below 👇
www.microsoft.com/en-us/securi...
The BadPilot campaign: Seashell Blizzard subgroup conducts multiyear global access operation
www.microsoft.com/en-us/securi...
www.microsoft.com/en-us/securi...
The BadPilot campaign: Seashell Blizzard subgroup conducts multiyear global access operation | Microsoft Security Blog
Microsoft is publishing for the first time our research into a subgroup within the Russian state actor Seashell Blizzard and its multiyear initial access operation, tracked by Microsoft Threat Intelli...
www.microsoft.com
February 14, 2025 at 8:29 AM
The BadPilot campaign: Seashell Blizzard subgroup conducts multiyear global access operation
www.microsoft.com/en-us/securi...
www.microsoft.com/en-us/securi...
Next-Gen Device Incident Investigation & Threat Hunting with Custom Plugins in #Securitycopilot
techcommunity.microsoft.com/blog/securit...
techcommunity.microsoft.com/blog/securit...
Next-Gen Device Incident Investigation & Threat Hunting with Custom Plugins | Microsoft Community Hub
The Security Copilot custom plugin empowers you to extend Security Copilot functionalities beyond the preinstalled and...
techcommunity.microsoft.com
February 11, 2025 at 5:49 AM
Next-Gen Device Incident Investigation & Threat Hunting with Custom Plugins in #Securitycopilot
techcommunity.microsoft.com/blog/securit...
techcommunity.microsoft.com/blog/securit...
Reposted by Sami Lamppu
EntraOps repository:
github.com/Cloud-Archit...
Learn more about XSPM and Graph:
Deep Dive blog post on XSPM by @samilamppu.bsky.social
samilamppu.com/2024/04/25/m...
Blog posts by @fabian.bader.cloud
cloudbrothers.info/en/workshop-...
cloudbrothers.info/en/find-late...
Kusto Graph rocks! (3/3)
github.com/Cloud-Archit...
Learn more about XSPM and Graph:
Deep Dive blog post on XSPM by @samilamppu.bsky.social
samilamppu.com/2024/04/25/m...
Blog posts by @fabian.bader.cloud
cloudbrothers.info/en/workshop-...
cloudbrothers.info/en/find-late...
Kusto Graph rocks! (3/3)
LinkedIn
This link will take you to a page that’s not on LinkedIn
lnkd.in
January 29, 2025 at 6:47 AM
EntraOps repository:
github.com/Cloud-Archit...
Learn more about XSPM and Graph:
Deep Dive blog post on XSPM by @samilamppu.bsky.social
samilamppu.com/2024/04/25/m...
Blog posts by @fabian.bader.cloud
cloudbrothers.info/en/workshop-...
cloudbrothers.info/en/find-late...
Kusto Graph rocks! (3/3)
github.com/Cloud-Archit...
Learn more about XSPM and Graph:
Deep Dive blog post on XSPM by @samilamppu.bsky.social
samilamppu.com/2024/04/25/m...
Blog posts by @fabian.bader.cloud
cloudbrothers.info/en/workshop-...
cloudbrothers.info/en/find-late...
Kusto Graph rocks! (3/3)
Unified Device Timeline Experience in Microsoft SIEM + XDR
techcommunity.microsoft.com/blog/microso...
techcommunity.microsoft.com/blog/microso...
Introducing the Unified Device Timeline Experience in Microsoft SIEM + XDR | Microsoft Community Hub
We are thrilled to announce the launch of the Unified Device Timeline, a feature that integrates device activity timelines from Microsoft Sentinel and...
techcommunity.microsoft.com
February 5, 2025 at 7:17 AM
Unified Device Timeline Experience in Microsoft SIEM + XDR
techcommunity.microsoft.com/blog/microso...
techcommunity.microsoft.com/blog/microso...
Sentinel Content Hub leverages AI technology in the new search capability. Check out below how
techcommunity.microsoft.com/blog/microso...
techcommunity.microsoft.com/blog/microso...
What’s new: Find the Sentinel content you need using AI search | Microsoft Community Hub
Overview
Getting value from Microsoft Sentinel and the Microsoft Unified Security Operations Platform requires deploying the right solutions. Microsoft and...
techcommunity.microsoft.com
February 3, 2025 at 2:14 PM
Sentinel Content Hub leverages AI technology in the new search capability. Check out below how
techcommunity.microsoft.com/blog/microso...
techcommunity.microsoft.com/blog/microso...
Speed up incident triage with Security Copilot and Microsoft Sentinel
techcommunity.microsoft.com/blog/securit...
techcommunity.microsoft.com/blog/securit...
Boost SOC automation with AI: Speed up incident triage with Security Copilot and Microsoft Sentinel | Microsoft Community Hub
The Solution
This solution leverages AI and automation to speed up incident triage by providing automated response to an incident while infusing AI reasoning...
techcommunity.microsoft.com
January 28, 2025 at 5:28 AM
Speed up incident triage with Security Copilot and Microsoft Sentinel
techcommunity.microsoft.com/blog/securit...
techcommunity.microsoft.com/blog/securit...
Hunt for identity-based threats with Security Copilot and Microsoft Sentinel
techcommunity.microsoft.com/blog/securit...
techcommunity.microsoft.com/blog/securit...
Hunt for identity-based threats with Security Copilot and Microsoft Sentinel | Microsoft Community Hub
Enter Microsoft Sentinel and Security Copilot, a powerful duo that brings great value to your security operations. Microsoft Sentinel's User and Entity...
techcommunity.microsoft.com
January 23, 2025 at 5:11 AM
Hunt for identity-based threats with Security Copilot and Microsoft Sentinel
techcommunity.microsoft.com/blog/securit...
techcommunity.microsoft.com/blog/securit...
Blog summarizes the three takeaways from the Microsoft AI Red team white paper: 'Lessons from
red teaming 100 generative AI products'
www.microsoft.com/en-us/securi...
red teaming 100 generative AI products'
www.microsoft.com/en-us/securi...
3 takeaways from red teaming 100 generative AI products | Microsoft Security Blog
The growing sophistication of AI systems and Microsoft’s increasing investment in AI have made red teaming more important than ever. Learn more.
www.microsoft.com
January 18, 2025 at 9:03 AM
Blog summarizes the three takeaways from the Microsoft AI Red team white paper: 'Lessons from
red teaming 100 generative AI products'
www.microsoft.com/en-us/securi...
red teaming 100 generative AI products'
www.microsoft.com/en-us/securi...
Reposted by Sami Lamppu
#MicrosoftEntra Attack & Defense Playbook Update:
@samilamppu.bsky.social and I have updated some content:
🔃 #EntraConnect: New capabilities by MDI sensor & XSPM
🎯 #AiTM: Attack scenarios on MDA sessions
🛡️ #MITRE: Updated TTP coverage & map
Check out the latest version:
github.com/Cloud-Archit...
@samilamppu.bsky.social and I have updated some content:
🔃 #EntraConnect: New capabilities by MDI sensor & XSPM
🎯 #AiTM: Attack scenarios on MDA sessions
🛡️ #MITRE: Updated TTP coverage & map
Check out the latest version:
github.com/Cloud-Archit...
GitHub - Cloud-Architekt/AzureAD-Attack-Defense: This publication is a collection of various common attack scenarios on Microsoft Entra ID (formerly known as Azure Active Directory) and how they can b...
This publication is a collection of various common attack scenarios on Microsoft Entra ID (formerly known as Azure Active Directory) and how they can be mitigated or detected. - Cloud-Architekt/Azu...
github.com
January 9, 2025 at 8:00 AM
#MicrosoftEntra Attack & Defense Playbook Update:
@samilamppu.bsky.social and I have updated some content:
🔃 #EntraConnect: New capabilities by MDI sensor & XSPM
🎯 #AiTM: Attack scenarios on MDA sessions
🛡️ #MITRE: Updated TTP coverage & map
Check out the latest version:
github.com/Cloud-Archit...
@samilamppu.bsky.social and I have updated some content:
🔃 #EntraConnect: New capabilities by MDI sensor & XSPM
🎯 #AiTM: Attack scenarios on MDA sessions
🛡️ #MITRE: Updated TTP coverage & map
Check out the latest version:
github.com/Cloud-Archit...
Together with @naunheim.cloud we did the following updates on Entra ID Attack & Defense Playbook:
Entra Connect: Added MDI enhancements and XSPM queries
AiTM: MDA section with Edge In-browser
MITRE: Updated heat map & TTPs
Check out the latest version 👉 github.com/Cloud-Archit...
Entra Connect: Added MDI enhancements and XSPM queries
AiTM: MDA section with Edge In-browser
MITRE: Updated heat map & TTPs
Check out the latest version 👉 github.com/Cloud-Archit...
GitHub - Cloud-Architekt/AzureAD-Attack-Defense: This publication is a collection of various common attack scenarios on Microsoft Entra ID (formerly known as Azure Active Directory) and how they can b...
This publication is a collection of various common attack scenarios on Microsoft Entra ID (formerly known as Azure Active Directory) and how they can be mitigated or detected. - Cloud-Architekt/Azu...
github.com
January 9, 2025 at 8:14 AM
Together with @naunheim.cloud we did the following updates on Entra ID Attack & Defense Playbook:
Entra Connect: Added MDI enhancements and XSPM queries
AiTM: MDA section with Edge In-browser
MITRE: Updated heat map & TTPs
Check out the latest version 👉 github.com/Cloud-Archit...
Entra Connect: Added MDI enhancements and XSPM queries
AiTM: MDA section with Edge In-browser
MITRE: Updated heat map & TTPs
Check out the latest version 👉 github.com/Cloud-Archit...
Leveraging ASIM-based KQL plugins in Microsoft Security Copilot for investigation scenarios
techcommunity.microsoft.com/blog/securit...
techcommunity.microsoft.com/blog/securit...
Leveraging ASIM-based KQL plugins in Microsoft Security Copilot for investigation scenarios | Microsoft Community Hub
Microsoft Security Copilot enhances the capabilities of Microsoft Sentinel by providing an AI-driven assistant that can help interpret complex hunting query...
techcommunity.microsoft.com
December 20, 2024 at 6:27 AM
Leveraging ASIM-based KQL plugins in Microsoft Security Copilot for investigation scenarios
techcommunity.microsoft.com/blog/securit...
techcommunity.microsoft.com/blog/securit...
Looking for how to audit Security Copilot activities? Great Techcommunity blog explains how.
Monitor user activities & system events with Security Copilot and Sentinel 👇
techcommunity.microsoft.com/blog/securit...
Monitor user activities & system events with Security Copilot and Sentinel 👇
techcommunity.microsoft.com/blog/securit...
Monitor User Activities and System Events with Security Copilot and Microsoft Sentinel | Microsoft Community Hub
We do recommend you read through the our Privacy and data security document to understand more about what data we are capturing Privacy and data security as...
techcommunity.microsoft.com
December 17, 2024 at 5:36 AM
Looking for how to audit Security Copilot activities? Great Techcommunity blog explains how.
Monitor user activities & system events with Security Copilot and Sentinel 👇
techcommunity.microsoft.com/blog/securit...
Monitor user activities & system events with Security Copilot and Sentinel 👇
techcommunity.microsoft.com/blog/securit...
Unified SOC Operations Platform latest enhancement: Use Sentinel Workbooks directly from the Defender XDR portal
techcommunity.microsoft.com/blog/microso...
techcommunity.microsoft.com/blog/microso...
What's New: View Microsoft Sentinel Workbooks Directly from Unified SOC Operations Platform | Microsoft Community Hub
Key Benefits
Unified Viewing Experience: Microsoft Sentinel workbook templates and saved workbooks can now be accessed directly within the...
techcommunity.microsoft.com
December 15, 2024 at 5:57 AM
Unified SOC Operations Platform latest enhancement: Use Sentinel Workbooks directly from the Defender XDR portal
techcommunity.microsoft.com/blog/microso...
techcommunity.microsoft.com/blog/microso...
#MSUGFI aka 'Microsoft Security User Group Finland' kokoontuu seuraavan kerran keskiviikkona 15.1.2024 klo 17:00, jolloin hostina toimii Arrow ECS.
Vielä olisi muutama paikka vapaana, jos event kiinnostaa nappaa itsellesi sisäänpääsy tapahtumaan linkin takaa 👇
www.meetup.com/microsoft-se...
Vielä olisi muutama paikka vapaana, jos event kiinnostaa nappaa itsellesi sisäänpääsy tapahtumaan linkin takaa 👇
www.meetup.com/microsoft-se...
MSUG #5: Arrow ECS, Wed, Jan 15, 2025, 5:00 PM | Meetup
Microsoft Security User Group Finlandin tammikuun tapahtuma järjestetään [Arrow ECS:llä](https://www.arrow.com/globalecs/fi/). Tule mukaan osallistumaan, kuulemaan, pohtima
www.meetup.com
December 11, 2024 at 10:15 AM
#MSUGFI aka 'Microsoft Security User Group Finland' kokoontuu seuraavan kerran keskiviikkona 15.1.2024 klo 17:00, jolloin hostina toimii Arrow ECS.
Vielä olisi muutama paikka vapaana, jos event kiinnostaa nappaa itsellesi sisäänpääsy tapahtumaan linkin takaa 👇
www.meetup.com/microsoft-se...
Vielä olisi muutama paikka vapaana, jos event kiinnostaa nappaa itsellesi sisäänpääsy tapahtumaan linkin takaa 👇
www.meetup.com/microsoft-se...
