@yellowhat_live Lets go!!!
English
๐๐ฐ๐ฐ๐ด ๐๐ฐ๐ฐ๐ด๐ด๐ฆ๐ฏ๐ด
884 posts
๐๐ฐ๐ฐ๐ด ๐๐ฐ๐ฐ๐ด๐ด๐ฆ๐ฏ๐ด
@KoosGoossens
Microsoft Security MVP | Photographer | Watch nerd | Pinball enthusiast | BBQ Grillmaster
The Netherlands ๊ฐ์
์ผ Temmuz 2010
155 ํ๋ก์293 ํ๋ก์
๐๐ฐ๐ฐ๐ด ๐๐ฐ๐ฐ๐ด๐ด๐ฆ๐ฏ๐ด ๋ฆฌํธ์ํจ
I usually don't drink on weekdays, but hear me out:
Over the weekend, I thought about a common conditional access misconfiguration I often see in the wild. I decided to write a blog post about it, but that got me thinking: Is that the best way to reach as many tenant admins as possible?
That gave me the following idea: What if I write a ๐ฅMaester test for it?
Now, as a non-developer, that might be out of your comfort zone, but with the help of @merill and @Thomas_Live, I quickly got this new test added to the existing repository, ready to hit hundreds or thousands of tenants.
Dare to (th)(dr)ink different. ๐ฅ
๐ [Blogpost] janbakker.tech/conditional-acโฆ
๐ [Contribute to Maester] maester.dev/docs/contributโฆ
English
๐๐ฐ๐ฐ๐ด ๐๐ฐ๐ฐ๐ด๐ด๐ฆ๐ฏ๐ด ๋ฆฌํธ์ํจ
โจ Session Announcement: Build your security data lake with Microsoft Sentinel & Data Explorer; a match made in Azure! โ๏ธ๐โจ
๐ค Get ready for a VIP experience with the legendary @KoosGoossens, Microsoft Security MVP & Cloud Wizard @ Wortell! He's spilling the tea on turbo-charged, budget-friendly log storage tricks that'll have your data spinning into the future.
๐๏ธ March 5, 2025 - mark your calendars for an epic showdown of code and Hollywood glamour at VUE! ๐ฅ๐ซ
๐๏ธ VIPs, let's light up the cloud! ๐ฅ๐ Tickets are flying - catch yours now and join the hype! ๐๐ conference.expertslive.dk
#ELDK2025 #ExpertsLiveDK #Microsoft #Community #Security #Azure #AI #ModernWorkplace #Intune #DevOps #Automation #M365 #PowerPlatform #Data #Purview #Development #OpenAI #Copilot #AVD #W365 #Identity #Entra
ELDK2025 Organizers:
Morten Knudsen (@knudsenmortendk) Thomas Poppelgaard (@_POPPELGAARD) Martin Byskov (@ByzzByskov) Henrik Wojcik (@henrikwojcik) Heine Madsen (@HeineKoldbro) Kent Agerlund (@agerlund)
English
๐๐ฐ๐ฐ๐ด ๐๐ฐ๐ฐ๐ด๐ด๐ฆ๐ฏ๐ด ๋ฆฌํธ์ํจ
Investigating Microsoft 365? The Unified Audit Log (UAL) is your go-to for tracking user and admin activities. Learn how to leverage it for security insights and compliance.
๐ Read more: cyberdom.blog/microsoft-365-โฆ
English
๐๐ฐ๐ฐ๐ด ๐๐ฐ๐ฐ๐ด๐ด๐ฆ๐ฏ๐ด ๋ฆฌํธ์ํจ
@HEXiT___ I put some notes here that hopefully explain it - github.com/reprise99/4688โฆ
English
๐๐ฐ๐ฐ๐ด ๐๐ฐ๐ฐ๐ด๐ด๐ฆ๐ฏ๐ด ๋ฆฌํธ์ํจ
One of our very smart Active Directory experts has been putting together a series of blog posts about hardening AD. Already into its 7th installment, it covers SMB hardening, disabling NTLMv1, least privilege and more. Check the series out - techcommunity.microsoft.com/tag/adhardening
English
๐๐ฐ๐ฐ๐ด ๐๐ฐ๐ฐ๐ด๐ด๐ฆ๐ฏ๐ด ๋ฆฌํธ์ํจ
Great reminder for anyone wanting to enrich their Kusto queries with additional information. If you are after enrichment such as geo info for IPs, ASN lookup info, tor exit node data and more, then have a look below. The KQL is already written for you - firewalliplists.gypthecat.com/kusto-tables/
Aura@SecurityAura
A special thanks to @reprise_99 who showed me @gypthecatdotcom and it's Kusto ASN Table lists and references! Definitely something everyone should be aware of and start using in their queries for enrichment and additional filtering opportunities! firewalliplists.gypthecat.com/kusto-tables/
English
๐๐ฐ๐ฐ๐ด ๐๐ฐ๐ฐ๐ด๐ด๐ฆ๐ฏ๐ด ๋ฆฌํธ์ํจ
A new dedicated resource application to enable Active Directory to Microsoft Entra ID sync using Microsoft Entra Connect Sync or Cloud Sync is coming ๐ฑ
In the announcement the mentioned reason is "upcoming security hardening"...
6bf85cfa-ac8a-4be5-b5de-425a0d0dc016
#EntraID
English
๐๐ฐ๐ฐ๐ด ๐๐ฐ๐ฐ๐ด๐ด๐ฆ๐ฏ๐ด ๋ฆฌํธ์ํจ
everyday df3ndr episode 01x01 is out now! df3ndr.io/episodes/2024/โฆ /cc @KoosGoossens
English
๐๐ฐ๐ฐ๐ด ๐๐ฐ๐ฐ๐ด๐ด๐ฆ๐ฏ๐ด ๋ฆฌํธ์ํจ
@KoosGoossens and I have been working on this for a few months now and while he is away at ESPC24 in Stockholm this week, I thought I'd share this intro - df3ndr.io/episodes/2024/โฆ
Join us for the first of many episodes, coming soon to your favorite podcast player.
English
๐๐ฐ๐ฐ๐ด ๐๐ฐ๐ฐ๐ด๐ด๐ฆ๐ฏ๐ด ๋ฆฌํธ์ํจ
For all #KQL fans, I had this list of community repos lying around, the list now consists of 33 repos for you to investigate. Happy hunting! ๐น
Feel free to send a PR if you miss repos! :)
github.com/Bert-JanP/Huntโฆ
English
๐๐ฐ๐ฐ๐ด ๐๐ฐ๐ฐ๐ด๐ด๐ฆ๐ฏ๐ด ๋ฆฌํธ์ํจ
New blogpost! Learn how to register Yubikeys on behalf of your users!
janbakker.tech/register-yubikโฆ
English
๐๐ฐ๐ฐ๐ด ๐๐ฐ๐ฐ๐ด๐ด๐ฆ๐ฏ๐ด ๋ฆฌํธ์ํจ
The latest @TheCloudArch episode is now live - thanks to @KoosGoossens @jeroenniesen @maarten_goet for being our guests (and cooking dinner!) - Episode 92: Dutch! (thearchitects.cloud)
English
๐๐ฐ๐ฐ๐ด ๐๐ฐ๐ฐ๐ด๐ด๐ฆ๐ฏ๐ด ๋ฆฌํธ์ํจ
Who doesn't want to learn about #security? ๐
Come to #ExpertsLiveEU to hear from @KoosGoossens and learn how to build your security data lake with #MicrosoftSentitel & #DataExplorer: a match made in #Azure.
๐
Sept 24-25 Main Conference
๐ Budapest, Hungary
๐ expertslive.eu
English
๐๐ฐ๐ฐ๐ด ๐๐ฐ๐ฐ๐ด๐ด๐ฆ๐ฏ๐ด ๋ฆฌํธ์ํจ
Wrote a new blog on how to set up Microsoft Defender for External Attack Surface Management. Hope itโs of use to someone out there.
security-ninja.com/post/configuriโฆ
English
@nickchapsas I had the exact same issue! The requirements are incorrect. 15 characters max. #thecakeisalie ๐
English
Must be in Ancient Greek
Must have 2 emojis
Must be a palindrome
Must be created after the sacrifice of a sacred deer
Must
English
@mikecybersec @fabian_bader Because we cannot trigger Functions from Sentinel automation. And triggering a Function from a Logic Apps, and bringing back the response to that Logic App is even more ugly. ๐
English
๐๐ฐ๐ฐ๐ด ๐๐ฐ๐ฐ๐ด๐ด๐ฆ๐ฏ๐ด ๋ฆฌํธ์ํจ
Run PowerShell in a Logic Apps
That's a game changer and will make it possible to use logic apps even for more complex tasks
techcommunity.microsoft.com/t5/azure-integโฆ
English
@fabian_bader @olafhartong Thatโs easy. Deploy Logic Apps from code and make sure nobody had write access to the Logic Apps. Perhaps a good idea for all resource types capable of using Managed Identites. Oh; and donโt assign owner to those identities. ๐คช
English
@olafhartong And think about the new "attack vectors" when you have a managed identity and a script nobody is monitoring ...
English
๐๐ฐ๐ฐ๐ด ๐๐ฐ๐ฐ๐ด๐ด๐ฆ๐ฏ๐ด ๋ฆฌํธ์ํจ
RansomCow ๐
Hackmanac@H4ckmanac
A #Ransomware Attack Killed a Cow and Her Calf. In the Swiss canton of Zug, a ransomware attack on a farmer's computer systems, including a milking robot, resulted in the death of a cow and her calf. The cybercriminals demanded 10,000 Swiss Francs ($10,800) for decryption, but the farmer chose not to pay. Although the milking robot continued functioning without the network connection, the farmer could not access vital data, leading to the delayed detection of the cow's distress. The monetary damage, excluding the ransom, amounted to over โฌ6,400. Read more: heise.de/en/news/Switzeโฆ #CyberAttack #CyberSecurity #Hack
Indonesia