Daniel Chronlund | Security MVP

Finally!! I'm consolidating all of my official PowerShell scripts around Microsoft Graph management, Conditional Access automation, etc, into one PowerShell module. Run Install-Module DCToolbox and Get-DCHelp to get started. danielchronlund.com/2020/11/09/dct…

@rucam365 @UK_Daniel_Card Haven't seen any sophisticated M365 wipers in the wild yet, no. But we do see a lot of bad stuff happening in M365 tenants ones threat actors are inside. Mostly related to priv esc and data exfiltration. Better automation with M365 malware will probably be a reality soon.

@UK_Daniel_Card @DanielChronlund created an M365 wiper. Tagging to see if he’s seen it in the wild. danielchronlund.com/2023/02/14/the…

has anyone ever seen Ransomware in SharePoint online? as in document libraries being encrypted? or a WIPER? It's got the recycle bin feature so I don't think that would work AFAIK

#AzureAD PIM makes it possible to configure activation and expiration settings on a per-role basis. Read my latest blog post for some cool PowerShell role automation based on role impact :) danielchronlund.com/2023/06/21/aut…

I've added a simple tool to #DCToolbox to quickly request a refresh token from #AzureAD using the OAuth 2.0 device code flow. For me, the clipboard integration is the killer feature! Install/update with 'Install-Module -Name DCToolbox -Force'

I'm currently investigating the potential threat of #Microsoft365 wiper #malware. Simulate an attack with 'Invoke-DCM365DataWiper' today, and take precautions in your #AzureAD tenant! danielchronlund.com/2023/02/14/the…

My latest blog post is a proof of concept of how poorly protected #AzureAD app permissions can be used in a data exfiltration #cybersecurity attack. I’ve added a new tool to my DCToolbox PowerShell module called Invoke-DCM365DataExfiltration. Interested? danielchronlund.com/2023/02/09/mic…

A somewhat different blog post for me where I share some thoughts on #Microsoft #cloudsecurity in 2023. danielchronlund.com/2023/01/25/a-s…

📢 My latest blog on Sentinel 🛡️ Integrate your #Microsoft Defender for Identity health alerts into #Sentinel incidents and use custom alert mapping to make you live easier. #MDI #MDO #M365D #Security cloudbrothers.info/en/integrate-m…

The new #MicrosoftSentinel Overview blade is live. Simple, yet a great improvement!

@spiddeer Jag har försökt bygga till det ett par gånger men upptäckt båda gångerna att det inte finns stöd för det i Graph så det har inte gått tyvärr.

@DanielChronlund Har du så man kan köra Privileged access groups när man kör Enable-DCAzureADPIMRole e?

I've just updated my #MicrosoftSentinel repo with some new #threathunting queries for #MicrosoftDefender (and some improvements to existing queries), based on the recent incident deep dives posted by Microsoft Detection and Response Team (DART). danielchronlund.com/2022/10/03/sen…

@MathHewitt You need to export Defender for Endpoint device events to Sentinel in the Defender connector.

@DanielChronlund Had a look at this today, good work although mine showed no data, layer is messing things up again 😂

I'm happy to announce that my #MicrosoftSentinel #MicrosoftDefender 'Attack Surface Reduction Dashboard' is now included in Sentinel. You'll find it in your Sentinel workspace today under Workbooks > Templates!

@wasmitit @janbakker_ @azuread No, CAP licensing seams to be designed for intrepretation. Noone I've talked to at Microsoft or partners, or the community seams to know the complete answer.

@DanielChronlund @janbakker_ @azuread Did you ever come to a final conclusion on this question?

Important question: Do I need to buy @azuread Premium licenses for user accounts in my Azure AD that don't belong to any human and that never signs in to Azure AD at all, for example synced stale accounts, when I use #conditionalaccess policies targeting all users?