Outsider Security

Two new Entra ID training opportunities in the next few months! I will give another 4-day edition of my public training July 7-10 in The Hague, NL. I will also return to RomHack (Rome, IT) this year for a training Sept 23-27 😀 Info and ticket links: outsidersecurity.nl/training/

I'll be heading to Black Hat Asia next year to give my Offensive Entra ID security course in APAC for the first time! April 1-4 in Singapore 😃. More info and tickets: #offensive-entra-id-azure-ad-and-hybrid-ad-security--43033" target="_blank" rel="nofollow noopener">blackhat.com/asia-25/traini…

Last chance to enjoy the early bird rate for our @BlackHatEvents #BHUSA training on hacking Azure AD and hybrid environments! #offensive-azure-ad-and-hybrid-ad-security-30223" target="_blank" rel="nofollow noopener">blackhat.com/us-23/training…

📢 The first public edition of my "Offensive Azure AD and Hybrid AD" training is now scheduled and available for booking. June 5th to 7th in The Hague, The Netherlands. Tickets and more information at events.outsidersecurity.nl/aadtraining/.

TOMROROW at 11am PT / 2pm ET, join NetSPI's @kfosaaen and @OutsiderSec's @_dirkjan during @BlackHatEvents' webcast, "Backdooring and Hijacking Azure AD Accounts by Abusing External Identities." ow.ly/fmTj50Lejmk #azure #activedirectory #blackhat

#BlackHat free webinar "Backdooring and Hijacking Azure AD Accounts by Abusing External Identities" on November 10 explains how external identities work in Azure AD, and how concepts such as B2B collaboration are facilitated. Register now>> bit.ly/3FT5DvB

Since users modifying their own identities is not yet patched, I've also made a query for that so you can monitor this behavior. Haven't tested this in real envs but I suspect this is not a common action. Query on my GitHub: gist.github.com/dirkjanm/bf9a6…

In my Black Hat talk I referenced a guest account hijack that is very hard to identify after the fact. For blue teamers here, I've made a KQL query available for hunting this abuse in Azure AD audit logs. It should be possible it identify historical abuse: gist.github.com/dirkjanm/814b4…

Almost time for @WEareTROOPERS #TROOPERS22, which means it's time to pack some stickers! 😍

🥳 super excited that I'll be back in Vegas this summer, presenting for the first time at Black Hat US #BHUSA! I'll give a talk about my latest research on hijacking and backdooring accounts via external identities in Azure AD 😁. #backdooring-and-hijacking-azure-ad-accounts-by-abusing-external-identities-26999" target="_blank" rel="nofollow noopener">blackhat.com/us-22/briefing…

Welcoming a new security consultancy to the market: @OutsiderSec I've had a few exchanges with its founder Dirk-jan, and can vouch for their knowledge and skills.