AiTM Token Theft: Detect Replay, Enforce Auth Strengths
AiTM token theft defeats MFA by replaying stolen session cookies. Hunt replay in Entra sign-in logs and enforce phishing-resistant auth strengths.
Read article →
Topic
22 articles
Security
Security work for the people who configure and defend Microsoft and Azure environments. Posts cover identity hardening in Entra, Conditional Access design and gap analysis, passkeys and break-glass accounts, privileged access with PIM, Zero Trust networking, Defender XDR and Sentinel, and Purview data protection. Threat-focused articles analyse real incidents, such as Teams helpdesk impersonation, ASCII smuggling, service account weaknesses and AI-assisted intrusions, then translate them into controls and checks you can apply the same day. Patch Tuesday triage and emergency-patch posts help you decide what to fix first.
Start with
CSP Break-Glass Accounts and Passkeys for Customer Tenants
CSP break-glass accounts done right: phishing-resistant passkeys for technicians, GDAP role tiers, emergency access custody, and drift checks at scale.
Read article →
Passkeys and Break Glass Accounts in One Entra Tenant
Entra emergency access accounts and passkeys in one tenant: FIDO2 keys for break glass, Conditional Access exclusions, sign-in alerts and quarterly drills.
Read article →
ASCII Smuggling: Invisible Unicode Is Slipping Past Your Phishing Filters
ASCII smuggling phishing hides invisible Unicode inside lure words to dodge keyword filters — how it works, and how to normalize before you match.
Read article →
Secure Boot Certificates and Memory Integrity by Default in Windows
Windows secure boot certificate update 2026 lands the same month Memory Integrity turns on by default — how to inventory, stage, and control both.
Read article →
AI Agent Cyber Attacks: What the Unit 42 Case Changes
AI agent cyber attacks compressed an enterprise intrusion into under 10 hours. Rebuild Entra, GitHub and Key Vault containment so every step fires at once.
Read article →
Emergency Patches Outside Microsoft: Adobe Commerce StyleSmuggler, N-able N-central, and PEEP
Vendor patches your Microsoft cycle won't show you: N-able N-central CVE-2026-86218, Adobe Commerce StyleSmuggler and the PEEP Chromium backdoor.
Read article →
Teams Helpdesk Impersonation: When the Attack Rides a Trusted Workflow
Teams helpdesk impersonation detection: the kill chain, KQL hunting queries and the settings that stop one approved remote session becoming domain access.
Read article →
September 2026 Patch Tuesday: 966 Fixes, Two Zero-Days to Triage First
September 2026 patch tuesday shipped 966 fixes and two exploited zero-days — the triage order, expedite paths, and KQL to run while you deploy.
Read article →
gMSA, dMSA and the Service Account Problem Nobody Solved
Group managed service accounts security rests on two things almost nobody audits: the password retrieval ACL and the forest KDS root key. Fix both.
Read article →