Select Page
varghesejoji_0-1696267105785.png

Unlocking Azure Secrets: Using Identities for Key Vault Access

Azure Key Vault is essential for securely managing keys, secrets, and certificates. Managed Identities (MI) allow Azure resources to authenticate to any service that supports Azure AD authentication without any credentials in your code.  For those looking to swiftly test ... continue reading

What’s new in Microsoft Entra

Microsoft has recently introduced a range of new security tools and features for the Microsoft Entra product family, aimed at helping organizations improve their security posture. With the ever-increasing sophistication of cyber-attacks and the increasing use of cloud-based services and ... continue reading
Side view close-up of a man typing on his phone while standing behind a Microsoft Surface Studio.

New security features in Windows 11 protect users and empower IT

While attacks are getting more sophisticated, so are our defenses. With recent innovations like secured-core PCs that are 60 percent more resilient to malware than non-secured-core PCs,1 and the Microsoft Pluton Security Processor that adds more protection by isolating sensitive ... continue reading
JerryDevore_0-1695331302683.png

Active Directory Hardening Series – Part 1 – Disabling NTLMv1

Active Directory Hardening Series - Part 1 – Disabling NTLMv1   Hello everyone, Jerry Devore back again after to along break from blogging to talk about Active Directory hardening.  In my role at Microsoft, I have found every organization has ... continue reading
Azure AD Rename Rollout and Resources

Azure AD Rename Rollout and Resources

  The rename of Azure Active Directory (Azure AD) to Microsoft Entra ID is now rolling across content and product experiences from Microsoft, as per the implementation timeline outlined in the Azure AD rename announcement on July 11th. We expect ... continue reading
Peach Sandstorm 2023 tradecraft and attack flow diagram.

Peach Sandstorm password spray campaigns enable intelligence collection at high-value targets

Since February 2023, Microsoft has observed password spray activity against thousands of organizations carried out  by an actor we track as Peach Sandstorm (HOLMIUM). Peach Sandstorm is an Iranian nation-state threat actor who has recently pursued organizations in the satellite, ... continue reading
How Tenant Restrictions v2 Can be Used to Prevent Data Exfiltration

How Tenant Restrictions v2 Can be Used to Prevent Data Exfiltration

In a previous blog, we introduced Continuous Access Evaluation (CAE) - a product that brings Zero Trust principles to session management. Today we would like to discuss securing cross-tenant access with a focus on preventing data exfiltration.  It’s impossible to imagine ... continue reading
Diagram showing the Storm-0324 attack chain from the delivery of phishing email to the deployment of the JSSLoader DLL, after which access is handed off to Sangria Tempest

Malware distributor Storm-0324 facilitates ransomware access

The threat actor that Microsoft tracks as Storm-0324 is a financially motivated group known to gain initial access using email-based initial infection vectors and then hand off access to compromised networks to other threat actors. These handoffs frequently lead to ... continue reading
Threat matrix with updated techniques included in reconnaissance, initial access, persistence, defense evasion, credential access, discovery, lateral movement, and exfiltration stages.

Cloud storage security: What’s new in the threat matrix

Today, we announce the release of a second version of the threat matrix for storage services, a structured tool that assists in identifying and analyzing potential security threats on data stored in cloud storage services. The matrix, first released in ... continue reading
ArchitectureOverview.png

Automating Azure VM Deployment: The Power of PowerApps, SharePoint, Flow and Azure DevOps Pipe

Introduction Many of our customers are trying to balance the productivity vs security scale at this point in time. On the one end you can provide access to the Azure Portal but that could provide certain risks and requires an ... continue reading