Select Page
How to deploy gMSA on AKS with Terraform

How to deploy gMSA on AKS with Terraform

The other day I posted a blog on how to deploy an AKS cluster that is ready for Windows workloads using Terraform. Today, I wanted to expand that to include gMSA, which is a highly requested feature from Windows customers ... continue reading
Capitalize on your investments with the new centrally managed Azure Hybrid Benefit for SQL Server

Capitalize on your investments with the new centrally managed Azure Hybrid Benefit for SQL Server

Introducing the new centrally managed Azure Hybrid Benefit for SQL Server.Today, Microsoft is pleased to announce the release of centrally managed Azure Hybrid Benefit for SQL Server, a new Azure portal feature that helps you improve SQL Server license management ... continue reading
Attack flow of the threat actor through initial access, execution, discovery, persistence, credential access, lateral movement, execution, impact, and communications stages.

MERCURY and DEV-1084: Destructive attack on hybrid environment

Microsoft Threat Intelligence has detected destructive operations enabled by MERCURY, a nation-state actor linked to the Iranian government, that attacked both on-premises and cloud environments. While the threat actors attempted to masquerade the activity as a standard ransomware campaign, the ... continue reading
Screenshots of Outlook on Windows showing how to set a custom sound that plays when a reminder is triggered

Guidance for investigating attacks using CVE-2023-23397

This guide provides steps organizations can take to assess whether users have been targeted or compromised by threat actors exploiting CVE-2023-23397. A successful exploit of this vulnerability can result in unauthorized access to an organization’s environment by triggering a Net-NTLMv2 ... continue reading
the inside of a building

Easily migrate SQL Server applications to the cloud with Azure

Microsoft Azure knows SQL Server best and will support your cloud migration at no cost for qualifying scenarios.The SQL Server platform has been successfully driving transformative business results with Microsoft customers across industries for over 25 years, enabling breakthrough innovation ... continue reading
andrefgp_1-1675251706991.png

NetDevOps on Azure

Introduction With every company, across every industry, digitally transforming, tons of modern applications are built at an unprecedented pace and speed, and all rely on the underlying network infrastructure. Networking enables application components to communicate with each other, its dependencies, ... continue reading
Local Computer Policy - User Rights Assignment Dialog

How To Automate The Hybrid World Part Two Of Two

Hi, Jonas here! Or as we say in the north of Germany: "Moin Moin!"I’m a Microsoft Senior Cloud Solution Architect – Engineering (or short Sr. CSA-E) and in this article I want to talk about how to automate the hybrid world. Over ... continue reading

How Do I Know If My AD Environment Is Impacted By The November 8th 2022 Patch?

  Q: How can I determine if objects in my AD environment are impacted by the November 8th 2022 patch? A: Use a couple of queries I wrote specifically for that purpose.   November 8th, 2022 brought us a patch ... continue reading
A human-operated ransomware attack example highlighting C2 usage. The attacker begins with the initial access stage, followed by execution, the initial C2 connection, persistence, a beaconing C2 connection, a post-exploitation C2 connection that continues throughout the attack, leading to lateral movement, and the final impact stage.

Stopping C2 communications in human-operated ransomware through network protection

Command-and-control (C2) servers are an essential part of ransomware, commodity, and nation-state attacks. They are used to control infected devices and perform malicious activities like downloading and launching payloads, controlling botnets, or commanding post-exploitation penetration frameworks to breach an organization ... continue reading
DEV-0832 (Vice Society) opportunistic ransomware campaigns impacting US education sector

DEV-0832 (Vice Society) opportunistic ransomware campaigns impacting US education sector

In recent months, Microsoft has detected active ransomware and extortion campaigns impacting the global education sector, particularly in the US, by a threat actor we track as DEV-0832, also known as Vice Society. Shifting ransomware payloads over time from BlackCat, ... continue reading