Principal Cloud Security Lead, Elisa Santa Monica, Microsoft Security MVP. Tweets are my own. Blogger, speaker.
Finland
Joined October 2009
- Tweets2.9K
- Following819
- Followers2.6K
- Likes6K
Sami Lamppu retweeted
I have the great pleasure of joining a shared session with @samilamppu at the M365 Security & Compliance User Group tonight. Preparations are now in full swing... You can find more details about the meetup and register for this free online event here:
meetup.com/m365sandcug/event…
Sami Lamppu retweeted
EntraOps repository:
github.com/Cloud-Architekt/E…
Learn more about XSPM and Graph semantics:
Deep Dive blog post on XSPM by @samilamppu
samilamppu.com/2024/04/25/mi…
Blog posts by @fabian_bader
cloudbrothers.info/en/worksh…
cloudbrothers.info/en/find-l…
Enjoy to learn Kusto Graph! (3/3)
Check out our latest updates on Entra ID Attack and Defense Playbook 👇
#MicrosoftEntra Attack & Defense Playbook Update: @samilamppu and I have updated some content, including:
🔃 #EntraConnect: Capabilities by MDI sensor & XSPM
🎯 #AiTM: Attack scenarios on MDA sessions
🛡️ #MITRE: Updated map
Check out the latest version:
github.com/Cloud-Architekt/A…
Sami Lamppu retweeted
I just sent out this week's Entra newsletter featuring posts from @12Knocksinna, @alitajran, @DanielatOCN, @dean_ellerby, @jannik_reinhard, @LazyAdmin, @pathak_somesh, @rahulj1906, @rbrayb, @samilamppu and more!
Microsoft Digital Defense Report 2024 is out. Interesting read, as always.
More from the blog: Escalating Cyber Threats Demand Stronger Global Defense and Cooperation blogs.microsoft.com/on-the-i…
Detecting AiTM Phishing via 3rd-Party Network events in Unified Security Operations Platform
techcommunity.microsoft.com/…
Sami Lamppu retweeted
Still struggling with token theft? All you need to know about adversary in the middle token theft attacks including detective and protective controls in the Azure AD Attack Playbook - github.com/Cloud-Architekt/A… from @Thomas_Live and @samilamppu
The new chapter of the #MicrosoftEntraID Attack & Defense Playbook has seen daylight: adversary-in-the-middle attacks.
The chapter will provide comprehensive attack descriptions, detections, mitigations & hunting queries.
Link to the playbook: bit.ly/3ZnWgNY
Kudos to @SantasaloJoosua & @fabian_bader for reviewing the content. It's always a privilege to work with both of you and, of course, with my co-author @Thomas_Live
On my way to Cloud Identity Summit in Cologne. First stop - Dusseldorf! Btw, if you happen to be there, come and say hi 😊
Defender for Identity expands to Entra Connect Server, and you will get:
- New detections on MDI
- Security posture recommendations in M365 Secure Score (underneath identity security assessment)
Details 👇
techcommunity.microsoft.com/…
Over the past few months, we (@Thomas_Live & me) have been conducting a new chapter for Entra ID Attack & Defense Playbook - AiTM attack.
We are in the final phase of doing QA for the chapter & hunting queries. Stay tuned!
Link to the playbook: bit.ly/3Sr6FT6
Sami Lamppu retweeted
Microsoft has added a new set of critical cloud assets classifications in #ExposureManagement. This includes classification capabilities for identities with #Azure privileges and pre-defined criticality levels for #MicrosoftEntra roles. More details:
techcommunity.microsoft.com/…
Multi-tenancy in the unified security operations platform experience is now in Public Preview
#DefenderXDR #MicrosoftSentinel
Blog: bit.ly/4dvTlHf
New set of critical cloud identities and resources add in #ExposureManagement.
Cloud Assets: Identifying and Protecting the Crown Jewels of your Cloud - bit.ly/3Mf36O9
Introducing the MDTI Premium Data Connector for Sentinel - Microsoft Community Hub techcommunity.microsoft.com/…
Using #DefenderXDR Portal to hunt for Kubernetes security issues techcommunity.microsoft.com/…
Bridging the On-premises to Cloud Security Gap: Cloud Credentials Detection
#XSPM #ExposureManagement
techcommunity.microsoft.com/…
Are you planning to integrate (or already have) #MicrosoftSentinel into #DefenderXDR? Here is MS technical FAQ blog about Unified Security Operations Platform to provide more info about the integration techcommunity.microsoft.com/…
Just found another FAQ related the integration published just few days ago - bit.ly/4dBYIVk