Bits, Bytes, and Bourbon @DecryptedTech

@ZackKorman @IceSolst Yeah? Well I'm going to get my engineers to invent combustible lemons that burn your AI down...

I've been working with orgs in M365 security now for 4 years. Time flies. Unprotected credentials in M365 workloads are just as pervasive as they were on shares in the on-prem day. youtube.com/watch?v=8kAO9T…

learn.microsoft.com/en-us/entra/wo…

Having responded to probably hundreds of incidents at this point, from ransomware to APT's, in my experience, the lack of knowledge on how to adequately secure Entra applications and service principals continues to be the biggest knowledge gap most defending teams have. You should be able to securely configure apps, detect compromise of apps and understand how to investigate compromise of apps. It seems overwhelming at first, but it isn't. Get started like this Secure them: •Use managed identities where possible - negates the need for credential handling •Limit privilege - reduce both the permissions granted and add additional API specific restrictions (i.e don't grant read/write all to all SharePoint sites, just the ones an application needs to access). This includes pushing back on vendors or internal teams that request privilege not required •High privileged applications should have no direct owners - lower privileged users can be granted direct ownership of an app, don't do this, govern the ability to manage applications via Entra ID roles •Configure credential restrictions such as requiring shorter lived secrets or enforcing use of certificates •Remove unused apps and service principals, this can prevent existing high privileged apps being leveraged and reduces your supply chain compromise footprint for multitenant apps •Monitor risk events for service principals like you would users Detect compromise of them: •Alert on application creation or application credential creation - may be noisy in large environments, but a good starting point •Alert on credentials being added to service principals - credentials generally live on the application object, service principal credential creation should be rare •Alert on permission consent - this can detect not only malicious activity but permission creep •Alert on anomalous resource access - does your app usually access only Azure Storage, and suddenly it accesses Microsoft Graph? - this may indicate a compromised credential •Alert on anomalous ASN or location access - does your app usually access only from a specific ASN or country, and suddenly that changes? - this may indicate a compromised credential Many of these are covered by Defender for Cloud Apps and other tools out of the box, but it is worth ensuring you are covered down and what they actually mean. Investigate compromise of them: Know how to query the following logs and understand the events surfaced •Entra ID sign in data - filter on service principal sign in events via the Entra portal or Kusto in the Defender XDR portal •Entra ID audit logs - filter on events related to the service principal via the Entra portal or Kusto in the Defender XDR portal. Service principals can be used to further establish persistence, such as creation of users or additional service principals, rinse and repeat for any malicious additions to your environment •Microsoft Graph - was the compromised app used to access data via Microsoft Graph? You can query via the Defender XDR portal using Kusto to find these events •Defender for Cloud Apps - did the compromised app access other M365 services? You can query via the Defender XDR portal using Kusto to find these events •Unified Audit Log - you can retrieve the events related to the compromised app via the audit functionality inside the Defender XDR portal

@BourbEnthusiasm Thank you sir :-)

Gasp!!! Who could've seen this coming? Oh wait... (Post not aimed at IT Guy)

IT Guy @T3chFalcon

20 hours ago

Attackers have figured out how to write phishing emails that bypass you entirely and go straight for the AI reading your inbox. Barracuda documented this in October. Here's how it works. You receive a phishing email. When your AI email assistant summarizes your inbox. it reads

235 1K 8K 592K 4K

I feel bad man 😭 Apologies to the thousands of VPS and compute engineers worldwide spending their weekend emergency patching and rebooting hypervisors because of CVE-2026-99999. Security bugs really do love getting disclosed right before the weekend.

pwn.ai @pwn_ai

3 days ago

Introducing PwnEscape 🦉: a full KVM guest-to-host escape via a Linux kernel networking flaw affecting industry standard hypervisors. CVE-2026-99999 went from untrusted VM code to host-kernel memory reads, controlled writes, and root command execution. More below:

16 209 1K 351K 750

@_Invadergirl Got my coffee, let's go.

Morning, get yo coffee! We have magical quests to get after, bring snacks and ammo. Also tee and hoodies live! rangerup.com/pages/invader-… And new art coming!

The best thing about HeroQuest is that it will be getting a digital version in 2027. youtu.be/Cx8sl2uC46A?is…

Nerdcognito @Nerdcognito

a day ago

If you were in my gameroom in 1989, you're excited today. HeroQuest is getting its first official digital edition, on Steam in 2027: Classic classes, online co-op, & the option to play Zargon & end players. The dungeon crawler is finally on a screen without losing the table.

59 76 812 22K 122

Actual footage inside the Anthropic HQ... ... allegedly.

Holly ⏸️ Elmore @ilex_ulmus

a day ago

At @AnthropicAI this is like a koan to them and they love making a big show of grappling with it. Of course what they’ve already decided to actually do is try to take over the world as fast as they can regardless.

0 10 81 8K 9

I made a short video that explains Entra app permissions and the part they played in the ConnectWise incident: how one app credential reached 173+ Microsoft 365 tenants with no password or MFA, and what to check today. youtube.com/watch?v=Q36aL_…

Announcing ADVERSARY AFTERLIFE 16 former threat domains, reborn as visual histories of real attacks: the APTs, malware and TTPs behind them, and the defenders who exposed them. Told through UwU Underground's art, music and lore. Coming soon

UwU Underground @uwu_underground

20 hours ago

Ummm dear threat intel agencies: Do not be alarmed by domains previously used by RU, DPRK, or CN APTs suddenly being repurchased in the last 72 hours It is us doing a preservation edutainment project Thank you for attention in this matter 6 Hugs and Kisses, UwU Underground

8 16 181 6K 24

Hey @romero have you seen this version of the Doom music? youtube.com/shorts/DUSghaM…

Want to WIN a beautiful Corpse Kings: The Silent Abyss Print on Demand hardcover worth $79.99? Here's how: Follow this account ✅ Like this post ✅ Share this post ✅ And finally, tell me your funniest Pirate Joke! 🦜

@ZackKorman @cheddar420yolo No, but we are looking into requiring DNA proof of identity via blood. Anytime you connect you need to tap a vein to run your device... We think it has a simple elegance to it... </of course this is a joke> Tag for the humor impaired.

@infosec_fox @ZackKorman It is 8:14 PM my time. Not time for bed yet, for me at least.

@infosec_fox @ZackKorman They do not want any accountability. That has been clear for a while.

@ZackKorman @infosec_fox Hahaha... no just a long winded sarcastic run up to the real point ;-)