OAuth App Privilege Escalation: The Backdoor That Survives a Password Reset
What we’re detecting This detection identifies a two-event chain in Microsoft Entra ID that, taken together, indicates a classic pattern of privilege…
Tag: Identity
I built an Evilginx setup from scratch and captured a Microsoft password
The first time on the other side0 For the past few years, my work has been defensive: I have written detection rules…
Conditional Access Baseline: 10 Policies for M365 Tenants
Why a baseline, and not “just MFA” Turning on MFA for every user is the first thing any tenant should do —…
MFA Fatigue
What we’re detecting This detection identifies a possible MFA Fatigue attack (also known as MFA Bombing), where an attacker already holds the…