#github #eicar #hunting #detections #mde #windows #defender #kql #cybersecurity #siem #detection #mde #xdr | 🛡️Jay Kerai [RedSun - KQL included below] A PoC was released on #Github 15 hours for Windows Defender Escalation exploit to SYSTEM from a non-privileged user by abusing a Defender detection to overwrite system f...

Quick post about the RedSun Exploit:

www.linkedin.com/posts/jay-ke...

SBOMs for the WIN

This image perfectly describes PIM self approval with no authentication context

The pick of destiny!

@skotheimsvik.no

In case you missed it. App Control Manager now has an option to deploy a WDAC audit mode policy for RMM tools:

Happy Sunday!

MCP permissions seem to be missing in #Entra portal so I made a quick #KQL detection to detect when MCP permissions are added:

github.com/jkerai1/KQL-...

MDA
MDE
MDI
MDO

But what is MDU?

With these type of scams becoming more popular www.ybs.co.uk/savings/guid... you should set a verification phrase with your family members to make it easier to spot scammers

Some new applied skills are out so ofc I had to go complete them to maintain my throne as Mr Applied skills

See My video about applied skills here:

www.linkedin.com/posts/micros...

I have no issues with the inclusion of the AI in products.

My issue is throwing GenAI at problems that GenAI was clearly not meant to solve.

If a better algorithm/solution exists, use that instead...

One thing I really like about RMAUs is that it forces people to use the correct roles.. PIM'ing to GA won't work for everything

#Entra

You've heard of VibeCoding but have you heard of Software VibeCoded Networking?

Back again

I'm back in blaxk

Noone forgetting about me after that fire lines

soundcloud.com/tryhardertog...

Attackers don’t care about your roadmap slide

They care if one weak control lets them inside

#ButImNotARapper

Security copilot won't let you deploy Overage SCUs only...Unless you deploy 1 SCU first then turn it down to 0 after.

Nice try LinkedIn with the wrap but I'm not installing your app.

If it can run in a browser.. Its staying in the browser

I can't wait for all these browsers to add AI honestly.

Finally businesses will see the use case for a single properly managed browser and block the rest.

Top tip:

Wear your battle jacket to conferences. Then you spend more time talking to sales people about bands than their fancy expensive dashboard

🤘

When you're scambaiting and chilling and you hit them with the "what do you think of *insert modern dictator here* ?"

Basically

#prt #whfb #fido2 #whfb #entra #defender #ediscovery #mde #mda #cyber #security #mfa #conditionalaccess #ca #audit #microsoft #soc #siem #entra #ip | 🛡️Jay Kerai [Stop Skipping MFA For Office/Trusted IPs] If you're still skipping MFA for Office IPs, watch this video 👇 Yep, we are talking about this old beast again. If the device is Entra Joined/Hybrid joine...

www.linkedin.com/posts/jay-ke... unlike the first time i tried to upload a video to linkedin and epically failed, this one actually uploaded! woo

1 take!

> Being a long teams meeting just to say "nope, nothing from my end" right at the end 🖖

Learn about Security Copilot inclusion in Microsoft 365 E5 subscription Learn about Security Copilot availability in Microsoft 365 (ME5)

learn.microsoft.com/en-us/copilo... Security Copilot coming to E5 is massive news!

Reporting to the Graham Security Response center...New Misconfiguration: Outta-Phase 😂

Remediation: Coffee + Reboot

Are you autopatch or outta patch?

Its Friday my dudes

Python Release Python install manager 25.0 The official home of the Python Programming Language

www.python.org/downloads/re... wow about time. Get uninstalling python for devs and repushing via Store!

Given that going from Python 2.X to 3.X broke some things wonder how this will work 🤔