Jeffrey Appel’s Post

🚨 Another reminder that “secure by default” doesn’t mean “bulletproof.” A recently disclosed @Microsoft Entra ID flaw (CVE-2025-55241) exposed a vulnerability that let attackers impersonate any user—including Global Admins—across tenants, often without leaving the usual audit trail. What made this one sting wasn’t sloppy configurations—it was legacy design decisions coming back to haunt everyone. Old token flows and the deprecated Azure AD Graph API created an opening big enough to drive a truck through. Here’s the bigger picture: • MFA alone isn’t a silver bullet. Token flows and legacy endpoints matter. • Deprecated APIs are basically unlocked windows. • Zero Trust isn’t a marketing slogan—it’s survival. At @IdealTechnologys, we spend a lot of time helping MSPs and their customers root out these hidden risks: reviewing token flows, auditing tenants for legacy exposure, and hardening identity posture before attackers get creative. Identity is the new perimeter. And if that perimeter is being held together by duct tape from 2013… it’s time for an upgrade. #cybersecurity #MSP #Microsoft365 #EntraID #identitysecurity #infosec #ZeroTrust 👉 Read the full story https://lnkd.in/gz7FyHD4

EsfLabsNews | 🚨 Cybersecurity Alert: | Source: https://lnkd.in/gCggSVsM A newly discovered Beacon Object File (BOF) tool is exploiting Microsoft Teams’ cookie encryption flaw, enabling attackers to decrypt session cookies and access private user chats. This technique bypasses traditional defenses, highlighting critical gaps in endpoint security and cloud collaboration tools. Organizations using Teams should enforce conditional access, EDR telemetry, and MFA hardening to mitigate risks. #CyberSecurity #ThreatIntel #MicrosoftTeams #BOFExploit #RedTeam #InfoSec #DataProtection #EDR #CloudSecurity #MalwareAnalysis #IncidentResponse #EsfLabsCyberSecurityNews #EsfLabsFeeds  

Microsoft is grappling with a widespread outage preventing some users from accessing Microsoft 365 applications, exposing organizations to significant productivity loss and potential disruption of critical business operations. Defenders should monitor Microsoft 365 service health dashboards and proactively communicate potential disruptions to end-users to mitigate impact. 🛡️ #cybersecurity https://lnkd.in/gAnhUJzR

🚀 Wazuh 4.14.0 is here! 🎉 The Wazuh 4.14.0 release enhances the IT Hygiene capability with an expanded inventory that now includes browser extensions, endpoint services, users, and groups. This release also introduces a new Microsoft Graph API dashboard and supports hot reload of Wazuh agent configuration. Find out more about these improvements in our new blog post: https://ow.ly/LG8r50Xh5F2 #InformationSecurity #CyberSecurity #OpenSource

🚀 Wazuh 4.14 – Strengthening IT Hygiene & Visibility! Excited to see the latest Wazuh 4.14 release bringing real value to Softcell’s MSSP and SOC operations, enhancing visibility, compliance, and proactive threat detection across customer environments. ✨ Key highlights: 🌐 Browser Extensions Inventory: Unified visibility across Chrome, Firefox, and Safari — reducing shadow IT risks and improving compliance checks. ⚙️ Services Inventory: Monitor Windows services and Linux systemd units to quickly detect unauthorized or failed services. 👥 Users & Groups Inventory: Gain a complete cross-platform view of users and groups — improving insider threat detection and audit readiness. These new capabilities strengthen Softcell’s Managed Security Services, enabling our customers to achieve better IT hygiene, endpoint control, and faster incident response through the power of open-source SIEM + XDR. Wazuh #Softcell #MSSP #CyberSecurity #SIEM #XDR #ITHygiene #OpenSourceSecurity #ThreatDetection Samir Patani Bhaskar Padaki Mitesh Gala AYUSHMAN SHUKLA Hrithik Lall Vinit Tyagi

An excellent article on how to disable Entra Connect Seamless SSO. In the modern world, Primary Refresh Tokens are high important.

Exploring the Microsoft Entra Conditional Access policy, particularly the Zero Trust policy, reveals its significant role in enhancing security, automating access decisions, and ensuring compliance in today's hybrid work environments. Zero Trust Conditional Access Overview • Zero Trust Principle: Enforces “Never Trust, Always Verify” — requiring explicit verification for every access attempt. • Real-Time Risk Evaluation: Continuously analyzes signals like user identity, device health, and location to apply the right access controls. • Granular Policies: Enables “if-then” rules (e.g., stronger MFA for sensitive data or unmanaged devices). • Automated Threat Response: Dynamically grants, limits, or blocks access based on risk to stop threats without manual action. • Reduced Attack Surface: Enforces least-privilege access and blocks insecure legacy authentication. • User-Friendly Security: Prompts MFA only when necessary, improving productivity and security balance. • Regulatory Alignment: Detailed logs and controls support compliance with data protection standards. • Integrated Defense: Works seamlessly with Entra ID Protection, Intune, and Defender for Cloud Apps. • Hybrid Access Security: Protects both cloud and on-premises apps through modern authentication. For details, see Microsoft’s official Conditional Access documentation. https://lnkd.in/easrfc8X

I know this may come as a shock to most of you, but the simple fact is this: Microsoft Defender for Endpoint (MDE) isn’t just an EDR solution — it’s actually the sensor backbone for the entire Defender and Purview ecosystem. Too often, I hear from organizations who have misconceptions about MDE. They see it as unnecessary, duplicative, or sometimes they're just talking about the wrong product. "Oh, we have Defender." And then it turns out to be Defender AV or Defender for Office 365. Or another good one is "Oh, we already have SentinelOne for our EDR solution, so we don't need Defender for Endpoint." But the reality is, you do still need it. Because MDE does far more than detect and respond. It feeds the telemetry that powers: • Defender XDR — correlation across identity, email, cloud app and device signals • Intune for device risk posture and device compliance • Purview Endpoint DLP — DLP enforcement on the entire endpoint • Defender Vulnerability Management — continuous endpoint risk insight • Microsoft 365 Compliance & Secure Score — unified visibility And, oh, by the way — MDE can run alongside other EDRs like CrowdStrike or SentinelOne, continuing to enrich Microsoft’s security intelligence without conflict. Defender for Endpoint isn't about replacing your tools. It’s about amplifying your ecosystem. Read the full post here: https://lnkd.in/g9BTp9X2 #MicrosoftDefender #DefenderXDR #Purview #EDR #ZeroTrust #EndpointSecurity #Microsoft365Security

🛡️ Fortifying Endpoints: A Deep Dive into Windows Defender Credential Guard Credential theft is the primary gateway for lateral movement in a network. As an IT Support Specialist, securing the Local Security Authority Subsystem Service (LSASS) is non-negotiable. That’s where Windows Defender Credential Guard comes in. This is more than just a setting; it's a fundamental change to how Windows protects credentials. Here’s a breakdown of what it is, the critical prerequisites, and how to deploy it using enterprise tools: What is Credential Guard? Credential Guard is a security feature (available in Windows 10/11 Enterprise/Education) that uses Virtualization-Based Security (VBS) to isolate LSASS. By running LSASS in a secure, isolated container, it becomes impossible for even an attacker with kernel-level access to steal NTLM hashes or Kerberos tickets from memory. Phase 1: Critical Prerequisites Credential Guard is a hardware-rooted defence, so these must be checked first: Processor: 64-bit with Virtualization Extensions (Intel VT-x or AMD-V). Firmware: UEFI 2.3.1+ with Secure Boot enabled. Security Chip: Trusted Platform Module (TPM) 1.2 or 2.0. BIOS/UEFI: Virtualization Technology and IOMMU (Input-Output Memory Management Unit) must be enabled. Phase 2: Enterprise Configuration For scalable deployment, we rely on centralized management tools. Method A: Group Policy (On-Premises) For domain-joined devices, you manage it via a GPO: Navigate to: Computer Configuration > Administrative Templates > System > Device Guard. Enable the policy: "Turn On Virtualization Based Security." Vital: Set the configuration to "Enable with UEFI lock." This prevents an attacker from simply turning the feature off in the BIOS. Method B: Microsoft Intune (Cloud-Managed) This is my preferred method for modern, cloud-native endpoints: Access the Microsoft Endpoint Manager admin centre. Create a new policy under Endpoint Security > Endpoint detection and response. Configure the Credential Guard setting and set the value to "Enable with UEFI lock." Assign the policy to your relevant Microsoft Entra ID (Azure AD) device groups. Verification: How to Confirm It’s Running Credential Guard runs passively. You can verify deployment using: System Information (msinfo32): Check the "System Summary" for the "Credential Guard" status. Registry Check: Verify the LsaCfgFlags value in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa. (A value of 1 or 2 confirms activation). Credential Guard is one of the most effective ways to break the "pass-the-hash" and lateral movement chain. If you are responsible for endpoint security, this feature should be at the top of your deployment list! #CyberSecurity #EndpointManagement #Intune #Microsoft365 #CredentialGuard #TechSkills #ITSupport

A new BOF( Beacon Object File) exploit targets Microsoft Teams, abusing cookie encryption to hijack sessions and read user chats, all without tripping alarms. It’s a perfect example of how the modern attack surface has shifted. We defend networks and endpoints… but attackers are now focusing on identity and app-layer compromise, where collaboration tools create new visibility gaps. Should visibility into these apps become a core part of security strategy? What are your thoughts. Link to the article ⬇️ https://lnkd.in/eh9-4f84 #CyberSecurity #Infosec #ThreatDetection #SOC