CoPhish: Using Microsoft Copilot Studio as a wrapper for OAuth phishing securitylabs.datadoghq.com/articles/cop... by @siigil.bsky.social

CoPhish: Using Microsoft Copilot Studio as a wrapper for OAuth phishing | Datadog Security Labs

Copilot Studio links look benign, but they can host content to redirect users to arbitrary URLs. In this post, we document a method by which a Copilot Studio agent's login settings can redirect a user...

securitylabs.datadoghq.com

😈 Copilot Studio agents are great for users... and attackers! Check out our deep-dive on why you should be careful to trust unknown agents, plus background on upcoming app consent changes that will help prevent our demo scenario. securitylabs.datadoghq.com/articles/cop...

CoPhish: Using Microsoft Copilot Studio as a wrapper for OAuth phishing | Datadog Security Labs

Copilot Studio links look benign, but they can host content to redirect users to arbitrary URLs. In this post, we document a method by which a Copilot Studio agent's login settings can redirect a user...

securitylabs.datadoghq.com

Old and busted: Cloud attackers making noisy List/Describe calls. New hotness: Laundering enumeration calls through an AWS service silently. Or at least, that used to work, until @datadoghq.com partnered with AWS to close this gap. Read more here: securitylabs.datadoghq.com/articles/enu...

Enumerating AWS the quiet way: CloudTrail-free discovery with Resource Explorer | Datadog Security Labs

Discover how attackers could quietly enumerate AWS resources via Resource Explorer, and how Datadog and AWS worked together to close the visibility gap.

securitylabs.datadoghq.com

🎉 Exciting news: The Office 365 Exchange Online SP privilege escalation we documented in "I SPy" is no longer possible! We've updated the post to reflect this. Thanks to Eli Guy for the tip on this one: securitylabs.datadoghq.com/articles/i-s...

I SPy: Escalating to Entra ID's Global Admin with a first-party app | Datadog Security Labs

Backdooring Microsoft's applications is far from over. Adding service principal credentials to these apps to escalate privileges and obfuscate activities has been seen in nation-state attacks, and led...

securitylabs.datadoghq.com

Check out my new blog on nested app authentication.

SpecterOps@specterops.io · 12mo ago

Why should Microsoft's Nested App Authentication (NAA) should be on your security team's radar? @1cemoon.bsky.social breaks down NAA and shows how attackers can pivot between Azure resources using brokered authentication. ghst.ly/45h2Zw3

Excited to see folks at DEFCON next week!! Ready to see some great talks and get those conference steps in. 👟

🕵️‍♀️ Looking to escalate privileges with a first-party Microsoft app? How do federated domain backdoors work? And what's an app reg, really? All this and more in our new @securitylabs.datadoghq.com post: securitylabs.datadoghq.com/articles/i-s...

I SPy: Escalating to Entra ID's Global Admin with a first-party app | Datadog Security Labs

Backdooring Microsoft's applications is far from over. Adding service principal credentials to these apps to escalate privileges and obfuscate activities has been seen in nation-state attacks, and led...

securitylabs.datadoghq.com

Join my team! We’re looking for a Senior Security Researcher specializing in Generative AI. You’ll have the opportunity to be a part of one of the leading security research organizations in the industry and shape Datadog’s security products! A 🧵 careers.datadoghq.com/detail/70312...

Senior Security Researcher - GenAI | Datadog Careers

We're building a platform that engineers love to use. Join us, and help usher in the future.

careers.datadoghq.com

☁️ My fwd:cloudsec talk, "I SPy: Rethinking Entra ID research for new paths to Global Admin", is up! Learn what a service principal is, how Microsoft's first-party apps could be backdoored, and one weird trick they haven't fixed yet: www.youtube.com/watch?v=oNpw...

I SPy: Rethinking Entra ID research for new paths to Global Admin

YouTube video by fwd:cloudsec

youtube.com

At @wearetroopers.bsky.social I dropped new research on #nOAuth, an abuse of #EntraID that allows you to spoof users in vulnerable SaaS applications. The attack is still alive and well. You can read all about it here: #Entra #M365 #infosec www.semperis.com/blog/noauth-...

New nOAuth Abuse Alert: Entra Cross-Tenant Saas Apps at Risk

Think nOAuth abuse is old news? We wish. Our recent testing shows that nearly 10% of apps in the Microsoft Entra Gallery remain vulnerable.

semperis.com

My RSAC virtual session is up! Catch "Persisting Unseen: Attacker Methods of Infesting Entra ID" here: youtu.be/ngSFP-tgupM?... Companion blog: kknowl.es/posts/defend...

Traditional Sessions: RSAC Virtual Seminar: Cloud Security

YouTube video by RSA Conference

youtu.be

🕵️‍♀️ I'll be presenting "I SPy: Rethinking Entra ID research for new paths to Global Admin” at fwd:cloudsec June 30-July 1, alongside some fantastic other speakers: fwdcloudsec.org/conference/n... If you can’t make it, talks are streamed at: www.youtube.com/@fwdcloudsec

fwd:cloudsec 2025 Speaker Bios & Abstracts | fwd:cloudsec

fwd:cloudsec is a non-profit conference on cloud security. At this conference you can expect discussions about all the major cloud platforms, both attack and defense research, limitations of security...

fwdcloudsec.org

🥷 Detect & defend vs Entra ID persistence! From my RSAC Cloud Summit talk, I've shared how attackers persist through Entra ID roles, applications, and authentication... and how you can stop them: kknowl.es/posts/defend...

Persisting Unseen: Defending against Entra ID persistence

I recently presented “Persisting Unseen: Attacker Methods of Infesting Entra ID” at RSAC’s virtual Cloud Security seminar. This session introduced some methods attackers may use now or in the near fut...

kknowl.es

Excited to speak at @fwdcloudsec.org in Denver on June 30 with Anthony Randazzo! We’ll share lessons from a year of cloud threat hunting. Don’t miss other @securitylabs.datadoghq.com talks from @siigil.bsky.social on EntraID escalation and @sethsec.bsky.social on AMI name confusion as well!

fwd:cloudsec 2025 Speaker Bios & Abstracts | fwd:cloudsec

fwd:cloudsec is a non-profit conference on cloud security. At this conference you can expect discussions about all the major cloud platforms, both attack and defense research, limitations of security...

fwdcloudsec.org

🌐 I'll be speaking at RSA Conference's Virtual Seminar on Cloud Security on June 5, 2025! I'll be sharing a technical overview of Entra persistence techniques for all levels. You can sign up to stop by here: www.rsaconference.com/library/virt...

The CFP for fwd:cloudsec Europe is now open! We're looking for practitioner-focused cloud security content, and we encourage all practitioners to submit, whatever your role or level of experience. The CFP is open until July 11th. Read more: fwdcloudsec.org/conference/e...

CFP | EU 2025 | fwd:cloudsec

fwd:cloudsec is a non-profit conference on cloud security. At this conference you can expect discussions about all the major cloud platforms, both attack and defense research, limitations of security...

fwdcloudsec.org

👾 It's up!! Everything you ever wanted to know about Entra Administrative Unit (AU) attack paths, from my talk at @specterops.io SO-CON 😁 www.youtube.com/watch?v=oxD7...

Abusing AUs, Confusing the SOC: Entra ID's Administrative Unit Attack Paths | SO-CON 2025

YouTube video by SpecterOps

youtube.com

In our latest blog post, @xpnsec.com breaks down how SQL Server Transparent Data Encryption works, shares new methods for brute-forcing database encryption keys, & reveals a default key used by ManageEngine's ADSelfService product backups. Read more 👉 ghst.ly/4iXFTyF

Had a fantastic time at @specterops.bsky.social SO-CON and Azure training! So much to learn, and so many incredible people to meet. Feeling excited to apply all this knowledge... time to head home. 😁

Excited to be at @specterops.bsky.social SO-CON this week!! If you're around, I'll be presenting "Abusing AUs, Confusing the SOC" tomorrow bright & early:

🛡️ We found a bug in restricted AUs that let accounts stay restricted (forever!) without an AU, preventing containment. Glad this is fixed now! More details here: securitylabs.datadoghq.com/articles/cre...

Creating immutable users through a bug in Entra ID restricted administrative units | Datadog Security Labs

Imagine trying to disable a malicious user in your Azure environment, only to find it can't be modified! We recently identified a timing-based bug in Entra ID's restricted administrative units (AUs) t...

securitylabs.datadoghq.com

The Datadog Security Digest is a monthly, practitioner-focused newsletter. Don't miss our February edition going live tomorrow! securitylabs.datadoghq.com/newsletters/...

We discovered a pattern in the way many projects retrieve Amazon Machine Images (AMIs), allowing attackers to publish AMIs with specially crafted names and gain code execution within vulnerable accounts. securitylabs.datadoghq.com/articles/who... by @sethsec.bsky.social

whoAMI: A cloud image name confusion attack | Datadog Security Labs

Detailing the discovery and impact of the whoAMI cloud image name confusion attack, which could allow attackers to execute code within AWS accounts due to a vulnerable pattern in AMI retrieval.

securitylabs.datadoghq.com

Check out this new blog post from @andyrobbins.bsky.social discussing the fundamental components & mechanics that enable the emergence of critical Attack Paths in Microsoft's increasingly popular Intune product. ghst.ly/3Cd5cwH

Intune Attack Paths — Part 1

Intune is an attractive system for adversaries to target…

ghst.ly

🎄Have you ever paid for a simple product and thought, "Hey, I could build that"? As a pre-holiday project, I tried my hand at "home cooking" my own web text editor with GPT Canvas: kknowl.es/posts/home-c... + the results: github.com/siigil/brevity

Home cooking apps with AI assistance

This is a reflective end-of-year post on using AI to make our app wishes come true. Happy holidays! ❄️

kknowl.es

👻 Excited to be presenting "Abusing AUs, Confusing the SOC: Entra ID's Administrative Unit Attack Paths" at #SOCON2025, March 31-April 1! You can register to join me with discount code SOCONSPEAKER20: ghst.ly/socon25-spkr

"Escalating privileges to read secrets with Azure Key Vault access policies" by @siigil.bsky.social securitylabs.datadoghq.com/articles/esc...

Escalating privileges to read secrets with Azure Key Vault access policies | Datadog Security Labs

Azure Key Vault Contributors are not allowed access to Key Vault keys, certificates, and secrets. But did you know they can still gain access to this sensitive data? This post will cover a privilege e...

securitylabs.datadoghq.com

🔑 Azure Key Vault Contributors can't access keys... but they CAN modify access policies! More on how this can lead to unintended data access here: securitylabs.datadoghq.com/articles/esc...

Escalating privileges to read secrets with Azure Key Vault access policies | Datadog Security Labs

Azure Key Vault Contributors are not allowed access to Key Vault keys, certificates, and secrets. But did you know they can still gain access to this sensitive data? This post will cover a privilege e...

securitylabs.datadoghq.com

🎄 I shared a lab on reviewing Azure security with KQL + Resource Graph Explorer! My walkthrough is available as Day 14 of the Advent of Cloud Security: ❄️ Calendar, Day 14: advent.cloudsecuritypodcast.tv ❄️ Full Repo: github.com/siigil/azure...

GitHub - siigil/azure-kql-demo: Demo: Review your Azure security with the power of Resource Graph + KQL!

Demo: Review your Azure security with the power of Resource Graph + KQL! - siigil/azure-kql-demo

github.com

Check out the kickoff to @hotnops.bsky.social's multi-part blog series on attacker tradecraft around the syncing mechanics between Active Directory & Entra. In this first part, he shows how complete control of an Entra user is equal to compromise of the on-premises user. ➡️ ghst.ly/3Bu19eW

Attacking Entra Metaverse: Part 1

This is part one in a two (maybe three…) part series regarding attacker tradecraft around the syncing mechanics between Active Directory…

ghst.ly