Reposted by Christopher BrummMerill Fernando 💚 @merill.net · 10/01/2026🚨 Global Secure Access ≠ “replace VPN and done.” I just published a new podcast with Chris Brum where we break down real-world Microsoft GSA deployments 🧵👇 152
Reposted by Christopher BrummFabian Bader @fabian.bader.cloud · 02/01/2026#ConsentFix is a great way for attackers to work around some protective layers but not all. @naunheim.cloud , @cbrhh.bsky.social and I wrote a blog post on detection and mitigations. Hope you find it useful and can adapt it to your environment. www.glueckkanja.com/de/posts/202... 083
Christopher Brumm @cbrhh.bsky.social · 17/01/2025Unfortunately, that was only a matter of time! This video combines two of the most dangerous tools at the moment associated with phishing - and it's surprisingly simple! www.youtube.com/watch?v=Dp1z... Do we have defense options? Read on 👇youtube.comTokenSmith Meets Evilginx: Token Theft Combined with Entra Conditional Access BypassYouTube video by SYNACK Time 1104
Christopher Brumm @cbrhh.bsky.social · 10/01/2025Global Secure Access and Token Replay - a thread... Did you know that "Microsoft Entra Internet Access for Microsoft" is included in your Entra ID P1 license? -> learn.microsoft.com/en-us/entra/... 1/4learn.microsoft.comWhat is Global Secure Access? - Global Secure AccessLearn how Microsoft's Security Service Edge (SSE) solution, Global Secure Access, provides network access control and visibility to users and devices inside and outside a traditional office. 271
Reposted by Christopher BrummFabian Bader @fabian.bader.cloud · 09/01/2025gist.github.com/CloudProtect... This one does a very good job because it considers if the device is joined/registered any only looks at the AADGraph. For this resource its not normal that a non-registered device is accessing itgist.github.comUse Defender XDR advanced hunting query capabilities to detect possible device compliance bypass attacks for Entra ID Conditional Access according to the vulnerability disclosed by Yuya Chudo (https:/...Use Defender XDR advanced hunting query capabilities to detect possible device compliance bypass attacks for Entra ID Conditional Access according to the vulnerability disclosed by Yuya Chudo (http... 021
Reposted by Christopher BrummFabian Bader @fabian.bader.cloud · 19/12/2024I hope every SOC is monitoring incoming emails for signs of anomalous incoming mail amounts to your users. If this happens the execution of any RMM by the target user is a high alert you should follow up on. 231
Reposted by Christopher BrummFabian Bader @fabian.bader.cloud · 19/12/2024🔊 @cbrhh and I will be part of this year's Experts Live DK with our session: The state of passkey in 2025 #ELDK2025 conference.expertsli... 131
Christopher Brumm @cbrhh.bsky.social · 19/12/2024Great news! 🎉 I have the opportunity to speak in March at the #eldk2025 in Copenhagen! I will do a comparison of Entra Private Access and a classic VPN solution and show why Global Secure Access is much closer to my understanding of Zero Trust Network Access. Hope to see you there! 062
