Sign in

sapirxfed.bsky.social

@sapirxfed.bsky.social
687 followers 39 following 43 posts

Security researcher. I have a blog: sapirxfed.com

PostsRepliesMedia
sapirxfed.bsky.social @sapirxfed.bsky.social · 20/02/2026
This is amazing research. Robbe explained every step so well and provided PS command for everything! As a person who is a bit scared of all the new AI agents thingy, I really enjoyed reading this! @robbevddaele.bsky.social hybridbrothers.com/posts/agenti...
hybridbrothers.com
Remediating Agent Identities for Identity Admins and SOCs | Hybrid Brothers
With Microsoft launching Agent ID at the end of 2025, a new kind of identities were born in Entra ID. These identities are specially built for dynamic requirements of AI Agents, and is therefore a com...
000
sapirxfed.bsky.social @sapirxfed.bsky.social · 20/02/2026
I haven't been here for a while 🙃 It's nice to be back! I wrote a nice post if you are interested 🙂 it contains a lot of IOCs and real-world statistics🩵 www.wiz.io/blog/detecti...
wiz.io
Uncovering Malicious OAuth Campaigns in Entra ID | Wiz Blog
Learn how Wiz Research automates detection of emerging malicious Azure app and consent phishing campaigns.
020
Reposted by @sapirxfed.bsky.social
Thomas Naunheim @naunheim.cloud · 11/02/2025
Enhancements in #MicrosoftEntra (diagnostic) logs: Several interesting sign-in properties (including Session ID, status for Token Protection, or GSA traffic) have been added to the sign-in logs and available in #MicrosoftSentinel. (1/3)
132
sapirxfed.bsky.social @sapirxfed.bsky.social · 11/02/2025
Some first-party apps that support ROPC flow, I see some FOCI apps in there 🫣 (I tested it!)
120
sapirxfed.bsky.social @sapirxfed.bsky.social · 11/02/2025
Can someone explain what scenario can cause password failure log in non-interactive sign-in logs? 😥 @merill.net @fabian.bader.cloud
100
sapirxfed.bsky.social @sapirxfed.bsky.social · 10/02/2025
Want to avoid microsoft graph activity log detection? Just create all your requests as $batch And you're done 😋
media.tenor.com
a pixelated image of a little girl in a red jacket looking up
ALT: a pixelated image of a little girl in a red jacket looking up
150
sapirxfed.bsky.social @sapirxfed.bsky.social · 09/02/2025
I just found out that Project Zero has released a Windows Registry Research Series, and I'm really looking forward to reading it! googleprojectzero.blogspot.com/2024/04/the-wi…
media.tenor.com
a close up of a cartoon bunny with the word wow written on it
ALT: a close up of a cartoon bunny with the word wow written on it
040
sapirxfed.bsky.social @sapirxfed.bsky.social · 04/02/2025
Omg I just realized all the good stuff happens here! It's like heaven of blog posts !!!
media.tenor.com
an animated image of elsa from frozen 2 says i am ready
ALT: an animated image of elsa from frozen 2 says i am ready
020
sapirxfed.bsky.social @sapirxfed.bsky.social · 14/01/2025
That looks like a good one to read
010
sapirxfed.bsky.social @sapirxfed.bsky.social · 27/11/2024
I really enjoyed reading parts 1 and 2 of this series!🤩💪 www.edtechirl.com/p/gaining-in...
edtechirl.com
Gaining Initial Access Part 1: How Do Attackers Find People to Target?
A look at how to enumerate users accounts in a M365 tenant
020
sapirxfed.bsky.social @sapirxfed.bsky.social · 26/11/2024
Hybrid attack paths sound like a crazy capability!! I love correlating stuff 😂
010
sapirxfed.bsky.social @sapirxfed.bsky.social · 24/11/2024
Waiting for today's entra news so bad, I can't find anything to read 🥲
media.tenor.com
a little girl is standing in front of a mirror with her fist in the air and says `` can 't wait ! ''
ALT: a little girl is standing in front of a mirror with her fist in the air and says `` can 't wait ! ''
010
sapirxfed.bsky.social @sapirxfed.bsky.social · 24/11/2024
Currently working on a cool automation that sends you a message every time something is added to version v1.0 in the changelog. Would anyone be interested in the code?
media.tenor.com
a cat wearing glasses and a tie is laying in front of a laptop .
ALT: a cat wearing glasses and a tie is laying in front of a laptop .
010
sapirxfed.bsky.social @sapirxfed.bsky.social · 20/11/2024
I just read that security defaults become disable as soon as there is at least one CAP, is this wise? In practice it can be a very specific CAP, for which many security mechanisms are lost
100
sapirxfed.bsky.social @sapirxfed.bsky.social · 20/11/2024
Copilot is now part of Entra, and I wonder. 1. How does it handle permissions 2. Can we get access to data we are not supposed to be able to read 3. Does it also perform write/update actions for you, or only read? This is going to be interesting 💣
130
sapirxfed.bsky.social @sapirxfed.bsky.social · 18/11/2024
So true !!
030
sapirxfed.bsky.social @sapirxfed.bsky.social · 18/11/2024
Do you know if there is a large amount of entra sign-in logs example data so I can work on it? I have a cool idea 🙂
000
sapirxfed.bsky.social @sapirxfed.bsky.social · 18/11/2024
Perfect rainy morning and the new entra.news (: it's like my dad used to read the paper, but instead of wars, I read about the great new CAE video 😜
130
sapirxfed.bsky.social @sapirxfed.bsky.social · 17/11/2024
I love it here. It feels more pure 🙂
020
sapirxfed.bsky.social @sapirxfed.bsky.social · 16/11/2024
Saturday study session 🙃 any good reading materials?
240
sapirxfed.bsky.social @sapirxfed.bsky.social · 14/11/2024
Wrote a small post sharing my random thoughts on some key sign-in fields!🙃 if you're into security logs and detection ideas- you might enjoy it! More rambling to come! 👀 sapirxfed.com/2024/11/14/e...
sapirxfed.com
Entra Sign-In logs hidden gems
This short post is here to raise awareness about some super useful fields in the sign-in logs. We all know how essential these logs are—if you want to get things done in the cloud, it usually start…
4246
sapirxfed.bsky.social @sapirxfed.bsky.social · 14/11/2024
I have a day off of work today. So, I'm writing a short post for my blog!
media.tenor.com
a cartoon cat is making a funny face and saying `` yay '' .
ALT: a cartoon cat is making a funny face and saying `` yay '' .
021
sapirxfed.bsky.social @sapirxfed.bsky.social · 13/11/2024
No more depression posts on this social media platform! I'm a new, optimistic person!
media.tenor.com
a cartoon penguin wearing a blue jacket and sunglasses
ALT: a cartoon penguin wearing a blue jacket and sunglasses
210
sapirxfed.bsky.social @sapirxfed.bsky.social · 13/11/2024
Let's create a discussion about #Entra device id in the Sign in logs. For me, it's completely voodoo. One time, my registered device id was PIO, and the next time, it was just exposed there.
media.tenor.com
a rabbit from the secret life of pets is making a funny face and saying heh .
ALT: a rabbit from the secret life of pets is making a funny face and saying heh .
110
sapirxfed.bsky.social @sapirxfed.bsky.social · 13/11/2024
One day, you are nothing, and the next day, you are #AADInternals contributer 😎
050
sapirxfed.bsky.social @sapirxfed.bsky.social · 13/11/2024
OK, I'm here. Now what ? @xpnsec.com 🙈
162