Sign in

sapirxfed.bsky.social

@sapirxfed.bsky.social
689 followers 39 following 43 posts

Security researcher. I have a blog: sapirxfed.com

PostsRepliesMedia
sapirxfed.bsky.social @sapirxfed.bsky.social · 20/02/2026
This is amazing research. Robbe explained every step so well and provided PS command for everything! As a person who is a bit scared of all the new AI agents thingy, I really enjoyed reading this! @robbevddaele.bsky.social hybridbrothers.com/posts/agenti...
hybridbrothers.com
Remediating Agent Identities for Identity Admins and SOCs | Hybrid Brothers
With Microsoft launching Agent ID at the end of 2025, a new kind of identities were born in Entra ID. These identities are specially built for dynamic requirements of AI Agents, and is therefore a com...
000
sapirxfed.bsky.social @sapirxfed.bsky.social · 20/02/2026
I haven't been here for a while 🙃 It's nice to be back! I wrote a nice post if you are interested 🙂 it contains a lot of IOCs and real-world statistics🩵 www.wiz.io/blog/detecti...
wiz.io
Uncovering Malicious OAuth Campaigns in Entra ID | Wiz Blog
Learn how Wiz Research automates detection of emerging malicious Azure app and consent phishing campaigns.
020
Reposted by @sapirxfed.bsky.social
Thomas Naunheim @naunheim.cloud · 11/02/2025
Enhancements in #MicrosoftEntra (diagnostic) logs: Several interesting sign-in properties (including Session ID, status for Token Protection, or GSA traffic) have been added to the sign-in logs and available in #MicrosoftSentinel. (1/3)
132
sapirxfed.bsky.social @sapirxfed.bsky.social · 11/02/2025
Some first-party apps that support ROPC flow, I see some FOCI apps in there 🫣 (I tested it!)
120
sapirxfed.bsky.social @sapirxfed.bsky.social · 11/02/2025
No 🥺 I saw it on my user, and I didn't change the password
010
sapirxfed.bsky.social @sapirxfed.bsky.social · 11/02/2025
Yet another time I impulsively post a random thought that appears to be wrong 🥲
010
sapirxfed.bsky.social @sapirxfed.bsky.social · 11/02/2025
Can someone explain what scenario can cause password failure log in non-interactive sign-in logs? 😥 @merill.net @fabian.bader.cloud
100
sapirxfed.bsky.social @sapirxfed.bsky.social · 11/02/2025
I saw $batch requests on my logs so I thought you can't see the payload, but then saw this - cloudbrothers.info/en/detect-th... So I might be wrong 🥺
cloudbrothers.info
Detect threats using Microsoft Graph activity logs - Part 2
In part one I focused mostly on detecting offensive security tools like AzureHound, GraphRunner, and PurpleKnight. In part two I will go into more depth how you can use the now available information f...
110
sapirxfed.bsky.social @sapirxfed.bsky.social · 10/02/2025
Want to avoid microsoft graph activity log detection? Just create all your requests as $batch And you're done 😋
media.tenor.com
a pixelated image of a little girl in a red jacket looking up
ALT: a pixelated image of a little girl in a red jacket looking up
150
sapirxfed.bsky.social @sapirxfed.bsky.social · 10/02/2025
Adding the github page :) github.com/zh54321/Grap...
github.com
GitHub - zh54321/GraphPreConsentExplorer: A comprehensive list of usable Entra ID first-party clients with pre-consented Microsoft Graph scopes, in a simple YAML-file explorable with a simple HTML GUI...
A comprehensive list of usable Entra ID first-party clients with pre-consented Microsoft Graph scopes, in a simple YAML-file explorable with a simple HTML GUI. - zh54321/GraphPreConsentExplorer
141
sapirxfed.bsky.social @sapirxfed.bsky.social · 09/02/2025
I just found out that Project Zero has released a Windows Registry Research Series, and I'm really looking forward to reading it! googleprojectzero.blogspot.com/2024/04/the-wi…
media.tenor.com
a close up of a cartoon bunny with the word wow written on it
ALT: a close up of a cartoon bunny with the word wow written on it
040
sapirxfed.bsky.social @sapirxfed.bsky.social · 04/02/2025
Omg I just realized all the good stuff happens here! It's like heaven of blog posts !!!
media.tenor.com
an animated image of elsa from frozen 2 says i am ready
ALT: an animated image of elsa from frozen 2 says i am ready
020
sapirxfed.bsky.social @sapirxfed.bsky.social · 25/01/2025
I love to show them the cool side of the security industry and use that to get them into things. My favorite - stuxnet. youtu.be/C8lj45IL5J4?...
010
sapirxfed.bsky.social @sapirxfed.bsky.social · 14/01/2025
Thats cool ! Is it a reference to the amazing white paper ? An ace up the sleeve 😜
110
sapirxfed.bsky.social @sapirxfed.bsky.social · 14/01/2025
That looks like a good one to read
010
sapirxfed.bsky.social @sapirxfed.bsky.social · 01/12/2024
What was your talk about? Looking forward watching it!
000
sapirxfed.bsky.social @sapirxfed.bsky.social · 27/11/2024
I really enjoyed reading parts 1 and 2 of this series!🤩💪 www.edtechirl.com/p/gaining-in...
edtechirl.com
Gaining Initial Access Part 1: How Do Attackers Find People to Target?
A look at how to enumerate users accounts in a M365 tenant
020
sapirxfed.bsky.social @sapirxfed.bsky.social · 26/11/2024
Hybrid attack paths sound like a crazy capability!! I love correlating stuff 😂
010
sapirxfed.bsky.social @sapirxfed.bsky.social · 25/11/2024
That's so awesome!! Thank you for the opportunity . It's so crazy to think that someone is reading my posts (and maybe even find it useful!!).
150
sapirxfed.bsky.social @sapirxfed.bsky.social · 24/11/2024
Waiting for today's entra news so bad, I can't find anything to read 🥲
media.tenor.com
a little girl is standing in front of a mirror with her fist in the air and says `` can 't wait ! ''
ALT: a little girl is standing in front of a mirror with her fist in the air and says `` can 't wait ! ''
010
sapirxfed.bsky.social @sapirxfed.bsky.social · 24/11/2024
Currently working on a cool automation that sends you a message every time something is added to version v1.0 in the changelog. Would anyone be interested in the code?
media.tenor.com
a cat wearing glasses and a tie is laying in front of a laptop .
ALT: a cat wearing glasses and a tie is laying in front of a laptop .
010
sapirxfed.bsky.social @sapirxfed.bsky.social · 20/11/2024
I just read that security defaults become disable as soon as there is at least one CAP, is this wise? In practice it can be a very specific CAP, for which many security mechanisms are lost
100
sapirxfed.bsky.social @sapirxfed.bsky.social · 20/11/2024
Copilot is now part of Entra, and I wonder. 1. How does it handle permissions 2. Can we get access to data we are not supposed to be able to read 3. Does it also perform write/update actions for you, or only read? This is going to be interesting 💣
130
sapirxfed.bsky.social @sapirxfed.bsky.social · 18/11/2024
So true !!
030
sapirxfed.bsky.social @sapirxfed.bsky.social · 18/11/2024
Do you know if there is a large amount of entra sign-in logs example data so I can work on it? I have a cool idea 🙂
000
sapirxfed.bsky.social @sapirxfed.bsky.social · 18/11/2024
Perfect rainy morning and the new entra.news (: it's like my dad used to read the paper, but instead of wars, I read about the great new CAE video 😜
130
sapirxfed.bsky.social @sapirxfed.bsky.social · 17/11/2024
I love it here. It feels more pure 🙂
020
sapirxfed.bsky.social @sapirxfed.bsky.social · 17/11/2024
Thank you for reading it 🥹
000
sapirxfed.bsky.social @sapirxfed.bsky.social · 17/11/2024
Thanks !! I really appreciate it 🙂
000
sapirxfed.bsky.social @sapirxfed.bsky.social · 17/11/2024
Haha tell me about it I'm a hugeeee fan!!
000
sapirxfed.bsky.social @sapirxfed.bsky.social · 16/11/2024
Mostly Entra stuff, yeah 🙂
000
sapirxfed.bsky.social @sapirxfed.bsky.social · 16/11/2024
Saturday study session 🙃 any good reading materials?
240
sapirxfed.bsky.social @sapirxfed.bsky.social · 15/11/2024
That's a scary thought
120
sapirxfed.bsky.social @sapirxfed.bsky.social · 14/11/2024
Crowdstrike representative here 🤚 I'll send them the message 😂
010
sapirxfed.bsky.social @sapirxfed.bsky.social · 14/11/2024
Omg the avocado toast looks 10/10 😂
100
sapirxfed.bsky.social @sapirxfed.bsky.social · 14/11/2024
Wrote a small post sharing my random thoughts on some key sign-in fields!🙃 if you're into security logs and detection ideas- you might enjoy it! More rambling to come! 👀 sapirxfed.com/2024/11/14/e...
sapirxfed.com
Entra Sign-In logs hidden gems
This short post is here to raise awareness about some super useful fields in the sign-in logs. We all know how essential these logs are—if you want to get things done in the cloud, it usually start…
4246
sapirxfed.bsky.social @sapirxfed.bsky.social · 14/11/2024
I have a day off of work today. So, I'm writing a short post for my blog!
media.tenor.com
a cartoon cat is making a funny face and saying `` yay '' .
ALT: a cartoon cat is making a funny face and saying `` yay '' .
021
sapirxfed.bsky.social @sapirxfed.bsky.social · 13/11/2024
I'll check that ! It was the same device but different resources, I didn't know it could affect the logs!
010
sapirxfed.bsky.social @sapirxfed.bsky.social · 13/11/2024
I'm on it! And so far, I love what I see !!
010
sapirxfed.bsky.social @sapirxfed.bsky.social · 13/11/2024
No more depression posts on this social media platform! I'm a new, optimistic person!
media.tenor.com
a cartoon penguin wearing a blue jacket and sunglasses
ALT: a cartoon penguin wearing a blue jacket and sunglasses
210
sapirxfed.bsky.social @sapirxfed.bsky.social · 13/11/2024
Haha I'll do my best ! 💪
010
sapirxfed.bsky.social @sapirxfed.bsky.social · 13/11/2024
Let's create a discussion about #Entra device id in the Sign in logs. For me, it's completely voodoo. One time, my registered device id was PIO, and the next time, it was just exposed there.
media.tenor.com
a rabbit from the secret life of pets is making a funny face and saying heh .
ALT: a rabbit from the secret life of pets is making a funny face and saying heh .
110
sapirxfed.bsky.social @sapirxfed.bsky.social · 13/11/2024
One day, you are nothing, and the next day, you are #AADInternals contributer 😎
050
sapirxfed.bsky.social @sapirxfed.bsky.social · 13/11/2024
OK, I'm here. Now what ? @xpnsec.com 🙈
162