1.
Ru Campbell
@rucam365
@janbakker_ Ah, I hadn’t read the docs yet. Great! Well, not great, but good for my demos
If for desktop clien… twitter.com/i/web/status/1…
If for desktop clien… twitter.com/i/web/status/1…
2.
Ru Campbell
@rucam365
New blog post: Newly registered domains can be a first sign of an attack.
In my blog post I outline a process to… twitter.com/i/web/status/1…
In my blog post I outline a process to… twitter.com/i/web/status/1…
Retweet of status by @fabian_bader
3.
4.
5.
6.
7.
Ru Campbell
@rucam365
Microsoft Entra Privilege Escalation
The title probably got your attention, and it should.
#microsoft… twitter.com/i/web/status/1…
The title probably got your attention, and it should.
#microsoft… twitter.com/i/web/status/1…
Retweet of status by @DijkmanRogier
Ru Campbell
@rucam365
A not so uncommon deployment scenario for MDE - disconnected endpoints and sitting behind a proxy.
A good read
techcommunity.microsoft.com/t5/microsoft-d…
A good read
techcommunity.microsoft.com/t5/microsoft-d…
Ru Campbell
@rucam365
I present to you:
The Hitchhiker's Guide to Microsoft Defender for Endpoint exclusions
Learn about all the exclu… twitter.com/i/web/status/1…
The Hitchhiker's Guide to Microsoft Defender for Endpoint exclusions
Learn about all the exclu… twitter.com/i/web/status/1…
Retweet of status by @fabian_bader
Ru Campbell
@rucam365
This week, Sentinel expert @reprise_99 joined @M365Rising and me to talk about...
Starting #365DaysofKQL
What… twitter.com/i/web/status/1…
Starting #365DaysofKQL
What… twitter.com/i/web/status/1…
Ru Campbell
@rucam365
1\ How to prove malicious macro was enabled & clicked? #DFIR
HKEY_LOCAL_MACHINE\USERDAT\Software\Microsoft\Offi… twitter.com/i/web/status/1…
HKEY_LOCAL_MACHINE\USERDAT\Software\Microsoft\Offi… twitter.com/i/web/status/1…
Retweet of status by @inversecos
8.
9.
10.
11.
Ru Campbell
@rucam365
Looking forward to Christmas break to catch up on 100+ open tabs for blogs by... #FF
@janbakker_
@ooms_rudy… twitter.com/i/web/status/1…
@janbakker_
@ooms_rudy… twitter.com/i/web/status/1…
Ru Campbell
@rucam365
Blog link if anyone's interested - well worth your time
blog.palantir.com/microsoft-defe…
blog.palantir.com/microsoft-defe…
Ru Campbell
@rucam365
Awesome to be joined on this week's show by Microsoft legend @stephenlrose who shared with us a bunch of wisdom:
… twitter.com/i/web/status/1…
… twitter.com/i/web/status/1…
Retweet of status by @CloudCons365
Ru Campbell
@rucam365
You can't force a dynamic group membership refresh...
Unless you use this one weird trick pic.twitter.com/yLOv0UKfRb
Unless you use this one weird trick pic.twitter.com/yLOv0UKfRb
Retweet of status by @NathanMcNulty
...but wait! There's more!
1.
fakhright
@fakhright
astaghfirullah peng.krim guaaaaaaaa..............a *salto sambil solat*
