41554 blogs · [ { "id": "01a0e753-b510-7014-9cbb-871e306a28c6", "title": "Hands-On Post Quantum TLS Lab", "url": "https://cyberdom.blog/hands-on-post-quantum-tls-lab/", "published_at": "2026-09-26T17:03:39+00:00" }, { "id": "01a08765-f7b7-7053-8c48-aa94f351ef12", "title": "Blueprint Inheritance Abuse in Entra Agent ID", "url": "https://cyberdom.blog/blueprint-inheritance-abuse-in-entra-agent-id/", "published_at": "2026-09-07T08:36:05+00:00" }, { "id": "01a08765-f7b7-7053-8c48-aa94f3c5df32", "title": "Own an Agent through its Skills", "url": "https://cyberdom.blog/own-an-agent-through-its-skills/", "published_at": "2026-08-30T06:10:50+00:00" }, { "id": "01a08765-f7b7-7053-8c48-aa94f44529a5", "title": "Exploiting Azure IMDS", "url": "https://cyberdom.blog/exploiting-azure-imds/", "published_at": "2026-07-26T19:33:52+00:00" }, { "id": "01a08765-f7b7-7053-8c48-aa94f49c1794", "title": "Inside Entra Agent ID", "url": "https://cyberdom.blog/inside-entra-agent-id/", "published_at": "2026-07-25T18:50:39+00:00" }, { "id": "01a08765-f7b7-7053-8c48-aa94f4e5f800", "title": "Entra ID User App Config Abuse", "url": "https://cyberdom.blog/entra-id-user-app-config-abuse/", "published_at": "2026-07-11T18:30:57+00:00" }, { "id": "01a08765-f7b7-7053-8c48-aa94f5292bb1", "title": "From ESTS Cookie Replay to Inbox Persistence", "url": "https://cyberdom.blog/from-ests-cookie-replay-to-inbox-persistence/", "published_at": "2026-06-27T17:45:00+00:00" }, { "id": "01a08765-f7b7-7053-8c48-aa94f590559b", "title": "Weaponizing Exchange Online Inbox Rules", "url": "https://cyberdom.blog/weaponizing-exchange-online-inbox-rules/", "published_at": "2026-06-25T17:45:11+00:00" }, { "id": "01a08765-f7b7-7053-8c48-aa94f597a7fd", "title": "Harvest Now Decrypt Later", "url": "https://cyberdom.blog/harvest-now-decrypt-later/", "published_at": "2026-06-23T17:46:41+00:00" }, { "id": "01a08765-f7b7-7053-8c48-aa94f5ea15cb", "title": "Microsoft Edge Heap Memory Exposure (MemEdge)", "url": "https://cyberdom.blog/microsoft-edge-heap-memory-exposure-memedge/", "published_at": "2026-06-21T19:43:55+00:00" }, { "id": "01a08765-f7b7-7053-8c48-aa94f6703950", "title": "The AI Middleware Risks in Claude Desktop", "url": "https://cyberdom.blog/the-ai-middleware-risks-in-claude-desktop/", "published_at": "2026-05-16T18:04:42+00:00" }, { "id": "01a0c505-2400-73a0-a8de-b8d438740581", "title": "Sentinel MCP for Threat Hunting and Investigations", "url": "https://cyberdom.blog/sentinel-mcp-for-threat-hunting-and-investigations/", "published_at": "2026-03-14T17:18:38+00:00" }, { "id": "01a0c505-2400-73a0-a8de-b8d438d1f22b", "title": "Securing AI at the Gate", "url": "https://cyberdom.blog/securing-ai-at-the-gate/", "published_at": "2026-02-27T13:01:11+00:00" }, { "id": "01a0c505-2400-73a0-a8de-b8d438edc6dc", "title": "The Part of AI Red Teaming Nobody Talks About", "url": "https://cyberdom.blog/the-part-of-ai-red-teaming-nobody-talks-about/", "published_at": "2026-02-22T13:56:25+00:00" }, { "id": "01a0c505-2400-73a0-a8de-b8d43987d55a", "title": "Entra ID Log Analyzer: Turning Raw Logs into Stories", "url": "https://cyberdom.blog/entra-id-log-analyzer-turning-raw-logs-into-stories/", "published_at": "2025-11-11T19:45:23+00:00" }, { "id": "01a0c505-2400-73a0-a8de-b8d439e25a10", "title": "The Hidden Risks inside ChatGPT in Entra ID", "url": "https://cyberdom.blog/the-hidden-risks-inside-chatgpt-in-entra-id/", "published_at": "2025-11-11T19:09:50+00:00" }, { "id": "01a0c505-2400-73a0-a8de-b8d43adfff88", "title": "Sentinel MCP Unlocked", "url": "https://cyberdom.blog/sentinel-mcp-unlocked/", "published_at": "2025-10-21T20:15:17+00:00" }, { "id": "01a0c505-2400-73a0-a8de-b8d43b49db80", "title": "Unlocking Microsoft Sentinel MCP", "url": "https://cyberdom.blog/unlocking-microsoft-sentinel-mcp/", "published_at": "2025-10-04T17:19:03+00:00" }, { "id": "01a0c505-2400-73a0-a8de-b8d43bd53913", "title": "Token Protection: The Good, the Bad, and the Assumptions", "url": "https://cyberdom.blog/token-protection-the-good-the-bad-and-the-assumptions/", "published_at": "2025-09-27T17:27:14+00:00" }, { "id": "01a0c505-2400-73a0-a8de-b8d43c49b278", "title": "Ghosting the Sensor: Disrupting Defender for Identity Without Detection", "url": "https://cyberdom.blog/ghosting-the-sensor-disrupting-defender-for-identity-without-detection/", "published_at": "2025-07-26T17:25:46+00:00" }, { "id": "01a0c505-2400-73a0-a8de-b8d43c86a521", "title": "macOS Forensics Artifacts and Commands", "url": "https://cyberdom.blog/macos-forensics-artifacts-and-commands/", "published_at": "2025-07-19T07:25:22+00:00" }, { "id": "01a0c516-ecdc-7056-8c31-4ecc2b3016cd", "title": "SharePoint Online as a Weapon: Offensive Tactics in Microsoft 365 Collaboration", "url": "https://cyberdom.blog/sharepoint-online-as-a-weapon-offensive-tactics-in-microsoft-365-collaboration/", "published_at": "2025-07-14T04:37:21+00:00" }, { "id": "01a0c516-ecdc-7056-8c31-4ecc2bba5e1d", "title": "Adversarial AI Digest – June, 2025", "url": "https://cyberdom.blog/adversarial-ai-digest-june-2025/", "published_at": "2025-07-08T12:41:11+00:00" }, { "id": "01a0c516-ecdc-7056-8c31-4ecc2c2d6efb", "title": "Entra ID Incident Response: Advanced PowerShell Techniques", "url": "https://cyberdom.blog/entra-id-incident-response-advanced-powershell-techniques/", "published_at": "2025-07-05T20:08:00+00:00" }, { "id": "01a0c516-ecdc-7056-8c31-4ecc2ce91213", "title": "Inside dMSA on AD 2025: How It Works, How to Monitor It, Why It Matters", "url": "https://cyberdom.blog/inside-dmsa-on-ad-2025-how-it-works-how-to-monitor-it-why-it-matters/", "published_at": "2025-06-24T20:07:47+00:00" }, { "id": "01a0c516-ecdc-7056-8c31-4ecc2d6cf40c", "title": "A New Day, A New Method: QR Code in Entra ID", "url": "https://cyberdom.blog/qr-code-in-entra-id/", "published_at": "2025-05-02T10:27:02+00:00" }, { "id": "01a0c516-ecdc-7056-8c31-4ecc2d8ae43f", "title": "Inside the Microsoft Teams Attack Matrix: Unpacking the The Frontier in Collaboration Threats", "url": "https://cyberdom.blog/inside-the-microsoft-teams-attack-matrix-unpacking-the-the-frontier-in-collaboration-threats/", "published_at": "2025-04-18T09:05:58+00:00" }, { "id": "01a0c516-ecdc-7056-8c31-4ecc2e17d609", "title": "Abusing the Windows Update Stack to Gain SYSTEM Access (CVE-2025-21204)", "url": "https://cyberdom.blog/abusing-the-windows-update-stack-to-gain-system-access-cve-2025-21204/", "published_at": "2025-04-14T17:15:11+00:00" }, { "id": "01a0c516-ecdc-7056-8c31-4ecc2efa0a27", "title": "AI Red Team: Be the PyRIT – Initiate the Power of PyRIT", "url": "https://cyberdom.blog/ai-red-team-be-the-pyrit-initiate-the-power-of-pyrit/", "published_at": "2024-11-04T19:18:07+00:00" }, { "id": "01a0c516-ecdc-7056-8c31-4ecc2f02c60d", "title": "Defender for Endpoint: Bypassing Lsass Dump with PowerShell", "url": "https://cyberdom.blog/defender-for-endpoint-bypassing-lsass-dump-with-powershell/", "published_at": "2024-11-02T14:32:00+00:00" }, { "id": "01a0c516-ecdc-7056-8c31-4ecc2fd3d7b8", "title": "Getting Started with PyRIT: Deployment Guide", "url": "https://cyberdom.blog/getting-started-with-pyrit-deployment-guide/", "published_at": "2024-10-28T04:51:58+00:00" }, { "id": "01a0c521-b2b5-72c9-ad25-b49e1f2d5eeb", "title": "Integrating PowerShell Logging into Microsoft Sentinel", "url": "https://cyberdom.blog/integrating-powershell-logging-into-microsoft-sentinel/", "published_at": "2024-10-25T05:31:24+00:00" }, { "id": "01a0c521-b2b5-72c9-ad25-b49e1fb8c79f", "title": "A Step-by-Step Guide for Microsoft 365 Copilot API Development", "url": "https://cyberdom.blog/a-step-by-step-guide-for-microsoft-365-copilot-api-development/", "published_at": "2024-10-16T14:58:06+00:00" }, { "id": "01a0c521-b2b5-72c9-ad25-b49e2085aa69", "title": "Azure Blob Storage PowerShell Scanning Script", "url": "https://cyberdom.blog/azure-blob-storage-powershell-scanning-script/", "published_at": "2024-10-16T08:21:17+00:00" }, { "id": "01a0c521-b2b5-72c9-ad25-b49e20e911b1", "title": "A Step-by-Step Guide to Run the Microsoft Copilot 365 API with Microsoft Graph", "url": "https://cyberdom.blog/a-step-by-step-guide-to-run-the-microsoft-copilot-365-api-with-microsoft-graph/", "published_at": "2024-10-14T10:17:13+00:00" }, { "id": "01a0c521-b2b5-72c9-ad25-b49e216ab2fa", "title": "Azure Ends TLS 1.0/1.1 Support: Key Script and Query", "url": "https://cyberdom.blog/azure-ends-tls-1-0-1-1-support-key-script-and-query/", "published_at": "2024-10-04T06:12:50+00:00" }, { "id": "01a0c521-b2b5-72c9-ad25-b49e21f37909", "title": "Shadow AI – Risks, Things and Prompt Security", "url": "https://cyberdom.blog/shadow-ai-risks-things-and-prompt-security/", "published_at": "2024-09-21T14:10:24+00:00" }, { "id": "01a0c521-b2b5-72c9-ad25-b49e22af718e", "title": "Cloud Security Toolkit: Your Ultimate Resource Hub!", "url": "https://cyberdom.blog/cloud-security-toolkit-your-ultimate-resource-hub/", "published_at": "2024-09-21T07:45:04+00:00" }, { "id": "01a0c521-b2b5-72c9-ad25-b49e231a6d3a", "title": "Microsoft AI Security Layers Review", "url": "https://cyberdom.blog/microsoft-ai-security-layers-review/", "published_at": "2024-08-24T10:00:59+00:00" }, { "id": "01a0c521-b2b5-72c9-ad25-b49e23a75ed6", "title": "Microsoft Defender Delayed Updates", "url": "https://cyberdom.blog/microsoft-defender-delayed-updates/", "published_at": "2024-07-20T10:04:06+00:00" }, { "id": "01a0c521-b2b5-72c9-ad25-b49e245c7741", "title": "AWS CloudTrail – HIDDEN_DUE_TO_SECURITY_REASONS", "url": "https://cyberdom.blog/aws-cloudtrail-hidden_due_to_security_reasons/", "published_at": "2024-05-11T20:13:46+00:00" }, { "id": "01a0c52d-40b1-73a7-8adf-4545f68f39f7", "title": "Microsoft 365 Cloud investigation via Unified Audit Log – Insights and Tips", "url": "https://cyberdom.blog/microsoft-365-cloud-investigation-via-unified-audit-log-insights-and-tips/", "published_at": "2024-04-26T10:13:19+00:00" }, { "id": "01a0c52d-40b1-73a7-8adf-4545f726d159", "title": "The Power of Promptbooks: A Closer Look at Copilot for Security Promptbook", "url": "https://cyberdom.blog/the-power-of-promptbooks-a-closer-look-at-copilot-for-security-promptbook/", "published_at": "2024-04-13T15:16:41+00:00" }, { "id": "01a0c52d-40b1-73a7-8adf-4545f7907043", "title": "Azure DevOps auditing with Microsoft Sentinel", "url": "https://cyberdom.blog/azure-devops-auditing-with-microsoft-sentinel/", "published_at": "2024-02-27T11:26:53+00:00" }, { "id": "01a0c52d-40b1-73a7-8adf-4545f8425247", "title": "Proactive Response: Any Breach (AnyDesk Incident)", "url": "https://cyberdom.blog/proactive-response-any-breach-anydesk-incident/", "published_at": "2024-02-03T14:10:30+00:00" }, { "id": "01a0c52d-40b1-73a7-8adf-4545f85b5390", "title": "Azure OpenAI: Security for GenAI and LLM", "url": "https://cyberdom.blog/azure-openai-security-for-genai-and-llm/", "published_at": "2024-02-03T11:46:29+00:00" }, { "id": "01a0c52d-40b1-73a7-8adf-4545f95755c3", "title": "Defender for Identity: Hunting for LDAP", "url": "https://cyberdom.blog/defender-for-identity-hunting-for-ldap/", "published_at": "2024-01-07T12:41:35+00:00" }, { "id": "01a0c52d-40b1-73a7-8adf-4545f9d5c9e3", "title": "Unmasking the Shadows: The Art of Threat Hunting in Defender for Identity", "url": "https://cyberdom.blog/unmasking-the-shadows-the-art-of-threat-hunting-in-defender-for-identity/", "published_at": "2023-12-09T16:43:59+00:00" }, { "id": "01a0c52d-40b1-73a7-8adf-4545fa072d6b", "title": "Spotting the Adversary with Microsoft Defender for Identity", "url": "https://cyberdom.blog/spotting-the-adversary-with-microsoft-defender-for-identity/", "published_at": "2023-12-03T18:54:19+00:00" }, { "id": "01a0c52d-40b1-73a7-8adf-4545fa5302b6", "title": "MDI Sensor on ADCS fails to start", "url": "https://cyberdom.blog/mdi-sensor-on-adcs-fails-to-start/", "published_at": "2023-11-04T18:39:41+00:00" }, { "id": "01a0c52d-40b1-73a7-8adf-4545faa633f5", "title": "GenAI Cybersecurity: Where are we? Threats, Risks, and More", "url": "https://cyberdom.blog/genai-cybersecurity-where-are-we-threats-risks-and-more/", "published_at": "2023-09-17T16:53:31+00:00" }, { "id": "01a0c537-dcf5-71ed-bf13-1f228ef047ea", "title": "Detecting Ransomware with Defender for Cloud Apps", "url": "https://cyberdom.blog/detecting-ransomware-with-defender-for-cloud-apps/", "published_at": "2023-08-27T07:00:21+00:00" }, { "id": "01a0c537-dcf5-71ed-bf13-1f228f87f1c9", "title": "Microsoft Sentinel Schema & Tables", "url": "https://cyberdom.blog/microsoft-sentinel-schema-tables/", "published_at": "2023-07-22T07:30:07+00:00" }, { "id": "01a0c537-dcf5-71ed-bf13-1f22900e3562", "title": "EASM vs. PT vs. VM & Defender EASM Approaches", "url": "https://cyberdom.blog/easm-vs-pt-vs-vm-defender-easm-approaches/", "published_at": "2023-07-07T06:08:10+00:00" }, { "id": "01a0c537-dcf5-71ed-bf13-1f2290c9c602", "title": "Unleashing the Power of Threat Hunting in the Cloud", "url": "https://cyberdom.blog/unleashing-the-power-of-threat-hunting-in-the-cloud/", "published_at": "2023-06-23T09:07:53+00:00" }, { "id": "01a0c537-dcf5-71ed-bf13-1f22910f1046", "title": "Understanding Prompt Injection – GenAI Risks", "url": "https://cyberdom.blog/understanding-prompt-injection-genai-risks/", "published_at": "2023-06-17T10:50:15+00:00" }, { "id": "01a0c537-dcf5-71ed-bf13-1f2291585704", "title": "Advanced Hunting 4 ZIP/MOV", "url": "https://cyberdom.blog/advanced-hunting-4-zip-mov/", "published_at": "2023-06-03T07:31:49+00:00" }, { "id": "01a0c537-dcf5-71ed-bf13-1f2291aad5f3", "title": "The State of External Attack Surface Management", "url": "https://cyberdom.blog/the-state-of-external-attack-surface-management/", "published_at": "2023-05-27T14:39:41+00:00" }, { "id": "01a0c537-dcf5-71ed-bf13-1f22929621bc", "title": "Configure Conditional Access Token Protection (CATP) with Conditional Access Policy (CAP)", "url": "https://cyberdom.blog/configure-conditional-access-token-protection-catp-with-conditional-access-policy-cap/", "published_at": "2023-05-12T15:09:27+00:00" }, { "id": "01a0c537-dcf5-71ed-bf13-1f229370df1d", "title": "Azure AD Conditional Access Token protection (CATP) First Impressions", "url": "https://cyberdom.blog/azure-ad-conditional-access-token-protection-catp-first-impressions/", "published_at": "2023-05-12T09:29:17+00:00" }, { "id": "01a0c537-dcf5-71ed-bf13-1f2293fcbf30", "title": "Azure PIM Activation with additional MFA", "url": "https://cyberdom.blog/azure-pim-activation-with-addtional-mfa/", "published_at": "2023-04-26T19:11:03+00:00" }, { "id": "01a0c541-75c1-7174-9f14-3d5553a6e696", "title": "Malware Scanning in Defender for Cloud – Notes from the Field", "url": "https://cyberdom.blog/malware-scanning-in-defender-for-cloud-notes-from-the-field/", "published_at": "2023-04-01T17:36:40+00:00" }, { "id": "01a0c541-75c1-7174-9f14-3d5553e4617b", "title": "Practical Hunting from the field", "url": "https://cyberdom.blog/practical-advanced-hunting-from-the-field/", "published_at": "2023-03-06T14:30:15+00:00" }, { "id": "01a0c541-75c1-7174-9f14-3d55548a030f", "title": "Azure AD Access Review – Microsoft 365 Groups with Guest users", "url": "https://cyberdom.blog/azure-ad-access-review-microsoft-365-groups-with-guest-users/", "published_at": "2023-03-04T18:16:43+00:00" }, { "id": "01a0c541-75c1-7174-9f14-3d5555156d02", "title": "OSINT Tools", "url": "https://cyberdom.blog/osint-tools/", "published_at": "2023-03-04T14:28:31+00:00" }, { "id": "01a0c541-75c1-7174-9f14-3d5555b2f596", "title": "Cloud Penetration Testing from the field", "url": "https://cyberdom.blog/cloud-penetration-testing-from-the-field/", "published_at": "2023-03-04T12:11:01+00:00" }, { "id": "01a0c541-75c1-7174-9f14-3d55562f5208", "title": "Be the Purple with Generative AI", "url": "https://cyberdom.blog/be-the-purple-with-generativeai/", "published_at": "2023-03-04T10:05:15+00:00" }, { "id": "01a0c541-75c1-7174-9f14-3d5557115d10", "title": "Operate Defender for Office like a Pro", "url": "https://cyberdom.blog/protect-office-atp-like-a-pro/", "published_at": "2023-03-03T07:19:10+00:00" }, { "id": "01a0c541-75c1-7174-9f14-3d55580e4662", "title": "The Power of investigation with Defender for Identity", "url": "https://cyberdom.blog/the-power-of-ir-with-mdi-and-mde/", "published_at": "2023-02-26T14:58:32+00:00" }, { "id": "01a0c541-75c1-7174-9f14-3d555852d564", "title": "Scared Mailbox – The Risks with Shared Mailbox", "url": "https://cyberdom.blog/scared-mailbox-the-risks-with-shared-mailbox/", "published_at": "2023-02-17T07:12:22+00:00" }, { "id": "01a0c541-75c1-7174-9f14-3d555857a355", "title": "Investigation in Defender TI", "url": "https://cyberdom.blog/investigation-in-defender-ti/", "published_at": "2023-02-01T18:42:33+00:00" }, { "id": "01a0c54a-5697-7144-a9af-7555b19b45d0", "title": "Recon Azure AD", "url": "https://cyberdom.blog/recon-azure-ad/", "published_at": "2023-01-14T11:52:04+00:00" }, { "id": "01a0c54a-5697-7144-a9af-7555b1da3cb5", "title": "Hunting Service Principal with Microsoft Sentinel", "url": "https://cyberdom.blog/hunting-service-principal-with-microsoft-sentinel/", "published_at": "2023-01-13T01:53:45+00:00" }, { "id": "01a0c54a-5697-7144-a9af-7555b24e444e", "title": "GitHub Starter Guide", "url": "https://cyberdom.blog/test/", "published_at": "2023-01-03T09:11:00+00:00" }, { "id": "01a0c54a-5697-7144-a9af-7555b29debfe", "title": "Azure Blob Container for Defenders", "url": "https://cyberdom.blog/azure-blob-container-for-defenders/", "published_at": "2022-12-22T10:17:00+00:00" }, { "id": "01a0c54a-5697-7144-a9af-7555b367bf10", "title": "Play with Microsoft Graph PowerShell – MgGraph 101", "url": "https://cyberdom.blog/play-with-powershell-mg-ms-security-graph-101/", "published_at": "2022-12-18T09:18:43+00:00" }, { "id": "01a0c54a-5697-7144-a9af-7555b36b93a7", "title": "Cloud Misconfiguration and Risks – Azure", "url": "https://cyberdom.blog/cloud-misconfiguration-risks-azure-2/", "published_at": "2022-11-09T02:54:43+00:00" }, { "id": "01a0c54a-5697-7144-a9af-7555b425fedd", "title": "Cloud Misconfiguration & Risks – Azure", "url": "https://cyberdom.blog/cloud-misconfiguration-risks-azure/", "published_at": "2022-11-09T02:54:43+00:00" }, { "id": "01a0c54a-5697-7144-a9af-7555b48ac424", "title": "Initial Access – Attacking and Defending MDE", "url": "https://cyberdom.blog/initial-access-attacking-and-defending-mde/", "published_at": "2022-11-05T06:25:00+00:00" }, { "id": "01a0c54a-5697-7144-a9af-7555b4ba2aa4", "title": "Defender EASM Glossary", "url": "https://cyberdom.blog/defender-easm-glossary/", "published_at": "2022-10-22T13:27:12+00:00" }, { "id": "01a0c54a-5697-7144-a9af-7555b5305368", "title": "Seeds & Discovery in Defender EASM", "url": "https://cyberdom.blog/seeds-discovery-in-defender-easm/", "published_at": "2022-10-17T15:23:37+00:00" }, { "id": "01a0c552-a74e-710f-a6ae-16e741903649", "title": "Deploy Defender EASM", "url": "https://cyberdom.blog/deploy-defender-easm/", "published_at": "2022-10-16T04:02:20+00:00" }, { "id": "01a0c552-a74e-710f-a6ae-16e74287a6a9", "title": "Defender EASM 101", "url": "https://cyberdom.blog/defender-easm-101/", "published_at": "2022-10-04T17:26:01+00:00" }, { "id": "01a0c552-a74e-710f-a6ae-16e7434e3268", "title": "Defender for Endpoint: Code Execution – Attacking and Defending Endpoint", "url": "https://cyberdom.blog/defender-for-endpoint-code-execution-attacking-and-defending-endpoint/", "published_at": "2022-07-08T14:50:56+00:00" }, { "id": "01a0c552-a74e-710f-a6ae-16e743f808d8", "title": "Code Execution – Attacking and Defending MDE", "url": "https://cyberdom.blog/code-execution-attacking-and-defending-mde/", "published_at": "2022-07-08T14:50:56+00:00" }, { "id": "01a0c552-a74e-710f-a6ae-16e744b0f380", "title": "Azure Blob Container Threats & Attacks", "url": "https://cyberdom.blog/azure-blob-container-threats-attacks/", "published_at": "2022-06-26T09:13:07+00:00" }, { "id": "01a0c552-a74e-710f-a6ae-16e744cde01e", "title": "Cloud Chain of Custody", "url": "https://cyberdom.blog/cloud-chain-of-custody/", "published_at": "2022-06-16T07:20:43+00:00" }, { "id": "01a0c552-a74e-710f-a6ae-16e7454fe044", "title": "Defender for Endpoint on Ubuntu", "url": "https://cyberdom.blog/defender-for-endpoint-on-ubuntu/", "published_at": "2022-06-11T21:45:15+00:00" }, { "id": "01a0c552-a74e-710f-a6ae-16e7459bacbc", "title": "API Security and Things ~ AppSec 101", "url": "https://cyberdom.blog/api-security-and-things-appsec-101/", "published_at": "2022-05-30T07:27:40+00:00" }, { "id": "01a0c552-a74e-710f-a6ae-16e746397069", "title": "Azure AD Incident Response Life-Cycle & Tools", "url": "https://cyberdom.blog/azure-ad-incident-response-life-cycle-tools/", "published_at": "2022-05-18T12:00:17+00:00" }, { "id": "01a0c552-a74e-710f-a6ae-16e746b44d34", "title": "Investigate AD Metadata with Microsoft Sentinel", "url": "https://cyberdom.blog/ad-forensics-with-microsoft-sentinel/", "published_at": "2022-05-11T05:39:33+00:00" }, { "id": "01a0c55a-ffef-72f5-9b3e-b054391253d5", "title": "Protect from Ransomware with Microsoft Defender for Cloud Apps", "url": "https://cyberdom.blog/protect-from-ransomware-with-microsoft-defender-for-cloud-apps/", "published_at": "2022-05-09T05:13:21+00:00" }, { "id": "01a0c55a-fff0-72a1-b778-d5673bceab0c", "title": "Monitor RDP Attack with Microsoft Sentinel", "url": "https://cyberdom.blog/monitor-rdp-attack-with-microsoft-sentinel/", "published_at": "2022-05-03T06:11:16+00:00" }, { "id": "01a0c55a-fff0-72a1-b778-d5673be8670e", "title": "PowerShell Hunting with Microsoft Sentinel", "url": "https://cyberdom.blog/powershell-hunting-with-microsoft-sentinel/", "published_at": "2022-05-01T05:09:54+00:00" }, { "id": "01a0c55a-fff0-72a1-b778-d5673cd0b178", "title": "Microsoft Sentinel and Sysmon 4 Blue Teamers", "url": "https://cyberdom.blog/microsoft-sentinel-and-sysmon-4-blue-teamers/", "published_at": "2022-04-29T14:48:47+00:00" }, { "id": "01a0c55a-fff0-72a1-b778-d5673d199f42", "title": "Bypass MDA App Proxy – User Agent Impersonation", "url": "https://cyberdom.blog/bypass-mda-app-proxy-user-agent-impersonation/", "published_at": "2022-04-23T14:40:21+00:00" }, { "id": "01a0c55a-fff0-72a1-b778-d5673dcb823e", "title": "Intune Devices invetigation with MDE & Microsoft Sentinel", "url": "https://cyberdom.blog/intune-devices-invetigation-with-mde-microsoft-sentinel/", "published_at": "2022-04-16T08:59:10+00:00" }, { "id": "01a0c55a-fff0-72a1-b778-d5673ebc6035", "title": "Legacy & Cloud-Native SIEM", "url": "https://cyberdom.blog/legacy-cloud-native-siem/", "published_at": "2022-04-15T14:38:52+00:00" }, { "id": "01a0c55a-fff0-72a1-b778-d5673fac42ad", "title": "GitHub in a Nutshell", "url": "https://cyberdom.blog/github-in-a-nutshell/", "published_at": "2022-04-15T14:29:44+00:00" }, { "id": "01a0c55a-fff0-72a1-b778-d56740a76929", "title": "The Role of the SOC in DevSecOps", "url": "https://cyberdom.blog/the-role-of-the-soc-in-devsecops/", "published_at": "2022-04-05T06:01:12+00:00" } ] posts Claim your blog

Back to cyberdom.blog

Blog · corpus.blog/blogs/cyberdom.blog/posts

cyberdom.blog

cyberdom.blog

2026

Hands-On Post Quantum TLS Lab original ↗

26 Sept 2026

Blueprint Inheritance Abuse in Entra Agent ID original ↗

7 Sept 2026

Own an Agent through its Skills original ↗

30 Aug 2026

Exploiting Azure IMDS original ↗

26 Jul 2026

Inside Entra Agent ID original ↗

25 Jul 2026

Entra ID User App Config Abuse original ↗

11 Jul 2026

From ESTS Cookie Replay to Inbox Persistence original ↗

27 Jun 2026

Weaponizing Exchange Online Inbox Rules original ↗

25 Jun 2026

Harvest Now Decrypt Later original ↗

23 Jun 2026

Microsoft Edge Heap Memory Exposure (MemEdge)original ↗

21 Jun 2026

The AI Middleware Risks in Claude Desktop original ↗

16 May 2026

Sentinel MCP for Threat Hunting and Investigations original ↗

14 Mar 2026

Securing AI at the Gate original ↗

27 Feb 2026

The Part of AI Red Teaming Nobody Talks About original ↗

22 Feb 2026

2025

Entra ID Log Analyzer: Turning Raw Logs into Stories original ↗

11 Nov 2025

The Hidden Risks inside ChatGPT in Entra ID original ↗

11 Nov 2025

Sentinel MCP Unlocked original ↗

21 Oct 2025

Unlocking Microsoft Sentinel MCP original ↗

4 Oct 2025

Token Protection: The Good, the Bad, and the Assumptions original ↗

27 Sept 2025

Ghosting the Sensor: Disrupting Defender for Identity Without Detection original ↗

26 Jul 2025

macOS Forensics Artifacts and Commands original ↗

19 Jul 2025

SharePoint Online as a Weapon: Offensive Tactics in Microsoft 365 Collaboration original ↗

14 Jul 2025

Adversarial AI Digest – June, 2025 original ↗

8 Jul 2025

Entra ID Incident Response: Advanced PowerShell Techniques original ↗

5 Jul 2025

Inside dMSA on AD 2025: How It Works, How to Monitor It, Why It Matters original ↗

24 Jun 2025

A New Day, A New Method: QR Code in Entra ID original ↗

2 May 2025

Inside the Microsoft Teams Attack Matrix: Unpacking the The Frontier in Collaboration Threats original ↗

18 Apr 2025

Abusing the Windows Update Stack to Gain SYSTEM Access (CVE-2025-21204)original ↗

14 Apr 2025

2024

AI Red Team: Be the PyRIT – Initiate the Power of PyRIT original ↗

4 Nov 2024

Defender for Endpoint: Bypassing Lsass Dump with PowerShell original ↗

2 Nov 2024

Getting Started with PyRIT: Deployment Guide original ↗

28 Oct 2024

Integrating PowerShell Logging into Microsoft Sentinel original ↗

25 Oct 2024

A Step-by-Step Guide for Microsoft 365 Copilot API Development original ↗

16 Oct 2024

Azure Blob Storage PowerShell Scanning Script original ↗

16 Oct 2024

A Step-by-Step Guide to Run the Microsoft Copilot 365 API with Microsoft Graph original ↗

14 Oct 2024

Azure Ends TLS 1.0/1.1 Support: Key Script and Query original ↗

4 Oct 2024

Shadow AI – Risks, Things and Prompt Security original ↗

21 Sept 2024

Cloud Security Toolkit: Your Ultimate Resource Hub!original ↗

21 Sept 2024

Microsoft AI Security Layers Review original ↗

24 Aug 2024

Microsoft Defender Delayed Updates original ↗

20 Jul 2024

AWS CloudTrail – HIDDEN_DUE_TO_SECURITY_REASONS original ↗

11 May 2024

Microsoft 365 Cloud investigation via Unified Audit Log – Insights and Tips original ↗

26 Apr 2024

The Power of Promptbooks: A Closer Look at Copilot for Security Promptbook original ↗

13 Apr 2024

Azure DevOps auditing with Microsoft Sentinel original ↗

27 Feb 2024

Proactive Response: Any Breach (AnyDesk Incident)original ↗

3 Feb 2024

Azure OpenAI: Security for GenAI and LLM original ↗

3 Feb 2024

Defender for Identity: Hunting for LDAP original ↗

7 Jan 2024

2023

Unmasking the Shadows: The Art of Threat Hunting in Defender for Identity original ↗

9 Dec 2023

Spotting the Adversary with Microsoft Defender for Identity original ↗

3 Dec 2023

MDI Sensor on ADCS fails to start original ↗

4 Nov 2023

GenAI Cybersecurity: Where are we? Threats, Risks, and More original ↗

17 Sept 2023

Detecting Ransomware with Defender for Cloud Apps original ↗

27 Aug 2023

Microsoft Sentinel Schema & Tables original ↗

22 Jul 2023

EASM vs. PT vs. VM & Defender EASM Approaches original ↗

7 Jul 2023

Unleashing the Power of Threat Hunting in the Cloud original ↗

23 Jun 2023

Understanding Prompt Injection – GenAI Risks original ↗

17 Jun 2023

Advanced Hunting 4 ZIP/MOV original ↗

3 Jun 2023

The State of External Attack Surface Management original ↗

27 May 2023

Configure Conditional Access Token Protection (CATP) with Conditional Access Policy (CAP)original ↗

12 May 2023

Azure AD Conditional Access Token protection (CATP) First Impressions original ↗

12 May 2023

Azure PIM Activation with additional MFA original ↗

26 Apr 2023

Malware Scanning in Defender for Cloud – Notes from the Field original ↗

1 Apr 2023

Practical Hunting from the field original ↗

6 Mar 2023

Azure AD Access Review – Microsoft 365 Groups with Guest users original ↗

4 Mar 2023

OSINT Tools original ↗

4 Mar 2023

Cloud Penetration Testing from the field original ↗

4 Mar 2023

Be the Purple with Generative AI original ↗

4 Mar 2023

Operate Defender for Office like a Pro original ↗

3 Mar 2023

The Power of investigation with Defender for Identity original ↗

26 Feb 2023

Scared Mailbox – The Risks with Shared Mailbox original ↗

17 Feb 2023

Investigation in Defender TI original ↗

1 Feb 2023

Recon Azure AD original ↗

14 Jan 2023

Hunting Service Principal with Microsoft Sentinel original ↗

13 Jan 2023

GitHub Starter Guide original ↗

3 Jan 2023

2022

Azure Blob Container for Defenders original ↗

22 Dec 2022

Play with Microsoft Graph PowerShell – MgGraph 101 original ↗

18 Dec 2022

Cloud Misconfiguration and Risks – Azure original ↗

9 Nov 2022

Cloud Misconfiguration & Risks – Azure original ↗

9 Nov 2022

Initial Access – Attacking and Defending MDE original ↗

5 Nov 2022

Defender EASM Glossary original ↗

22 Oct 2022

Seeds & Discovery in Defender EASM original ↗

17 Oct 2022

Deploy Defender EASM original ↗

16 Oct 2022

Defender EASM 101 original ↗

4 Oct 2022

Defender for Endpoint: Code Execution – Attacking and Defending Endpoint original ↗

8 Jul 2022

Code Execution – Attacking and Defending MDE original ↗

8 Jul 2022

Azure Blob Container Threats & Attacks original ↗

26 Jun 2022

Cloud Chain of Custody original ↗

16 Jun 2022

Defender for Endpoint on Ubuntu original ↗

11 Jun 2022

API Security and Things ~ AppSec 101 original ↗

30 May 2022

Azure AD Incident Response Life-Cycle & Tools original ↗

18 May 2022

Investigate AD Metadata with Microsoft Sentinel original ↗

11 May 2022

Protect from Ransomware with Microsoft Defender for Cloud Apps original ↗

9 May 2022

Monitor RDP Attack with Microsoft Sentinel original ↗

3 May 2022

PowerShell Hunting with Microsoft Sentinel original ↗

1 May 2022

Microsoft Sentinel and Sysmon 4 Blue Teamers original ↗

29 Apr 2022

Bypass MDA App Proxy – User Agent Impersonation original ↗

23 Apr 2022

Intune Devices invetigation with MDE & Microsoft Sentinel original ↗

16 Apr 2022

Legacy & Cloud-Native SIEM original ↗

15 Apr 2022

GitHub in a Nutshell original ↗

15 Apr 2022

The Role of the SOC in DevSecOps original ↗

5 Apr 2022