📘
DFIR
Ctrlk
  • Networking
    • Networking
  • Windows
    • Administration
    • Forensics
    • Cheat Sheet
    • Investigation
    • Internals
    • Active Directory
    • MISC
  • Linux
    • Forensics
    • SSH
    • Linux WebShells
    • Directories of Interest
    • Internals
  • Enterprise Architecture
    • CI/CD Pipline
    • Citrix
    • Web Applications
    • The Cloud
      • AWS
      • Azure
        • Hunting
        • Admin
        • Securing Azure
          • CA Policies
        • CheatSheet
        • Detections
        • Forensics
        • Attacking Azure
        • Fundementals
        • Logging
      • M365
      • Cloud Labs
    • vSphere
    • Containers
    • Troubleshooting
  • Mac
    • Forensics
  • Attacker Information
    • Adversary Operations
    • Actor Playbooks
    • Abused Domains
  • IR Playbook
    • Activity from Unmanaged Host
    • Recommendations
  • Reverse Engineering
    • Python - Pyinstaller
Powered by GitBook
On this page
  • Disable Legacy Authentication:
  • Token Tactics:
  • Case Studies:
  1. Enterprise Architecture
  2. The Cloud
  3. Azure

Securing Azure

Disable Legacy Authentication:

LogoLegacy authentication: The curious case of BAV2ROPCRed Canary
LogoWhy You Should Block Microsoft Legacy Authenticationsoftwarekeep.com

Token Tactics:

LogoToken tactics: How to prevent, detect, and respond to cloud token theft | Microsoft Security BlogMicrosoft Security Blog
LogoAddressing data exfiltration: Token theft talk | Microsoft Community HubTECHCOMMUNITY.MICROSOFT.COM

Case Studies:

LogoMicrosoft Breach — What Happened? What Should Azure Admins Do?Medium
LogoMidnight Blizzard breach: analysis and best practices | Wiz BlogWiz.io
PreviousAdminNextCA Policies

Last updated 1 year ago