Fabian Bader

Addressing Exchange Server May 2026 vulnerability CVE-2026-42897 | Microsoft Community Hub! 🦋 techcommunity.microsoft.com/blog/Exchang...

In my latest blog "Now You See Me: AADGraphActivityLogs" I explore the newly released Azure AD Graph logs and demonstrate how you can detect tools like ROADtools and AADinternals that rely on this API and have been under the radar for defenders so far. cloudbrothers.info/en/aadgrapha...

My Disobey talk "Are passkeys as secure as you think" is now available on YouTube youtu.be/DQ4dnXibaoM?...

Microsoft just announced official support to store device bound Passkeys for Entra ID in the Windows Hello container. No app, no external hardware key but built in support. Sadly no attestation while in preview. mc.merill.net/message/MC12... #Passkey #EntraID

What are preferred methods to lock someone out of a remote Intune managed computer? Any that work well in a hybrid configuration? Our best solution to date is a push of a “deny local login” policy in advance and a forced reboot. @nathanmcnulty.com @merill.net @fabian.bader.cloud

Today at 15:00 CET #YellowHat will start. It's a free live streamed conference around Microsoft Security and we have amazing speakers and topics lined up for you. Register now to reserve your free spot. yellowhat.live #XDR #EDR #Defender #Microsoft #Security

With the unified SOC experience there might be some ANRs you want to exclude from XDR correlation. Now you can! Either using the UI or add #DONT_CORR# at the beginning of the ANR description. learn.microsoft.com/en-us/defend...

#ConsentFix is a great way for attackers to work around some protective layers but not all. @naunheim.cloud , @cbrhh.bsky.social and I wrote a blog post on detection and mitigations. Hope you find it useful and can adapt it to your environment. www.glueckkanja.com/de/posts/202...

We’re thrilled to reveal our next MC2MC Connect speakers for February 5th in Antwerp: @fabian.bader.cloud @rogierdijkman.bsky.social ! 🎙️ ➡️Looking to explore the program or secure your spot? Check out: connect.mc2mc.be #MC2MC #ConnectMC2MC #ConnectMC2MC2026 #Connect #Collaborate #Create

@_dirkjan and my joint talk at #TROOPERS25 is now available on YouTube. "Finding Entra ID CA Bypasses - the structured way" @wearetroopers.bsky.social youtu.be/yYQBeDFEkps

🚀 The speakers for MC2MC Connect 2026 are live! ➡️ Dive into Microsoft Cloud, Endpoint, Security, AI, FinOps & Architecture with top experts. 🎤 Speakers: connect.mc2mc.be/speakers-wid... 🎟️ Only a few early-bird tickets left: connect.mc2mc.be/tickets/ #MC2MC #ConnectMC2MC #ConnectMC2MC2026

Custom data collection in Microsoft Defender for Endpoint was just announced in the November release notes. Documentation is already available learn.microsoft.com/en-us/defend... Predictive shielding sounds also very interesting... #MDE #XDR

Attackers found a clever way to abuse legitimate, digitally signed software to load malware and it's working. Expel Intel’s Marcus Hutchins (@malwaretech.com) breaks down a campaign that weaponizes Greenshot, a legit screenshot tool, to evade detection at multiple layers. 🧵

Microsoft Defender just got the September 2025 update ◽Improved core service startup behavior ◽ Security fixes for missing input validation of RPC services ◽Fixed threat exclusion handling ◽Restored performance optimization for network file access learn.microsoft.com/en-us/defend...

I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: dirkjanm.io/obtaining-gl...

Did you ever asked yourself: What does Swiss cheese and Conditional Access have in common? Either way, if you want to learn about (un)documented Conditional Access Bypasses, then join me on Monday at the Workplace Ninja Summit 25 #WPninjas wpninjas25.sched.com/event/27VE4/...

Sentinel UEBA got a welcome set of new data sources ◽Defender XDR device logon events ◽Entra ID managed identity signin logs ◽Entra ID service principal signin logs ◽AWS CloudTrail ◽GCP audit logs ◽Okta MFA techcommunity.microsoft.com/blog/microso...

Token Protection in Microsoft Entra Conditional Access for Windows is now GA! 🎉 #EntraID #Token learn.microsoft.com/en-us/entra/...

Two years ago I published a two part series on #MSGraph logs and how to use them for threat hunting. Now comes part 3 and the logs are finally available to the masses. #EntraID #KQL #Security cloudbrothers.info/en/detect-th...

Recently, we announced the finalists for the most special of the #GoldenClippyAwards The #ChuckNorris award is for heroes in multiple areas: @nathanmcnulty.com @fabian.bader.cloud @bindertech.se @knudsenm.bsky.social@mortenknudsen.net Congratulate them/reshare for these rockstars! #MVPBuzz #WPNinjas

Defender AV Platform v4.18.25070.5 ◽Enhanced Passive Mode Scanning Behavior ◽Improved Tamper Protection Handling ◽Digital Signature Verification Performance Boost ◽Refined ASR Rule Exclusion Processing #MDAV #MDE #ASR

A rare, but highly welcome change. Microsoft changed the license requirement for Token protection from Entra ID P2 to P1. This will protect more customers in the long run and lead to a more secure ecosystem. learn.microsoft.com/en-us/entra/...

🚨 PSA - Zero day in SharePoint on-prem is actively exploited! ◽ Have Defender AV active ◽ Don't disable AMSI integration of SharePoint ◽ Keep an eye out for the alerts outlined in the article ◽ Look for post exploitation with the hunting query msrc.microsoft.com/blog/2025/07...

Part 8053 of eleventy billion on our path to killing NTLM: way way way way way better auditing. support.microsoft.com/en-us/topic/...

What r u doing while cooking? That’s my distraction …. #PSConfEU 2915

The latest on the Azure AD Graph retirement mentions two temporary outage tests and more guidance. If something stops working it might be because of those tests. #Entra #AADGraph techcommunity.microsoft.com/blog/microso...

One of the results of the joined research with @dirkjanm.io is entrascopes.com Basically the yellow pages for Microsoft first party apps. #TROOPERS25

"One thing we have learned over years is that the world moves quickly, and building is easy but supporting is hard...." Sydney Smith 2025 #StateOfTheShell #PSConfEU 2025

Rerunning my test scenarios for the #TROOPERS25 presentation...

Pizza 🍕

Microsoft trying to be like @vxunderground, smh 😂

Suspicious domain m365sessionlogin[.]com was registered through Njalla on 5/18/25. Domain itself does not resolve, but subdomains login, logon, and office365 indicate hosting at 80.78.30[.]154.

The unified IdentityInfo table is the most comprehensive way to identify users and their attributes in the unified SOC experience. You have to onboard your Sentinel workspace AND enable UEBA to take advantage of this in advanced hunting. #xdr #sentinel

First time I made it on the @msftsecresponse leaderboard 🍾 msrc.microsoft.com/leaderboard

Planning for some days off from work. What to put in the duffle back beside a good book and some sunscreen? My new favorite card game of course. #FOCI #FamilyOfClientID

Application Based Authentication on Microsoft Entra Connect Sync is near. With this change you will be able to use a TPM backed certificate in Entra Connect Sync for authentication. This is a welcome change to prevent the compromise of this high privileged account. #Entra #Certificate

I made an Azure version microsoftedge.microsoft.com/addons/detai...

Here's (finally!) what I've found about this 😉 bsky.app/profile/cnot...

👀 Who is Nova? We will find out tomorrow 😉

Here's another Maester v1.2 teaser. We just added Severity for test results plus the ability to filter by Severity.

Looks like Lifecycle Workflows just added the ability to revoke session tokens 💪 Previously, we had to create our own custom extension (Logic App) to do this, so really nice to see it as a built-in task now :) learn.microsoft.com/...

Two new ASR rules are now generally available: ◽Block rebooting machine in Safe Mode ◽Block use of copied or impersonated system tools learn.microsoft.com/en-us/defend...

Microsoft XDR Automatic attack disruption just got better. It now takes into account the device role and criticality to preserve key network functionality while protecting the assets. Plus IP address based containment of undiscovered devices! #XDR techcommunity.microsoft.com/blog/microso...

Happy to join the Workplace Ninja Summit 2025 together with @naunheim.cloud @oudendorp.nl @harjit.bsky.social interviewed us at the #MVPSummit youtu.be/DSYu-4tXaxI #WPNinjaSummit2025

Only 4️⃣ days until we come together for an epic PowerShell + DevOps experience! 🎉 💡 Learning ✅ 🤝 Networking ✅ 🚀 Growth ✅ 📢 Like, comment, and share to spread the excitement! #seattle #bellevue #powershell #techconference #devops #ai #innovation

This is awesome! Microsoft is killing off the ability for multi-tenant applications to authenticate in directories where a service principal has not been registered. learn.microsoft.com/... I'd like to automate discovery and remediation for admins, but I need help testing :)

Since it's already April, let's have a look at the top 10 passwords in Q1 2025. If yours is not part of the list, good for you 😅