IA – Page 2 – Trackr.Live

§ Category

Device Code Phishing Lives in the Log Table You Don’t Ingest

Device code phishing produces a clean, MFA-satisfied sign-in on Microsoft’s own infrastructure — and most of the telemetry that betrays it sits in the Entra non-interactive log table teams drop to save money. Here’s where the detection actually lives, how the threshold flips between a Windows shop and a dev-heavy tenant, and the persistence artifacts the closeout always skips.

Kerberoasting detection in 2026: the 4769 signals that hold up, AES downgrade tells, and clearing service-account account noin week one

Encryption-type detancy deton Kerberos TGS requests still catches lazy roasting, but as RC4 gets disabled the durable signal moves to behavior. What to grep for, why the AES downgrade tell degrades, and how to kill service-account false positives before they bury the SOC.

Stolen Session Tokens Walk Past Your MFA: Detecting and Killing AiTM Replay in Entra

Adversary-in-the-middle kits steal the session token after MFA succeeds, then replay it from somewhere else. Here is how the replay actually looks in your sign-in logs, why token protection only half-closes the gap, and where it maps to 800-53.

Token replay forensics: reconstructing a post-MFA compromise in Entra ID

When MFA held and the attacker still got in, the evidence lives in session token reuse, not failed logins. A defender’s view of reconstructing a stolen-session timeline in Entra ID — what survives, what to query, and where the false positives come from.

Microsoft’s passwordless-by-default shift: what Entra admins and home users need to know

System-preferred authentication is moving to the first factor, the password prompt is about to vanish for passkey holders, and break-glass accounts are not exempt from mandatory MFA. Here’s what that actually changes for Entra defenders and home users.

Salt Typhoon and the Carrier Trust Collapse: A Defender’s Field Guide

Chinese state actors have been inside major U.S. carrier networks for months to years. Here is what enterprise defenders should actually do about it — detection logic, SIEM specifics, and the control updates that matter.

Token Theft in 2026: What CAE and DBSC Actually Cover, and What Your SIEM Still Has to Catch

Continuous Access Evaluation and Device Bound Session Credentials closed some of the AitM gap, but session token theft against Entra ID is still the dominant identity attack and most of the detection burden still falls on the SOC. Here is the shape of the problem and where the first round of tuning has to land.

Private-CISA: A Nightwing Contractor, 844 MB of GovCloud Admin Keys on Public GitHub, and the 48-Hour Rotation Window That Stayed Open

A Nightwing contractor with CISA access kept a public GitHub repository called Private-CISA from November 13, 2025 to May 15, 2026 — 184 days of admin credentials to three AWS GovCloud accounts, Entra ID SAML certificates, Artifactory tokens, plaintext passwords in CSV, and the Landing Zone DevSecOps configuration for the agency tasked with everyone else’s vulnerability hygiene. The leak is bad. The thing that should worry defenders more is that the AWS keys remained valid for 48 hours after CISA was notified.

Token Theft After DBSC: What Identity Detection Actually Looks Like in 2026

Device Bound Session Credentials are landing in Chrome and Edge, but the gap between the protocol promise and what your SIEM sees is wider than the vendor decks suggest. A defender-oriented look at what detection actually requires right now.

Device Code Phishing and Persistent OAuth Consent: 2026 APT Tradecraft in Entra ID

A defender-focused analysis of how APT29-aligned and Storm-2372-style intrusion sets are abusing device authorization grants and long-lived OAuth consent in Entra ID through 2026 — what to detect, what to revoke, and where it maps to 800-53.