Showing 0 of 8 articles for “”
Attackers are registering look-alike enterprise applications and phishing global admins into granting Mail.ReadWrite and Directory.ReadWrite.All, sidestepping MFA entirely. We break down the consent-grant chain and the audit-log queries that surface it.
Both entries abuse IMDSv1 endpoints reachable from vulnerable web apps to mint temporary role credentials. Enforcing IMDSv2 with a hop limit of one closes the path — here is the org-wide policy plus a GuardDuty detection to catch what slipped through.
Tracked as CVE-2026-3184, the flaw sits in the admission webhook and is trivially reachable wherever the API is internet-facing. Vendor patches shipped overnight for 4.2.x and 4.1.x; a network-policy workaround holds the line until you can roll them.
Each notebook pairs a hypothesis with the exact SigninLogs and DeviceLogonEvents joins that prove or kill it — impossible travel, dormant-account revival, Kerberoasting fallout, and three more.
We reviewed 340 customer projects over six months. Workload Identity Federation is available in every one of them, yet downloaded keys keep landing in CI variables and private repos. The migration is shorter than most teams expect.
A walkthrough on a deliberately weak lab cluster — service-account token discovery, over-permissive RBAC bindings, host-path escapes — with the admission policy that blocks each step. For authorised testing on systems you own.
Simulation mode first, policy tips second, blocking last. We share the three-week phased rollout and the PowerShell that reports on match volume before you enforce a single rule.
The open-source scanner now ships 128 read-only checks across AWS, Azure, GCP and Microsoft 365, exports to SARIF and CSV, and runs in a container with a scoped audit role. Release notes and file hashes inside.
Try a broader term — for example Azure, OAuth, Kubernetes, or DLP.
