Bryant Smith
@flowstateTrusted contributorCompletionist
3 followers678 downloads310 copies7 likes12,516 views
3 intel reports
Filters
Last updated
All Time
Adversaries
1
1
Malware / Tools
1
1
1
1
MITRE Techniques
2
2
1
1
1
Publisher
1
1
1
1
New Privileged Token Context Telemetry in Microsoft Defender
Microsoft Defender for Endpoint has introduced new token context fields in Advanced Hunting to surface privileged group SIDs and logon attributes at the time of token creation.
Azure AD Conditional Access Bypass via Phantom Devices
The Storm-2372 threat actor and security researchers bypass Microsoft Entra ID Conditional Access by registering phantom devices and spoofing Intune compliance claims.
Rise of EvilTokens and Device Code Phishing
Threat actor EvilTokens uses device code flow phishing to bypass MFA and obtain Primary Refresh Tokens for persistent Microsoft 365 access.