I do product things @ Gambit Security. Former PM for Microsoft Defender for Identity and Google SecOps. Tweets are my own.
Joined June 2013
- Tweets937
- Following161
- Followers1.3K
- Likes9.1K
Daniel Naim retweeted
Anyone else annoyed there is no "select all" option for Advanced Auditing in M365? 😒
If this is you, I just pushed a script to help enable all record types available as of today (keep in mind, they add new ones often)
github.com/nathanmcnulty/nat…
Daniel Naim retweeted
The Ninja Show is ending this week strongly 💪 with a Better Together conversation! Tune in March 23rd to see the advantages of a united relationship between Microsoft Defender for Identity & Defender for Endpoint! 📅: aka.ms/NinjaShow/307/calenda…
#ninjashow #cybersecurity #MDI #MDE
Daniel Naim retweeted
This is a BIG deal. BIG.
Yay, we just announced the general availability of the native response actions now in Defender for Identity. Security teams can now directly impact the on-premises AD account in the event of an identity compromise.
techcommunity.microsoft.com/… #identityprotection #cybersecurity
Daniel Naim retweeted
MS Defender for Identity helped us spot #redteam at a customer this week.
Lead: Suspected Kerberos SPN exposure
This was ~20 hours before we had any significant activity from an EDR integration.
Good example of the importance of being able to extend beyond EDR.
Daniel Naim retweeted
Finally, #MDI settings are now available as part of #M365Defender, in public preview
techcommunity.microsoft.com/…
Daniel Naim retweeted
NEW BLOG: PrintNightmare…from 𝐚𝐭𝐭𝐚𝐜𝐤 to detection via Microsoft Defender for Identity (𝐌𝐃𝐈) and -Endpoint (𝐌𝐃𝐄)
derkvanderwoude.medium.com/b…
@Nedscaper #printnightmare
Daniel Naim retweeted
CloudAppEvents is now GA in M365D AH! Activities of Teams, EXO, SPO and OneDrive are audited.
Read our new blog series of “MCAS: The Hunt”, for interesting use cases to investigate incidents involving MCAS using this new table and the entire AH dataset aka.ms/AAbgejt
Daniel Naim retweeted
NEW BLOG: ZeroLogon detected by the Microsoft Defender suite.
medium.com/@derkvanderwoude/…
@we_are_inspark @msftsecurity @MicrosoftMTP @MSThreatProtect
Daniel Naim retweeted
In case you missed it - ZeroLogon is now detected by Microsoft Defender for Identity (CVE-2020-1472 exploitation) techcommunity.microsoft.com/…
Daniel Naim retweeted
Illustration of an end-to-end attack chain across multiple domains using Microsoft security products was just posted!
@Taliash1 @Stefan0x531
microsoft.com/security/blog/…
Daniel Naim retweeted
Azure ATP detects SMBGhost on protected Domain Controllers bit.ly/2VxvtO5
It's here! Details on how we achieved #SMBGhost RCE are available. Enjoy!
"I'll ask your body": SMBGhost pre-auth RCE abusing Direct Memory Access structs by (@hugeh0ge)
ricercasecurity.blogspot.com…
Daniel Naim retweeted
I just published Lateral Movement Graph for Azure AD link.medium.com/1KS4kMf0N5
Daniel Naim retweeted
Come join myself and @danielmy1Daniel at our demo-rich session "Dive deep into Microsoft Threat Protection: See how we defend against threats like phishing and stop attacks in their tracks across your estate" at Microsoft Ignite the Tour Copenhagen!
copenhagen.myignitetour.tech…
Daniel Naim retweeted
New in preview!🦄 Hunting across Office 365 ATP mail flow and MDATP endpoint EDR, vulnerability and configuration data in one place. Available now for any Microsoft 365 E5 customer. Try it out right now aka.ms/EnableMTP
