By This Author
How adversaries use Entra ID service principals in business email compromise schemes How adversaries use Entra ID service principals in business email compromise schemes
May 16, 2024
Microsoft Investigating legacy authentication: The curious case of “BAV2ROPC” Investigating legacy authentication: The curious case of “BAV2ROPC”
June 7, 2023
Microsoft Diary of a Detection Engineer: Exposing and shutting down an inbox heist in action Diary of a Detection Engineer: Exposing and shutting down an inbox heist in action
March 16, 2023
Threat detection Cloud coverage: Detecting an email payroll diversion attack Cloud coverage: Detecting an email payroll diversion attack
October 6, 2022
Cloud security Detecting suspicious email forwarding rules in Office 365 Detecting suspicious email forwarding rules in Office 365
May 31, 2022
Cloud security Remote access tool or trojan? How to detect misbehaving RATs Remote access tool or trojan? How to detect misbehaving RATs
August 19, 2021
Threat detection Rclone Wars: Transferring leverage in a ransomware attack Rclone Wars: Transferring leverage in a ransomware attack
May 4, 2021
Threat detection Catch me if you code: how to detect process masquerading Catch me if you code: how to detect process masquerading
February 9, 2021
Threat detection