Hybrid Brothers

Hybrid Brothers

Microsoft Security, Hybrid Infrastructure, Code, and more

Microsoft Defender XDR & Sentinel

Transition from Microsoft Sentinel to Defender XDR - Practical challenges

Transition from Microsoft Sentinel to Defender XDR - Practical challenges

Microsoft announced on the 1st of July 2025 that the Microsoft Sentinel Azure Portal UI will be deprecated at the 1st of July 2026, and all requests will be redirected to the Security Portal instead. This means that all Microsoft Sentinel customers have 1 year time to transition to the Unified experience between Microsoft Sentinel and Defender XDR.
12 min read
Defender XDR Microsoft Sentinel Security Portal Migration
MDE Device Discovery - Improving the monitored network page

MDE Device Discovery - Improving the monitored network page

This blogpost is probably the first of a series that I will create in the coming months on Device Discovery. I regularly see organizations buy a specific tool to create an asset inventory list of what lives in their networks, while this is something we can actually do with Microsoft technology
7 min read
MDE Device Discovery Asset Management Network Monitoring
Correlating Defender for Endpoint and Global Secure Access Logs

Correlating Defender for Endpoint and Global Secure Access Logs

If you are working with Microsoft security solutions, you might have heard of the new kid on the block called Microsoft Global Secure Access. Being a blue teamer myself, I asked myself how we can use this new Secure Service Edge solution - and specifically the Internet Access logs - to make our detections better.
6 min read
MDE GSA Global Secure Access Kusto
Device isolation and containment strategies

Device isolation and containment strategies

How can you effectively isolate a device in your network, and be sure a threat will not perform lateral movement?
14 min read
MDE Containment Defender XDR Network isolation
Analyzing MDE Network Inspections

Analyzing MDE Network Inspections

What is Defender for Identity NNR, why is it important, and how can you resolve issues with it?
9 min read
MDI Defender XDR Kusto Health monitoring

Microsoft Entra ID

Detecting non-privileged Windows Hello abuse

Detecting non-privileged Windows Hello abuse

I recently followed a live session of Dirk-Jan Mollema and Ceri Coburn on how Windows Hello for Business can be abused as a non-privileged user. I was very intrigued by the concept of the attack they demonstrated, which is why a spend a couple of days thinking of ways how we can counter this attack with detective controls as blue teamers.
20 min read
Windows Hello Detection Engineering WDAC MDE
Entra ID Private Access with private integrated storage accounts

Entra ID Private Access with private integrated storage accounts

In the past couple of weeks, I worked on a project where I needed to provide access to a securely private integrated Azure Storage Account via the Entra ID Private access profile. During this project I encountered a very interesting bug, that made me better understand the insights of how Global Secure Access works.
6 min read
Global Secure Access Azure Private Access Troubleshooting
Cyber back to school: Microsoft Token Theft Unveiled

Cyber back to school: Microsoft Token Theft Unveiled

I am thrilled to participate in the Cyber Back to School initiative hosted during cyber awareness month! This session is all about Primary Refresh Token VS Access Token stealing in Microsoft Entra ID, and will show the practical countermeasures for each of them. I preferred to write a blog post for this instead of a PowerPoint deck since there are a lot of technical details and references I want to cover.
17 min read
Entra ID Cyber back to school Tokens AiTM
Client Credentials - Client Certificate

Client Credentials - Client Certificate

The process is quite similar to the client secret flow described here, so be sure to take a look! The challenge here lies in generating a JWT (JSON Web Token) based on a certificate. I will provide a detailed explanation of how the JWT is generated and exchanged for an access token below.
5 min read
Authentication Security
Client Credentials - Client Secret

Client Credentials - Client Secret

The next authentication flow in my series will be the Client Credentials Flow. Be sure to check out the first one here! We will first take a look at the client secret model. I will skip the basics in this article as this has been explained in my other article.
2 min read
Authentication Security
T1556.009 - Detect and prevent suspicious conditional access policy modifications

T1556.009 - Detect and prevent suspicious conditional access policy modifications

In April 2024, MITRE came with their new V15 version of ATT&CK. In this version a new sub-technique was introduced called 'T1556.009 - Modify Authentication Process: Conditional Access Policies'. This was, in my opinion, a great addition to the framework, since it is an important technique which can be abused by adversaries. By changing a Conditional Access policy (later referred to as 'CA policy'), an adversary can establish Credential Access, Defense Evasion, and Persistence in Entra ID. Since it is such a vital component, I thought it was time to do a bit of a deep dive into how we can detect and mitigate suspicious CA policy changes.
21 min read
Entra ID Conditional Access MITRE ATT&CK Defender XDR
Authorization Code Flow

Authorization Code Flow

In the past, I was always curious about the workings of Connect-AzAccount, the authentication command from the Az.Accounts PowerShell module. This led me to delve into debugging, and the subsequent article is a product of that exploration. It's intriguing that both Az CLI and Az PowerShell are operational across all tenants, even the newly created ones. I aimed to emulate this functionality in PowerShell and utilize it in my scripts. For instance, this could be beneficial when executing commands across various tenants, a task that the Az modules are not adept at handling.
9 min read
Authentication Security
Using WDAC to ingest missing MDE events and detect token stealing

Using WDAC to ingest missing MDE events and detect token stealing

In a previous blog post I talked about how adversaries can exploit SSO capabilities of Hybrid or fully Entra ID joined devices. I mentioned the different ways we can steal tokens from the devices, either by using BrowserCore.exe or MicrosoftAccountTokenProvider.dll.
7 min read
Entra ID WDAC Tokens PRT Stealing
From hybrid / fully joined devices to Entra ID

From hybrid / fully joined devices to Entra ID

Adversaries are more and more interested in the data and infrastructure that lives in Cloud environments like Azure and Microsoft 365 solutions. Since Microsoft EntraID is the most common central IDP solution for these environments, it is important to identify the possible paths attackers can use to move from a device to possible crown jewels that live in these Cloud solutions. In this blog post, I wanted to talk about how adversaries can use Entra ID Joined or Hybrid Joined devices to move laterally to the cloud, using EntraID SSO features, and how they can get a foothold on these devices. This blog post is based on a Red-Teaming scenario I encountered in a real-life, and is written from a Blue-Teaming perspective.
22 min read
Entra ID Purple Team Tokens PRT Stealing

Infrastructure as Code

Bicep: Dynamic naming technique

Bicep: Dynamic naming technique

When designing IaC modules finding the correct syntax to deploy a certain resource type is often not the hardest thing to do. What I found in 3 years of writing Bicep code, is that defining a dynamic way to name your resources which is also easy to use, seems to pose quite the challenge. This article won't define the best way to get this but a way that seems to work for me and the customers I have worked with in the past.
7 min read
Bicep Azure IaC
Ghost blogging on Azure Container Apps

Ghost blogging on Azure Container Apps

Hosting a blog these days can easily be done without having to cost anything. There are a lot of solutions in the likes of Medium, Weebly, Wix,... But for the more technology-minded people like us, who want to go the extra mile, we didn't go for the easiest solution. We chose to run our blog on Azure Container Apps using the Ghost blogging platform.
22 min read
Bicep Azure IaC