Collaborate Disseminate
Using impersonation insight to view domains that are sending phishes, there are several that are being delivered, even though our policy is to quarantine.
One domain that is commonly abused is icloud.com. Although, there are some false po… Continue reading Impersonation Insight – Microsoft 365 security [migrated]
Received an alert of a medium user at risk report. Our policy alerts on medium risks and requires a password change with MFA verification, but the sign-in logs are a little confusing on what generated the alert:
The snapshot is from the s… Continue reading Microsoft Identitiy Protection – Risky sign-ins
My responder is still catching hashes from Windows 10 box that has had Netbios over TCP/IP (DHCP scope option) and LLMNR disabled (GP).
The workstation invokes the net view \\responderip and responder displays the hash. Please confirm thi… Continue reading Responder still catching hashes with LLMNR and Netbios over TCP/IP disabled. Is this by design?