Automation & ToolingScripts & Templates

Detecting Kerberoasting with PowerShell and logs

November 14, 2025
Detecting Kerberoasting with PowerShell and Logs Kerberoasting is an Active Directory attack technique where an attacker requests Kerberos service tickets (TGS) for accounts that have Service Principal Names (SPNs), then cracks the ticket offline to recover the service account password. Because it uses legitimate Kerberos flows, the key to detection is understanding what…
Read more
Detection EngineeringSecurity Operations for Identity

Detecting unmanaged accounts via group audit

September 17, 2025
Detecting unmanaged accounts via group audit: advanced comparison guide for AD, Entra, SIEM, and PAM Detecting unmanaged accounts via group audit means using group membership changes and “who got added where” telemetry to surface identities that operate outside expected governance: accounts not onboarded to PAM, not tied to HR/ITSM ownership, not covered by standard…
Read more
Microsoft Entra IDTenant & Directory Administration

How to monitor and backup Azure resources

July 23, 2024
Monitoring and backing up your Azure resources is critical to ensuring the availability, performance, and resilience of your cloud infrastructure and data. Azure provides several tools and services for effective monitoring and backup. Here’s a general guide to monitoring and backing up Azure resources. Monitoring Azure resources Azure offers several tools to monitor your cloud environment…
Read more
Microsoft Entra IDTenant & Directory Administration

How to monitor and report security events in Microsoft Entra ID

June 11, 2024
In Microsoft Entra ID (Azure Active Directory), monitoring and reporting capabilities are vital for safeguarding your organization. They act as vigilant guards, detecting and responding to potential threats within the Microsoft 365 environment. By tracking security events and providing detailed reports, you can stay ahead of cyber risks and maintain a secure digital ecosystem where your data…
Read more
Microsoft Entra IDTenant & Directory Administration

Integrating Azure AD with SIEM

May 24, 2024
Imagine managing your company’s security posture without a central safety net. This is the reality for businesses that do not integrate security information and event management (SIEM) solutions into their environment. What is a SIEM solution? A SIEM solution is pivotal for your organization’s security posture. It collects data from users, servers, devices, and applications, analyzing it…
Read more