A summary of the latest trends in real-world security incidents and breaches.   #defend

Dropbox has filed an 8-K with the SEC, reporting a cybersecurity incident affecting Dropbox Sign.   #attack   #saas

V15 is all about actionability and bringing defenders' reality into focus. MITRE prioritized what you need to detect, and how you can do it more effectively.   #defend   #monitor

Imagine you create an empty, private AWS S3 bucket in a region of your preference. What will your AWS bill be the next morning?   #attack   #aws

Use Semgrep to evangelize secure-by-default modules, create opinonated rules, and to secure your CI/CD.   #build   #ci/cd   #iac

Postman, the popular API testing platform, hosts the largest collection of public APIs. Unfortunately, it's become one of the largest public sources of leaked secrets.   #attack   #saas

It's simultaneously painful and fun.   #build

When an AML workspace is created, by default, the Storage Account is publicly accessible using the access key.   #attack   #azure

This blog explains how reply URLs in Azure Applications can be used as a vector for phishing. The impact of this can range from data leaks to complete tenant takeover; just by luring a victim into clicking on a link.   #attack   #azure

From June 2023 to March 2024, Microsoft Graph was vulnerable to a logging bypass that allowed attackers to perform password-spray attacks undetected. During this period, any organization in Azure could have been attacked and would have had no indication of the activity.   #attack   #azure

Easily check your clusters for use of deprecated APIs.

Serverless Extensible Slackbot.

GCP IAM Brute is a tool that leverages the testIamPermissions feature in GCP to perform fuzz testing for different permissions within GCP.

A simple script which implements different Cognito attacks such as Account Oracle or Privilege Escalation.

You can now define policies for centrally creating, deploying and managing VPC NACL rules for VPC subnets across accounts in an AWS Organization.

The story of one honeypot instance and how it enabled Microsoft to collect varied threat intelligence against a broad range of actor groups targeting Microsoft.