Fabian Bader

fabian.bader.cloud

18 January 2026 11:32

#ConsentFix is a great way for attackers to work around some protective layers but not all. @naunheim.cloud , @cbrhh.bsky.social and I wrote a blog post on detection and mitigations. Hope you find it useful and can adapt it to your environment. www.glueckkanja.com/de/posts/202...

Nathan McNulty

nathanmcnulty.com

23 November 2025 18:12

Hey folks, just jumping on a live Entra Chat to talk about all the Ignite announcements with @merill.net, @naunheim.cloud, Martin Sandren, and Ru Campbell! Come join us at riverside.fm/studio/entra...

Merill Fernando 💚

merill.net

02 November 2025 10:14

Thomas Naunheim and Sami Lamppu quietly built one of the most useful open projects for Entra ID defenders. The Entra ID Attack & Defense Playbook It’s free, community-driven, and packed with real detection logic and KQL queries. 🧵👇

Scott Hanselman 🌮

scott.hanselman.com

18 July 2025 04:18

I just wanted to say, I’m probably more proud of this Ted talk than just about anything I’ve ever done so I’m gonna be absolutely useless for the next couple of weeks as I promote the shit out of this because I want you to watch it because it matters in the moment we are in youtu.be/dVG8W-0p6vg

Dirk-jan

dirkjanm.io

20 February 2025 20:16

It appears Microsoft quietly mitigated most of the risk of the "Intune company portal" device compliance CA bypass by restricting the scope of Azure AD graph tokens issued to this app, making them almost useless for most abuse scenarios. Thx @domchell.bsky.social for the heads up.