Katie Knowles

CoPhish: Using Microsoft Copilot Studio as a wrapper for OAuth phishing securitylabs.datadoghq.com/articles/cop... by @siigil.bsky.social

😈 Copilot Studio agents are great for users... and attackers! Check out our deep-dive on why you should be careful to trust unknown agents, plus background on upcoming app consent changes that will help prevent our demo scenario. securitylabs.datadoghq.com/articles/cop...

Old and busted: Cloud attackers making noisy List/Describe calls. New hotness: Laundering enumeration calls through an AWS service silently. Or at least, that used to work, until @datadoghq.com partnered with AWS to close this gap. Read more here: securitylabs.datadoghq.com/articles/enu...

🎉 Exciting news: The Office 365 Exchange Online SP privilege escalation we documented in "I SPy" is no longer possible! We've updated the post to reflect this. Thanks to Eli Guy for the tip on this one: securitylabs.datadoghq.com/articles/i-s...

Check out my new blog on nested app authentication.

Excited to see folks at DEFCON next week!! Ready to see some great talks and get those conference steps in. 👟

🕵️‍♀️ Looking to escalate privileges with a first-party Microsoft app? How do federated domain backdoors work? And what's an app reg, really? All this and more in our new @securitylabs.datadoghq.com post: securitylabs.datadoghq.com/articles/i-s...

Join my team! We’re looking for a Senior Security Researcher specializing in Generative AI. You’ll have the opportunity to be a part of one of the leading security research organizations in the industry and shape Datadog’s security products! A 🧵 careers.datadoghq.com/detail/70312...

☁️ My fwd:cloudsec talk, "I SPy: Rethinking Entra ID research for new paths to Global Admin", is up! Learn what a service principal is, how Microsoft's first-party apps could be backdoored, and one weird trick they haven't fixed yet: www.youtube.com/watch?v=oNpw...

At @wearetroopers.bsky.social I dropped new research on #nOAuth, an abuse of #EntraID that allows you to spoof users in vulnerable SaaS applications. The attack is still alive and well. You can read all about it here: #Entra #M365 #infosec www.semperis.com/blog/noauth-...

My RSAC virtual session is up! Catch "Persisting Unseen: Attacker Methods of Infesting Entra ID" here: youtu.be/ngSFP-tgupM?... Companion blog: kknowl.es/posts/defend...

🕵️‍♀️ I'll be presenting "I SPy: Rethinking Entra ID research for new paths to Global Admin” at fwd:cloudsec June 30-July 1, alongside some fantastic other speakers: fwdcloudsec.org/conference/n... If you can’t make it, talks are streamed at: www.youtube.com/@fwdcloudsec

🥷 Detect & defend vs Entra ID persistence! From my RSAC Cloud Summit talk, I've shared how attackers persist through Entra ID roles, applications, and authentication... and how you can stop them: kknowl.es/posts/defend...

Excited to speak at @fwdcloudsec.org in Denver on June 30 with Anthony Randazzo! We’ll share lessons from a year of cloud threat hunting. Don’t miss other @securitylabs.datadoghq.com talks from @siigil.bsky.social on EntraID escalation and @sethsec.bsky.social on AMI name confusion as well!

🌐 I'll be speaking at RSA Conference's Virtual Seminar on Cloud Security on June 5, 2025! I'll be sharing a technical overview of Entra persistence techniques for all levels. You can sign up to stop by here: www.rsaconference.com/library/virt...

The CFP for fwd:cloudsec Europe is now open! We're looking for practitioner-focused cloud security content, and we encourage all practitioners to submit, whatever your role or level of experience. The CFP is open until July 11th. Read more: fwdcloudsec.org/conference/e...

👾 It's up!! Everything you ever wanted to know about Entra Administrative Unit (AU) attack paths, from my talk at @specterops.io SO-CON 😁 www.youtube.com/watch?v=oxD7...

In our latest blog post, @xpnsec.com breaks down how SQL Server Transparent Data Encryption works, shares new methods for brute-forcing database encryption keys, & reveals a default key used by ManageEngine's ADSelfService product backups. Read more 👉 ghst.ly/4iXFTyF

Had a fantastic time at @specterops.bsky.social SO-CON and Azure training! So much to learn, and so many incredible people to meet. Feeling excited to apply all this knowledge... time to head home. 😁

Excited to be at @specterops.bsky.social SO-CON this week!! If you're around, I'll be presenting "Abusing AUs, Confusing the SOC" tomorrow bright & early:

🛡️ We found a bug in restricted AUs that let accounts stay restricted (forever!) without an AU, preventing containment. Glad this is fixed now! More details here: securitylabs.datadoghq.com/articles/cre...

The Datadog Security Digest is a monthly, practitioner-focused newsletter. Don't miss our February edition going live tomorrow! securitylabs.datadoghq.com/newsletters/...

We discovered a pattern in the way many projects retrieve Amazon Machine Images (AMIs), allowing attackers to publish AMIs with specially crafted names and gain code execution within vulnerable accounts. securitylabs.datadoghq.com/articles/who... by @sethsec.bsky.social

Check out this new blog post from @andyrobbins.bsky.social discussing the fundamental components & mechanics that enable the emergence of critical Attack Paths in Microsoft's increasingly popular Intune product. ghst.ly/3Cd5cwH

🎄Have you ever paid for a simple product and thought, "Hey, I could build that"? As a pre-holiday project, I tried my hand at "home cooking" my own web text editor with GPT Canvas: kknowl.es/posts/home-c... + the results: github.com/siigil/brevity

"Escalating privileges to read secrets with Azure Key Vault access policies" by @siigil.bsky.social securitylabs.datadoghq.com/articles/esc...

🔑 Azure Key Vault Contributors can't access keys... but they CAN modify access policies! More on how this can lead to unintended data access here: securitylabs.datadoghq.com/articles/esc...

🎄 I shared a lab on reviewing Azure security with KQL + Resource Graph Explorer! My walkthrough is available as Day 14 of the Advent of Cloud Security: ❄️ Calendar, Day 14: advent.cloudsecuritypodcast.tv ❄️ Full Repo: github.com/siigil/azure...

Check out the kickoff to @hotnops.bsky.social's multi-part blog series on attacker tradecraft around the syncing mechanics between Active Directory & Entra. In this first part, he shows how complete control of an Entra user is equal to compromise of the on-premises user. ➡️ ghst.ly/3Bu19eW

Want to run roadrecon, but a device compliance policy is getting in your way? You can use the Intune Company Portal client ID, which is a hardcoded and undocumented exclusion in CA for device compliance. It has user_impersonation rights on the AAD Graph 😃

"Tales from the cloud trenches: Unwanted visitor" securitylabs.datadoghq.com/articles/tal... This post describes an attacker that we've observed in the wild, including a malicious AWS account ID used to create a backdoor IAM role.

We talk about Obsidian as a second brain, but I prefer the joy it can spark as a "second braincell". Wikipedia will never love your banter the same way you do:

If you've ever wanted to add "Stratus Red Team Contributor" to your list of titles! 😉

Stratus Red Team v2.20.0 is now available, with great contributions from @flekyy90.bsky.social allowing you to reproduce AWS TTPs seen in the wild! ➔ Use GetFederationToken to generate temporary credentials ➔ Use SendSerialConsoleSSHPublicKey to pivot to EC2 instances github.com/DataDog/stra...

Our Founding Engineer Michael has been in the weeds of Azure logging for the past few months. Some of the details discovered may surprise you... tracebit.com/blog/azure-d...

🌤️ Happy Friday!! Wondering what's in Entra ID's Free tier for your lab experiments? I recently found out this moved to a Microsoft Learn page, instead of its previous home on the sales page: learn.microsoft.com/en-us/entra/...

Hello! 👋 I'm still getting set up, & will be exploring the next few days.