337 articles
S’abonner (RSS)a semaine du 5 août 2026.
Un nouveau malware Windows truffé de fonctions IA vient de faire surface dans le monde des cybercriminels. Ce logiciel malveillant est capable de classer automatiquement les victimes selon leur potentiel de rentabilité. Il permet ainsi aux pirates de mieux choisir leurs victimes.
Learn about Authenticator-specific requirements, configuration, and troubleshooting for passkeys in Microsoft Authenticator for Microsoft Entra ID.
Microsoft conserve la croissance cloud la plus élevée parmi les grands hyperscalers. Azure affiche une progression de 43 % sur un an tandis que l’ensemble de l’activité Microsoft Cloud atteint 59,3 milliards $ de chiffre d’affaires trimestriel, en hausse de 27 %. Le groupe attribue cette performance à la diffusion croissante de ses offres d’IA, notamment Azure AI et Microsoft 365 Copilot. Microsoft indique désormais compter plus de 30 millions d’utilisateurs payants de Microsoft 365 Copilot. Aut
Stop sensitive data from leaving your organization. Extend data detection and identity-aware enforcement to the network—now in preview.
Learn how Microsoft Purview DLP protects Microsoft 365 Copilot and Copilot Chat by blocking sensitive prompts, restricting web search, and excluding labeled content.
dr-ish is that if you insert carefully worded instructions, as white-text thus making it invisible to the user, at the end of Microsoft Office documents, Microsoft Copilot will follow the instructions given to it. The problem with this method (as is tradition), is that the text is still visible in the document if highlighted by the user. Hence, doing something as simple as CTRL+A would render the text visible to the user. Regardless, Håkon Måløy successfully appended white text to a Microsoft Office document that halved the values of company data presented in the document. In simple words, the appended white text manipulated company data in the Microsoft Word file. His second proof-of-concept demonstrated appended white texting propagating the appended white text to other Microsoft Office documents, thus making…
Automatic Migration reduces the time and expertise needed to migrate to a new SIEM. The first version of this feature maps and translates existing SIEM artifacts with AI, reducing cost, complexity, an...
Use Automatic Import with an LLM to build a custom Elastic integration from a data sample when no prebuilt integration exists, for Security, Observability, and other solutions.
A while back, I read an interesting blog by Oddvar Moe about Pre-created computer accounts in Active Directory. In the blog, Oddvar also describes the option to configure who can join the computer to the domain after the object is created. This sets an interesting ACL on computer accounts, allowing the principal who gets those rights to reset the computer account password via the “All extended rights” option. That sounded quite interesting, so I did some more digging into this and found there are more ACLs set when you use this option, which not only allows this principal to reset the password but also to configure Resource-Based Constrained Delegation. BloodHound was missing this ACL, and I dug into why, which I’ve written up in this short blog. If an environment is sufficiently large (and/or old), someone at some point likely added a few systems to the domain with this option set to “Everyone” or “Authenticated Users”, allowing all users in the domain to join the computer to the domain. Whoever configured this probably did not realize this would also give everyone specific permissions on the object after it is joined to the domain. The logic to analyze this is now included in the BloodHound.py data gatherer, as well as a Pull Request for SharpHound. If this misconfiguration is present in a domain, it may give you access to servers from any user. This makes for an easy first step in lateral movement. Along the way, I discovered more cases in which these ACEs were present, so in any larger environment, there’s a good chance that unintended users have some lingering permissions on computer objects. This post includes some queries to use in BloodHound, as well as some recommended mitigations.
Understand Cluster Shared Volumes (CSV) in Windows Server failover clusters, including features, requirements, and best practices for deployment and management.
POC tool to abuse windows server failover clusters - garrettfoster13/fustercluck
Historically, running advanced analytics or training ML models across clouds meant a cross-cloud tax: high egress fees, network latency, and fragile ETL pipelines. The borderless Lakehouse solves this with Cross-Cloud Interconnects. These private, dedicated links deliver consistent bandwidth and lower latency than the public internet, at a fraction of the cost of traditional cross-cloud connections. The borderless Lakehouse supports zero variable egress costs when accessing your data from AWS1.
CEO, @MicrosoftAI | Author: The Coming Wave | Past: Co-founder, @InflectionAI & @GoogleDeepMind
Scripts for packaging virtio-win drivers. Contribute to virtio-win/virtio-win-pkg-scripts development by creating an account on GitHub.
Learn about the Microsoft implementation of the Server Message Block (SMB) Protocol.
Microsoft n’hésite pas à déclarer que son modèle, profondément intégré à MDASH, a été « perfectionné par les meilleurs experts en cybersécurité du secteur et renforcé dans le plus grand domaine de sécurité au monde ». Ce qui lui permet, toujours selon Microsoft, de battre tout le monde dans le domaine de la détection de failles, y compris Mythos, GPT 5.6 Sol, GPT 5.5 Cyber et Gemini 3.5 Flash Cyber. Avec 95,95 % au test CyberGym, Microsoft dépasse d’au moins 10 points la concurrence. Mais attent
Microsoft a présenté le 27 juillet 2026 une architecture de sécurité entièrement bâtie sur l'IA agentique, avec une préversion publique annoncée pour le 3 août 2026. La cybersécurité est devenue l'un des terrains de bataille les plus visibles de la course à l'IA, et chaque acteur y va désormais de son programme
CORTEX