ParsonsProject @ParsonsProject

DFIR Consultant who knows too much about Office 365 IR and Seattle Transit Find me in BlueSky :) Joined June 2009

Tweets

87
Followers

181
Following

255
Likes

272

ParsonsProject @ParsonsProject

11 months ago

Deleting Twitter, find me on the Blue place (same username).

0 0 0 20 0

Sean Metcalf @PyroTek3

3 years ago

Due to breaches involving MFA bombing (attacker keeps sending MFA requests until accepted) now is the time for organizations with Office 365 to enable MFA number matching in Microsoft Authenticator. You can deploy to a group before configuring for all. docs.microsoft.com/en-us/azure/ac… 1/3

17 283 962 0 272

Download Image

ParsonsProject @ParsonsProject

3 years ago

If you're looking for Operation names to alert or hunt with M365 here's a few to help you out! I would prioritize "Add service principal credentials" for nation state cases. (sourced from my BSides Vancouver talk last year) #DFIR #m365 #o365 #bsidesvancouver #stellarparticle

0 1 0 0 0

Download Image

ParsonsProject @ParsonsProject

4 years ago

Thanks for hosting my talk @BSidesVancouver ! In case you want a copy of the slides here they are! slideshare.net/AlexParsons13/… #DFIR #Office365 #o365 #oauth #azuread

2 2 4 0 0

ParsonsProject @ParsonsProject

4 years ago

If you want to hear my talk on Nation States and how they stealthily navigate through O365/Azure AD, don't forget to register for this virtual conference ! My talk is today at 2:45 PM in Track 2! Register here! eventbrite.ca/e/bsides-vanco… #DFIR #bsidesvancouver #O365 #Office365

0 2 1 0 0

ParsonsProject @ParsonsProject

5 years ago

If you don't want me or my colleagues on an IR call with you, please follow these steps! I'm very happy to finally work with my colleagues to get this blog post published after nearly a year of work to document and consolidate to these steps! #DFIR #O365 aon.com/cyber-solution…

0 2 1 0 1

ParsonsProject @ParsonsProject

5 years ago

It's Friday, so here's some more Sunburst related persistence mechanisms within O365/Azure; glad to have helped the team on this post; happy hunting! tl;Dr Check your legitimate Azure Enterprise Apps for MailRead permissions! aon.com/cyber-solution… #SolarWindsHack #DFIR #O365