One-tricked a personal Brigitte build to Pro in just 5 hours lmao, On my way to Legend #overwatch
| Websiste | https://lucienpannatier.ch |
| Bluesky | https://bsky.app/profile/bluewall.me |
| Pixelfed | https://pixel.infosec.exchange/bluewall |
Bluewall 
- 214 Followers
- 307 Following
- 1.3K Posts
InfoSec & IT Lead in the humanitarian sector (Switzerland 🇨🇭). Blue Team defender, securing with M365, Entra & Intune. Cross-platform by nature : Linux, macOS, Windows. Home Assistant tinkerer, consoles. Game design nerd, Pro Overwatch Stadium player. Podcasts & photography.
Update 🧵
Rules ARE active, Event ID 1121 confirms blocking (WmiPrvSE → HPFirmwareInstaller blocked, LSASS protection firing daily).
But Get-MpPreference returns empty, registry key missing. TVM can't detect them → Secure Score stuck at 22/22 exposed.
Anyone seen this before? #MDE #Intune #DefenderForEndpoint
Rules ARE active, Event ID 1121 confirms blocking (WmiPrvSE → HPFirmwareInstaller blocked, LSASS protection firing daily).
But Get-MpPreference returns empty, registry key missing. TVM can't detect them → Secure Score stuck at 22/22 exposed.
Anyone seen this before? #MDE #Intune #DefenderForEndpoint
Weird Intune/MDE issue 🧵
ASR policy (Block PSExec/WMI) shows 38 Succeeded in Intune, but Get-MpPreference returns empty on endpoints and registry key doesn't exist.
AttackSurfaceReductionRules_ProviderSet = 1 in PolicyManager but no actual rule values written anywhere.
Cloud-only, no SCCM. Anyone seen this? #MicrosoftDefender #Intune #MDE
ASR policy (Block PSExec/WMI) shows 38 Succeeded in Intune, but Get-MpPreference returns empty on endpoints and registry key doesn't exist.
AttackSurfaceReductionRules_ProviderSet = 1 in PolicyManager but no actual rule values written anywhere.
Cloud-only, no SCCM. Anyone seen this? #MicrosoftDefender #Intune #MDE
My Ubuntu-certified HP EliteBook greeted me this morning with a lovely blue GRUB screen. Memory test, UEFI Firmware Settings, the works.
apt full-upgrade installed a new OEM kernel and Canonical forgot 3 lines of GRUB config in their package.
This is the kind of detail that kills the Linux desktop experience. On a *certified* laptop.
That's it for me, good night/day everyone, see you tomorrow for more security shenanigans.
When you try to join a local cybersecurity association and they ask for your number to add you to the WhatsApp group.
Am I the only one seeing a slight consistency issue here? 😅
I wish I was kidding.
EvilTokens; new PhaaS actively targeting Microsoft 365 via Device Code Flow abuse.
The attack abuses the legitimate OAuth Device Authorization Grant. The attacker sends you a code, you enter it on the REAL microsoft.com/devicelogin page and they get your tokens. MFA bypassed. Password reset won't revoke access.
Check if the flow is used in your tenant:
Entra Sign-in logs → filter "Authentication Protocol: Device code" → Last 30 days → check all 4 tabs.
All empty? You can block safely.
Block it:
Conditional Access → New policy → All users → All resources → Conditions: Authentication flows > Device code flow → Grant: Block access → ON.
Takes 5 minutes. Do it now.