Cybersecurity & Career Reflections
tl;dr: Requests to Microsoft Graph’s $batch endpoint bundle several API calls into one JSON object. This makes analyzing Azure Portal traffic difficult, since underlying API calls for requests to the $batch endpoint are not individually logged. This post shares the graph_batch_parser.py Burp Suite extension as a way to speed up analysis of $batch requests. The extension processes $batch re...
tl;dr: This post documents requirements for logging the CopilotInteraction event, as well as some caveats of when it isn’t logged. This event is key for Copilot audit trails. An App Insights alternative for logging interactions in Copilot Studio is also provided. Background In August 2025, I started looking into Copilot Studio. This led to some really interesting discoveries, like using Copil...
I recently presented “Persisting Unseen: Attacker Methods of Infesting Entra ID” at RSAC’s virtual Cloud Security seminar. This session introduced some methods attackers may use now or in the near future to maintain access to Entra ID (formerly Azure AD) once they’ve obtained a privileged foothold. This post serves two purposes: A follow-up to my session that you can easily share with your ...
The Azure Resource Graph Explorer is a great way to quickly understand your Azure netework exposure. Simple KQL queries let you review all your resources at once, free of charge! More complex joins can allow reviews of VM exposure, complete with VM IP address. As a part of the Cloud Secuirty Podcast’s “Advent of Cloud Security”, I created a small lab exercise to get you started on all your Res...
This post documents the process to create and test a new attack technique for Stratus Red Team, a threat emulation tool built in Terraform and Go. Introduction I recently had the opportunity to contribute to Stratus Red Team as a part of my research into Entra ID administrative units. I’ve found open-source contributions can feel daunting if you haven’t been through them before. Based on that...