Identity Threat Detection & Response
Categories
- Active Directory Backup & Recovery (64)
- Active Directory Security (225)
- AD Security 101 (17)
- Community Tools (19)
- Directory Modernization (9)
- From the Front Lines (69)
- Hybrid Identity Protection (69)
- Identity Attack Catalog (32)
- Identity Threat Detection & Response (151)
- Our Mission: Be a Force for Good (14)
- Purple Knight (5)
- Semperis University (5)
- The CISO's Perspective (16)
- Threat Research (69)
- Uncategorized (1)
Understanding Identity Security Posture: See the Big Picture of Your Hybrid Environment
- Sean Deuby | Principal Technologist, Americas
- Jun 27, 2025
Pursuing cybersecurity maturity requires more than flipping a switch. To maintain a strong identity security posture, start by taking a broader look at the complex factors affecting your identity ecosystem.
nOAuth Abuse Alert: Full Account Takeover of Entra Cross-Tenant SaaS Applications
- Eric Woodruff
- Jun 25, 2025
Key findings In testing 104 applications, Semperis found 9 (or roughly 9%) that were vulnerable to nOAuth abuse. As the abuse has been already disclosed, the ability to perform nOAuth is low complexity. nOAuth abuse exploits cross-tenant vulnerabilities and can lead to SaaS application data exfiltration, persistence, and lateral movement.…
How to Defend Against Password Guessing Attacks
- Daniel Petri | Senior Training Manager
- Jun 13, 2025
Here’s what you need to know about password guessing and how to protect Active Directory—and your organization.
BadSuccessor: How to Detect and Mitigate dMSA Privilege Escalation
- Semperis Team
- Jun 05, 2025
The BadSuccessor Active Directory attack technique exploits a dangerous Windows Server 2025 vulnerability. Learn how DSP indicators of exposure and compromise enable you to proactively halt malicious activity.
What is Identity Attack Surface Management?
- Daniel Petri | Senior Training Manager
- May 23, 2025
A specialized identity attack surface management (IASM) practice is not optional. It’s a fundamental necessity for organizations that rely on identity services like Active Directory.
Top 10 Active Directory Risks IFIR Has Caught in the Wild
- Huy Kha | Senior Identity & Security Architect
- May 15, 2025
Identity Forensics and Incident Response prioritizes business resilience, starting with understanding threats and reducing the attack surface. Tackle these 10 common AD risks now to strengthen your identity security.
Defending Against Cable: Prevent Malicious Use of Post-Exploitation Tool
- Huy Kha | Senior Identity & Security Architect
- May 06, 2025
Post-exploitation tools—such as Cable, the Active Directory-specific pentesting tool—are meant to educate security teams. But attackers use them too. Here’s how to detect and defend against malicious use of the Cable tool.
Redefining Cyber Crisis Management
- Mickey Bresman
- Apr 25, 2025
Cyber resilience isn't just about technology—it's about people, processes, and the ability to act decisively when everything is on the line. It's about discipline, preparation, confidence, and the ability to adapt under pressure. At Semperis, we've spent years helping organizations recover from identity-based cyberattacks. But time and again, we’ve seen…
