Identity Threat Detection & Response
Categories
- Active Directory Backup & Recovery (69)
- Active Directory Security (239)
- AD Security 101 (18)
- Community Tools (26)
- Crisis Management (5)
- Directory Modernization (9)
- From the Front Lines (70)
- Hybrid Identity Protection (84)
- Identity Attack Catalog (32)
- Identity Threat Detection & Response (169)
- Our Mission: Be a Force for Good (14)
- Purple Knight (6)
- Semperis University (5)
- The CISO's Perspective (18)
- Threat Research (79)
- Uncategorized (3)
What Is EntraGoat? A Deliberately Vulnerable Entra ID Simulation Environment
- Jonathan Elkabas and Tomer Nahum
What’s the best way to build cyber resilience? Practice! Meet EntraGoat, your safe space for hands-on, CTF-style learning. Track attack paths, hunt down identity misconfigurations, and expose access control flaws—while building resilience against real-world threats.
Improve Hybrid AD Security with Automated Response and Streamlined Administration
- Eran Gewurtz | Director of Product Management
Service accounts are easy to misconfigure, hard to keep track of, and often forgotten, making them ideal entry points for cyber attackers. Learn how DSP expands your ability to discover, monitor, govern, and protect service accounts.
How to Block BadSuccessor: The Good, Bad, and Ugly of dMSA Migration
- Jorge de Almeida Pinto
The BadSuccessor privilege escalation technique presents a severe risk to Active Directory environments that use delegated Managed Service Accounts. Learn how blocking dMSA migration prevents attackers from misusing a dMSA to take over an AD domain.
Understanding Identity Security Posture: See the Big Picture of Your Hybrid Environment
- Sean Deuby | Principal Technologist, Americas
Pursuing cybersecurity maturity requires more than flipping a switch. To maintain a strong identity security posture, start by taking a broader look at the complex factors affecting your identity ecosystem.
nOAuth Abuse Alert: Full Account Takeover of Entra Cross-Tenant SaaS Applications
- Eric Woodruff | Chief Identity Architect
Key findings In testing 104 applications, Semperis found 9 (or roughly 9%) that were vulnerable to nOAuth abuse. As the abuse has been already disclosed, the ability to perform nOAuth is low complexity. nOAuth abuse exploits cross-tenant vulnerabilities and can lead to SaaS application data exfiltration, persistence, and lateral movement.…
How to Defend Against Password Guessing Attacks
- Daniel Petri | Senior Training Manager
Here’s what you need to know about password guessing and how to protect Active Directory—and your organization.
BadSuccessor: How to Detect and Mitigate dMSA Privilege Escalation
- Semperis Team
The BadSuccessor Active Directory attack technique exploits a dangerous Windows Server 2025 vulnerability. Learn how DSP indicators of exposure and compromise enable you to proactively halt malicious activity.
What is Identity Attack Surface Management?
- Daniel Petri | Senior Training Manager
A specialized identity attack surface management (IASM) practice is not optional. It’s a fundamental necessity for organizations that rely on identity services like Active Directory.
