Threat Research
Categories
- Active Directory Backup & Recovery (71)
- Active Directory Security (252)
- AD Security 101 (19)
- Agentic AI (16)
- Community Tools (26)
- Crisis Management (9)
- Cyber Resilience (1)
- Directory Modernization (11)
- From the Front Lines (71)
- Hybrid Identity Protection (102)
- Identity Attack Catalog (32)
- Identity Security Research Library (11)
- Identity Threat Detection & Response (180)
- Our Mission: Be a Force for Good (15)
- Purple Knight (6)
- Semperis University (5)
- The CISO's Perspective (19)
- Threat Research (94)
- Uncategorized (3)
Prince of Persia: Threat Group Hiding in Plain Sight
- Tomer Bar | AVP of Security Research
- Oct 22, 2026
APT group Prince of Persia is back, with a surprising new Command and Control (C2) server strategy.
Battling Zombie Certificates: The Persistent Risk Lurking in AD CS
- Jake Hildreth
- Oct 07, 2026
Darkness falls across the land…and Zombie Certificates—authentication certificates that can’t be killed—are close at hand! Learn how to detect and kill these AD CS persistence risks…and prevent another outbreak…
Identity Crisis: Novel Vulnerabilities Leading to Kerberos Downgrade, DoS, and Full Domain Takeover
- Shai Laron | Security Researcher
- Aug 05, 2026
Active Directory (AD) remains the crown jewel of enterprise infrastructure, and for threat actors, the holy grail is clear: gain Domain Admin privileges. This level of privilege effectively grants full control over your environment. Identity protection therefore plays an integral part in enterprise security, and organizations invest great efforts in…
Where Things Might Go Wrong with Agent Identities in Entra ID—and How to Prevent Disaster
- Semion Vasilevitzky and Jonathan Elkabas
- Jul 12, 2026
AI agents aren’t just code running quietly in the background. They’re code with agency, wrapped in identity, carrying permissions, making decisions, and crossing boundaries on behalf of someone or something else. Learn how to avoid some simple but important misconfigurations as your organization begins adopting Agent ID at scale.
Practice Checkpoint 4: Verifying Tokens and Claims in 3 Entra ID Authentication Flows
- Semion Vasilevitzky and Jonathan Elkabas
- Jul 11, 2026
In the previous chapter of our guide to protecting agent identities, you learned about and practiced using Microsoft’s Agent Registry. In this Practice checkpoint, follow the steps to verify three agent identity authentication flows in Entra ID.
Practice Checkpoint 3: Registering an Agent—With and Without Agent ID
- Semion Vasilevitzky and Jonathan Elkabas
- Jul 10, 2026
In the third hands-on practice session in our series on understanding and preventing Entra ID identity attacks, you’ll learn how Microsoft’s Agent Registry works by walking through the steps of registering a new agent identity.
The Agent Registry and How Agent Identities Operate in Entra ID
- Semion Vasilevitzky and Jonathan Elkabas
- Jul 10, 2026
Editor’s Note: Welcome to Chapter 5 of Understanding and Preventing Entra ID Agent Identity Attacks: A Comprehensive Guide. To review previous chapters and practice lessons, start here. While we were writing this blog, the registry blade was removed from the Entra portal. Now the registry is part of the Agent…
Practice Checkpoint 2: Setting Agent Identity Permissions
- Semion Vasilevitzky and Jonathan Elkabas
- Jul 10, 2026
In this Practice Checkpoint—part of our comprehensive Guide to Preventing Entra ID Identity Attacks—you'll walk through the steps to wire up the permission model for an agent identity in the same way it appears in real deployments.
