├── .DS_Store ├── .gitignore ├── Entra_ID_CAE ├── .DS_Store ├── Entra_ID_Continuous_access_evaluation.md └── Images │ ├── cae_1.png │ ├── cae_2.png │ ├── cae_3.png │ ├── cae_4.png │ ├── cae_5.png │ ├── cae_6.png │ ├── cae_7.png │ ├── cae_8.png │ └── cae_9.png ├── Entra_certificate_binding ├── Entra_ID_certificate_binding.md └── Images │ ├── Claim_in_Token.JPG │ ├── OID.JPG │ ├── OID_Entra.JPG │ ├── SKI_Entra_ID.JPG │ └── SKI_local_user.JPG ├── Hunting_Defender_for_cloud └── VMs_with_public_ips.md ├── Hunting_Defender_for_endpoint ├── Advanced_hunting_on_a_suspicion.md ├── Advanced_hunting_queries.md └── Links.md ├── Images ├── Example_1.png ├── Example_2.png ├── Example_3.png ├── Example_4.png ├── Example_5.png ├── Example_6.png ├── Example_7.png ├── Example_8.png ├── Example_9.png ├── Hunt_1.png ├── Hunt_2.png ├── Hunt_3.png ├── M365.png ├── fail2_0.png ├── fail2_1.png ├── fail2_2.png ├── fail2_3.png └── fail2_4.png ├── Links.txt └── README.md /.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tomwechsler/Microsoft_365_Enterprise_Mobility_Security/HEAD/.DS_Store -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | .DS_Store -------------------------------------------------------------------------------- /Entra_ID_CAE/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tomwechsler/Microsoft_365_Enterprise_Mobility_Security/HEAD/Entra_ID_CAE/.DS_Store -------------------------------------------------------------------------------- /Entra_ID_CAE/Entra_ID_Continuous_access_evaluation.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tomwechsler/Microsoft_365_Enterprise_Mobility_Security/HEAD/Entra_ID_CAE/Entra_ID_Continuous_access_evaluation.md -------------------------------------------------------------------------------- /Entra_ID_CAE/Images/cae_1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tomwechsler/Microsoft_365_Enterprise_Mobility_Security/HEAD/Entra_ID_CAE/Images/cae_1.png -------------------------------------------------------------------------------- /Entra_ID_CAE/Images/cae_2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tomwechsler/Microsoft_365_Enterprise_Mobility_Security/HEAD/Entra_ID_CAE/Images/cae_2.png -------------------------------------------------------------------------------- /Entra_ID_CAE/Images/cae_3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tomwechsler/Microsoft_365_Enterprise_Mobility_Security/HEAD/Entra_ID_CAE/Images/cae_3.png -------------------------------------------------------------------------------- /Entra_ID_CAE/Images/cae_4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tomwechsler/Microsoft_365_Enterprise_Mobility_Security/HEAD/Entra_ID_CAE/Images/cae_4.png -------------------------------------------------------------------------------- /Entra_ID_CAE/Images/cae_5.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tomwechsler/Microsoft_365_Enterprise_Mobility_Security/HEAD/Entra_ID_CAE/Images/cae_5.png -------------------------------------------------------------------------------- /Entra_ID_CAE/Images/cae_6.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tomwechsler/Microsoft_365_Enterprise_Mobility_Security/HEAD/Entra_ID_CAE/Images/cae_6.png -------------------------------------------------------------------------------- /Entra_ID_CAE/Images/cae_7.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tomwechsler/Microsoft_365_Enterprise_Mobility_Security/HEAD/Entra_ID_CAE/Images/cae_7.png -------------------------------------------------------------------------------- /Entra_ID_CAE/Images/cae_8.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tomwechsler/Microsoft_365_Enterprise_Mobility_Security/HEAD/Entra_ID_CAE/Images/cae_8.png -------------------------------------------------------------------------------- /Entra_ID_CAE/Images/cae_9.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tomwechsler/Microsoft_365_Enterprise_Mobility_Security/HEAD/Entra_ID_CAE/Images/cae_9.png -------------------------------------------------------------------------------- /Entra_certificate_binding/Entra_ID_certificate_binding.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tomwechsler/Microsoft_365_Enterprise_Mobility_Security/HEAD/Entra_certificate_binding/Entra_ID_certificate_binding.md -------------------------------------------------------------------------------- /Entra_certificate_binding/Images/Claim_in_Token.JPG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tomwechsler/Microsoft_365_Enterprise_Mobility_Security/HEAD/Entra_certificate_binding/Images/Claim_in_Token.JPG -------------------------------------------------------------------------------- /Entra_certificate_binding/Images/OID.JPG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tomwechsler/Microsoft_365_Enterprise_Mobility_Security/HEAD/Entra_certificate_binding/Images/OID.JPG -------------------------------------------------------------------------------- /Entra_certificate_binding/Images/OID_Entra.JPG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tomwechsler/Microsoft_365_Enterprise_Mobility_Security/HEAD/Entra_certificate_binding/Images/OID_Entra.JPG -------------------------------------------------------------------------------- /Entra_certificate_binding/Images/SKI_Entra_ID.JPG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tomwechsler/Microsoft_365_Enterprise_Mobility_Security/HEAD/Entra_certificate_binding/Images/SKI_Entra_ID.JPG -------------------------------------------------------------------------------- /Entra_certificate_binding/Images/SKI_local_user.JPG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tomwechsler/Microsoft_365_Enterprise_Mobility_Security/HEAD/Entra_certificate_binding/Images/SKI_local_user.JPG -------------------------------------------------------------------------------- /Hunting_Defender_for_cloud/VMs_with_public_ips.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tomwechsler/Microsoft_365_Enterprise_Mobility_Security/HEAD/Hunting_Defender_for_cloud/VMs_with_public_ips.md -------------------------------------------------------------------------------- /Hunting_Defender_for_endpoint/Advanced_hunting_on_a_suspicion.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tomwechsler/Microsoft_365_Enterprise_Mobility_Security/HEAD/Hunting_Defender_for_endpoint/Advanced_hunting_on_a_suspicion.md -------------------------------------------------------------------------------- /Hunting_Defender_for_endpoint/Advanced_hunting_queries.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tomwechsler/Microsoft_365_Enterprise_Mobility_Security/HEAD/Hunting_Defender_for_endpoint/Advanced_hunting_queries.md -------------------------------------------------------------------------------- /Hunting_Defender_for_endpoint/Links.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tomwechsler/Microsoft_365_Enterprise_Mobility_Security/HEAD/Hunting_Defender_for_endpoint/Links.md -------------------------------------------------------------------------------- /Images/Example_1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tomwechsler/Microsoft_365_Enterprise_Mobility_Security/HEAD/Images/Example_1.png -------------------------------------------------------------------------------- /Images/Example_2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tomwechsler/Microsoft_365_Enterprise_Mobility_Security/HEAD/Images/Example_2.png -------------------------------------------------------------------------------- /Images/Example_3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tomwechsler/Microsoft_365_Enterprise_Mobility_Security/HEAD/Images/Example_3.png -------------------------------------------------------------------------------- /Images/Example_4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tomwechsler/Microsoft_365_Enterprise_Mobility_Security/HEAD/Images/Example_4.png -------------------------------------------------------------------------------- /Images/Example_5.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tomwechsler/Microsoft_365_Enterprise_Mobility_Security/HEAD/Images/Example_5.png -------------------------------------------------------------------------------- /Images/Example_6.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tomwechsler/Microsoft_365_Enterprise_Mobility_Security/HEAD/Images/Example_6.png -------------------------------------------------------------------------------- /Images/Example_7.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tomwechsler/Microsoft_365_Enterprise_Mobility_Security/HEAD/Images/Example_7.png -------------------------------------------------------------------------------- /Images/Example_8.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tomwechsler/Microsoft_365_Enterprise_Mobility_Security/HEAD/Images/Example_8.png -------------------------------------------------------------------------------- /Images/Example_9.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tomwechsler/Microsoft_365_Enterprise_Mobility_Security/HEAD/Images/Example_9.png -------------------------------------------------------------------------------- /Images/Hunt_1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tomwechsler/Microsoft_365_Enterprise_Mobility_Security/HEAD/Images/Hunt_1.png -------------------------------------------------------------------------------- /Images/Hunt_2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tomwechsler/Microsoft_365_Enterprise_Mobility_Security/HEAD/Images/Hunt_2.png -------------------------------------------------------------------------------- /Images/Hunt_3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tomwechsler/Microsoft_365_Enterprise_Mobility_Security/HEAD/Images/Hunt_3.png -------------------------------------------------------------------------------- /Images/M365.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tomwechsler/Microsoft_365_Enterprise_Mobility_Security/HEAD/Images/M365.png -------------------------------------------------------------------------------- /Images/fail2_0.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tomwechsler/Microsoft_365_Enterprise_Mobility_Security/HEAD/Images/fail2_0.png -------------------------------------------------------------------------------- /Images/fail2_1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tomwechsler/Microsoft_365_Enterprise_Mobility_Security/HEAD/Images/fail2_1.png -------------------------------------------------------------------------------- /Images/fail2_2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tomwechsler/Microsoft_365_Enterprise_Mobility_Security/HEAD/Images/fail2_2.png -------------------------------------------------------------------------------- /Images/fail2_3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tomwechsler/Microsoft_365_Enterprise_Mobility_Security/HEAD/Images/fail2_3.png -------------------------------------------------------------------------------- /Images/fail2_4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tomwechsler/Microsoft_365_Enterprise_Mobility_Security/HEAD/Images/fail2_4.png -------------------------------------------------------------------------------- /Links.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tomwechsler/Microsoft_365_Enterprise_Mobility_Security/HEAD/Links.txt -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tomwechsler/Microsoft_365_Enterprise_Mobility_Security/HEAD/README.md --------------------------------------------------------------------------------