Week 36 · 17 min read
August 31 – September 7, 2026
Act by
- 3 Nov 2026 — the public preview of the MemberOf rule operator in Microsoft Entra ID ends, and configurations that use it stop updating. This covers dynamic groups, dynamic administrative units and entitlement management auto-assignment policies. Microsoft says it observed MemberOf affecting dynamic membership processing across a tenant, which is why it is not recommended for production and is being withdrawn rather than promoted. Audit your dynamic membership rules now: anything still keyed on MemberOf keeps whatever membership it has on 3 November and quietly stops reflecting reality, which for a dynamic AU or an access package is a silent access-governance failure rather than a visible outage. (Microsoft Entra Blog)
What changed
Microsoft Threat Intelligence published a teardown on 2 September of a helpdesk impersonation campaign that runs entirely through Microsoft Teams, and it is the item to brief your tier-1 analysts on this week. The attacker chats the victim from an external tenant posing as IT — the pretexts observed were "Microsoft Security Update", "Spam Filter Update" and "Account Verification" — and talks them into a Quick Assist or RMM remote session, sometimes adding a voice call so the malicious instructions never appear in the chat log. Nothing about Teams is exploited: the external-tenant label, the Accept/Block prompt and the phishing indicators all fire correctly and the user overrides them. Inside the session, PowerShell pulls a malicious MSI from Azure Blob Storage (update1n5, update1n6, update1n7, update1n9 and updatetmp under blob.core.windows.net), the MSI fetches a legitimate portable Node.js from the official distribution, and hidden bootstrap code runs an encrypted JavaScript implant under node.exe that polls out over HTTPS at randomised intervals. From there it is hands-on-keyboard: ADSI enumeration of accounts, servers and user attributes, second-stage DLLs run through rundll32, and WinRM on TCP 5985 toward domain controllers and certificate authorities. One recovered build carried a dormant blockchain-based C2 discovery routine that reads a URL from an Ethereum smart contract, disabled but present. Defender for Endpoint alerts to watch are "Possible initial access from an emerging threat", "Suspicious Node.js process behavior", "Suspicious JavaScript process", "Suspicious process launch by Rundll32.exe", "Possible hands-on-keyboard pre-ransom activity" and "Suspicious WinRM activity was observed"; on the collaboration side, "Microsoft Teams chat initiated by a suspicious external user" and "IT Support Teams Voice phishing following mail bombing activity". The three controls worth pushing this week: restrict Teams external access to trusted domains rather than the whole world, publish an internal helpdesk verification phrase so users have a way to say no, and limit WinRM to authorised management workstations and alert when it starts from a user-context process. Treat any host that reached the WinRM stage as a pivot and rotate the domain credentials it held. (Microsoft Security Blog)
The day before, on 1 September, Defender Experts published a tracking report on a counterfeit-installer operation that Microsoft assesses with moderate confidence aligns with the publicly documented Silver Fox activity, affecting China-based operations of multinationals and Chinese-speaking users across healthcare, manufacturing, gaming, technology, logistics, government and education. Victims land on spoofed vendor download pages — pc-razerzone[.]com[.]cn and app-microsoft-edge[.]com[.]cn are the examples given — and take away ZIP archives named app_setup, zinst or zintall whose payloads are regenerated on the fly from dedicated hosts, so file hashes rotate while behaviour does not. The behaviour is the detection opportunity: throwaway SYSTEM-level scheduled tasks that write Add-MpPreference exclusion paths, vssadmin delete shadows /all /quiet, Windows Update disabled by stopping the service and renaming DLLs, scheduled tasks with bland names such as "Deadline Mission Target" and "Hierarchy Tools Smooth Inventory" relaunching payloads roughly every 60 seconds, and payloads masquerading as Philips Speech driver binaries with fabricated version metadata. Drop paths are randomised under C:\Users\Public and C:\Program Files (x86). Command and control runs to six-character .net domains and IP:port endpoints on non-standard ports including 5090, 7031, 7088-7090, 8050 and 28290, hubbed on 202.95.14[.]237. Alerts include "Modification attempt in Microsoft Defender Antivirus exclusion list", "Suspicious Task Scheduler activity" and "Compromised device (attack disruption)". The single highest-value control here is Tamper Protection, which blocks the exclusion writes even when the process is running as SYSTEM — if it is not enforced across your estate, this campaign is a good reason to close that gap this week. (Microsoft Security Blog)
The third teardown, on 3 September, is about a technique crossing over from AI security research into ordinary phishing. ASCII smuggling means splicing invisible Unicode tag characters from the U+E0000 to U+E007F block into text; the reader sees a normal word and the detector sees a fragment. In the campaign Microsoft tracked, U+E0020 (tag space) was inserted into finance vocabulary so that "funding" became "fun" plus an invisible character plus "ding", breaking keyword signatures and producing odd sub-tokens for ML classifiers. The volume is the striking part: a high-volume phase from 9 February to 15 May 2026 peaking at 2.37 million messages a day, around 150 finance-themed disposable domains, about 92 percent of daily volume from a single /24 (173.236.20.0/24), relayed through the legitimate ActiveCampaign marketing platform so that sender reputation was of limited help. Defender for Office 365 caught over 99 percent of it through layered protections independent of the Unicode signature, so this is not a coverage panic — it is a reminder for anyone running their own content rules. The guidance transfers directly to home-grown detections and to anything feeding mail into an LLM: normalise or strip the tag block before you apply signatures or regex, and treat the presence of tag characters as an anomaly signal in its own right, since they are rare in legitimate mail. If you hunt in EmailEvents, the post notes that the relevant detection method to filter on is Prompt Injection Protection. (Microsoft Security Blog)
Defender added five identity security posture management recommendations on 1 September, each tied to an attack technique rather than a hygiene checkbox, and they live in the Defender portal under Exposure management then Recommendations. Two of them are the classic Active Directory escalation paths and are worth running first: non-admin identities holding WriteDACL over a sensitive group, which lets an ordinary account rewrite the group's ACL and grant itself in, and non-admin accounts holding password-reset rights over sensitive groups, which is the shadow admin problem — a user who is low privilege on paper and one reset away from being an administrator. The other three target the cloud side: privileged SaaS app accounts created inside the application and living outside your identity provider, which Microsoft says SaaS data-exfiltration campaigns are actively hunting for because those accounts miss Conditional Access and your SOC cannot see them; service accounts assigned Domain Admin or Global Admin; and external or guest identities granted privileged roles, where a compromise at the other organisation becomes a privileged foothold in yours. The post also flags four existing recommendations still worth prioritising, including dormant accounts in sensitive groups and enforcing sign-in frequency with non-persistent browser sessions for administrators, which is the control that shortens the useful life of a stolen admin session cookie. (Microsoft Defender XDR Blog)
The Entra September roundup, published 1 September, carries two changes that touch SOC workflow directly. The built-in Security Administrator role is being expanded to include identity response actions against non-privileged users — disabling and enabling accounts, revoking active sessions, and forcing password resets — with rollout completing by the end of September 2026. That is a real reduction in the number of people who need a heavier role just to contain a compromised user, and it is worth revisiting your break-glass and on-call role assignments once it lands. Separately, the User.ReadBasic.All Graph permission is being narrowed: it currently leaks app role assignments and licence details, which it was never meant to expose, and that access is being removed. Microsoft describes this as addressing a vulnerability and not a breaking change, but if any of your tooling reads role assignments or licensing through that scope it will need User.Read.All, LicenseAssignment.Read.All, or User.Read.All for both. Also new in preview is the Global Secure Access MCP Firewall, which discovers shadow MCP servers and applies allow or block policy to individual servers, tools, resources and prompts without changing the clients or servers themselves — the first Microsoft control that treats agent-to-MCP traffic as something you inspect rather than something you hope about. (Microsoft Entra Blog)
Defender for Endpoint's what's new page picked up two September items, both preview and both about extending coverage into places the sensor has historically not reached. Memory scan for Linux inspects process memory for known malicious behaviours and memory-resident threats, which is the gap that matters most on Linux servers where an implant may execute entirely in memory and leave nothing on disk for file-based scanning to find; it needs version 101.26071.0005 or later on the Insiders-slow channel. The second is plug-in support for WSL containers, which brings container activity on Windows developer machines into device inventory, alerts, incidents, the device timeline and advanced hunting. If your developers run workloads inside WSL — and on any modern engineering estate they do — that has been a blind spot sitting on managed endpoints. Enrolment is by registration form rather than a portal toggle. (Microsoft Defender for Endpoint what's new)
Defender for Cloud shipped two items on 3 September. Amazon GuardDuty coverage status now appears on the S3 asset page in the Cloud security details section, showing GuardDuty Extended Threat Detection and GuardDuty Malware Protection independently as Enabled or Disabled per bucket. The two are turned on separately in AWS, so a bucket can genuinely have one and not the other, and the useful part is being able to see which buckets are covered without signing in to the AWS console mid-investigation. Separately, Defender for Cosmos DB reached general availability in Azure Government, bringing that plan in line with the commercial cloud on feature coverage and runtime protection. (Microsoft Defender for Cloud release notes)
Three items dated 31 August landed too late for last week's issue and are worth carrying. Microsoft Sentinel's data connectors for Auth0, CrowdStrike Falcon and Salesforce Service Cloud now support multi-account ingestion through the Codeless Connector Framework, so one connector configuration can cover multiple accounts, orgs or tenants instead of forcing duplicate configurations or custom scripts. Analytics rules, workbooks and playbooks apply across all accounts automatically. If you have been carrying a known coverage gap because a subsidiary's CrowdStrike tenant or a business unit's Salesforce org was too awkward to wire up, that excuse is gone — add the account from the connector page and the existing detections follow. (Microsoft Security Community Blog)
The second is a full runbook, also dated 31 August, for running one SOC across many Entra tenants using Azure Lighthouse with a single Sentinel deployment in a hub tenant and delegated read access to each spoke's Log Analytics workspace. The point of the pattern is that source logs never leave the spoke — the spoke keeps workspace ownership, data residency and its own ingestion and retention bill, while hub analysts query across tenants and manage incidents centrally. The write-up is unusually operational: the RBAC baseline is Log Analytics Reader for a SOC-Readers group at workspace or resource-group scope with elevated roles only on documented need, privileged access is PIM-governed rather than standing, and it names the step teams most often miss — registering Microsoft.ManagedServices in every spoke subscription and Microsoft.SecurityInsights plus Microsoft.OperationalInsights on at least one hub subscription, without which delegation silently fails. It also ships validation queries that prove the access path works and a troubleshooting section for the errors you actually hit. (Microsoft Security Community Blog)
The third, published late on 31 August, is a Purview deck on layering endpoint, browser and network data protection, and it is the clearest explanation yet of which layer catches what. Endpoint DLP owns the device — removable media, clipboard, print, restricted apps — carries the deepest classification support including exact data match, fingerprinting and OCR, and keeps working offline. Browser data security sits inline in Edge for Business and inspects content before an upload or form submission, which makes it the precise layer for AI prompts and for activity inside a managed web app. Network data security runs on the wire through Entra Global Secure Access or a third-party SASE and handles traffic that never touches a browser at all — desktop apps and Office add-ins calling out — and it is the only layer that supports inbound classification of content coming back from cloud and AI apps. The material includes six scenario walkthroughs tracing one determined user trying three separate routes to get the same file to a consumer AI service, deployment flows for both browser patterns and both network paths, and a proper breakdown of collection policies, which is the plumbing feeding Activity Explorer, Insider Risk Management, eDiscovery and DSPM. The deployment guidance says to pilot first and keep Conditional Access in report-only mode in production until you have confirmed the behaviour; take that seriously. (Microsoft Purview Blog)
KQL to try
An end-of-life hunt for Defender XDR, published 4 September, that pulls the endoflife.date dataset into advanced hunting with externaldata and joins it to your own estate. Query A lists devices whose operating system reaches end of life within the next 180 days; query B lists installed applications and databases already past end of life. The matching logic is the valuable part and the reason not to write this yourself — it handles the ways Defender actually populates these fields, including CPE-style lower-case vendor and name tokens, qualifiers such as firefox_esr and the (x64) and (user) suffixes, and the fact that Microsoft products report an internal build rather than the marketing year, so SQL Server major version 13 maps to 2016 and Office 12 to 2007. Office 16.x is deliberately left unmapped because 2016, 2019, 2021 and 365 cannot be told apart from the build. (eol_products.kql — Sergio Albea)
// =====================================================================================
// End-of-Life (EOL) hunting — endoflife.date -> Microsoft Defender XDR
// Data: EOL_Products/eol_products.csv (built from https://endoflife.date/ v1 API)
// Two self-contained queries: (A) Operating systems, (B) Applications & databases.
// Matching is tuned to how Defender actually populates the fields:
// DeviceInfo: OSPlatform / OSVersion / OSVersionInfo
// DeviceTvmSoftwareInventory: SoftwareVendor / SoftwareName / SoftwareVersion
// - vendor & name are lower-case CPE-style tokens (microsoft, mozilla, oracle...)
// - name carries qualifiers: firefox_esr, firefox_for_mac, acrobat_reader_dc_for_mac,
// office_16_click-to-run_..., *_(x64), *_(x64_de), *_(user)
// - version is often an internal build, not the marketing version
// =====================================================================================
// ============================ QUERY A — OPERATING SYSTEMS ============================
// Devices whose OS reaches end-of-life within the next 180 days.
let StartDate = now();
let EndDate = datetime_add('day', 180, StartDate);
let eol = externaldata(
category:string,
product_id:string,
product:string,
release:string,
release_date:string,
eol_date:string,
is_eol:string,
is_maintained:string,
latest_version:string,
cpe:string,
defender_vendor:string,
defender_softwarename:string,
aliases:string
)
[@"https://raw.githubusercontent.com/Sergio-Albea-Git/Threat-Hunting-KQL-Queries/main/EOL_Products/eol_products.csv"]
with (format="csv", ignoreFirstRecord=true);
let eol_os =
eol
| where category == "os" and isnotempty(eol_date)
| extend eolDate = todatetime(eol_date)
| extend os_key = case(
product_id == "windows"
and release !contains "(E)"
and release !contains "IoT"
and release !contains "LTS",
strcat("win|", extract(@"^(1[01]\s+\w+)", 1, release)),
product_id == "windows-server"
and release contains "LTSC",
strcat("winsrv|", extract(@"Windows Server (\d{4})", 1, release)),
product_id == "macos",
strcat("mac|", extract(@"(?:macOS|OS X|Mac OS X)\s+(\d+)", 1, release)),
product_id == "ios",
strcat("ios|", extract(@"^(\d+)", 1, release)),
product_id == "android",
strcat("android|", extract(@"^(\d+)", 1, release)),
""
)
| where isnotempty(os_key) and not(os_key endswith "|")
| where eolDate between (StartDate .. EndDate);
DeviceInfo
| where isnotempty(OSPlatform)
| summarize arg_max(Timestamp, OSVersion, OSVersionInfo)
by DeviceId, DeviceName, OSPlatform
| extend os_family = case(
OSPlatform startswith "WindowsServer", "winsrv",
OSPlatform startswith "Windows", "win",
OSPlatform =~ "macOS", "mac",
OSPlatform =~ "iOS", "ios",
OSPlatform =~ "Android", "android",
"other"
)
| extend os_key = case(
os_family == "winsrv",
strcat("winsrv|", extract(@"(\d{4})", 1, OSPlatform)),
os_family == "win",
strcat("win|", extract(@"(\d+)$", 1, OSPlatform), " ", OSVersionInfo),
os_family == "mac",
strcat("mac|", tostring(split(OSVersion, ".")[0])),
os_family == "ios",
strcat("ios|", tostring(split(OSVersion, ".")[0])),
os_family == "android",
strcat("android|", tostring(split(OSVersion, ".")[0])),
""
)
| where os_family != "other" and isnotempty(os_key)
| join kind=inner eol_os on os_key
| extend DaysToEOL = datetime_diff('day', eolDate, now())
| project
DeviceName,
OSPlatform,
OSVersion,
OSVersionInfo,
Matched = product,
EOL_Release = release,
EOL_Date = eol_date,
DaysToEOL
| sort by DaysToEOL asc
// ======================= QUERY B — APPLICATIONS & DATABASES (past EOL) ================
// DeviceTvmSoftwareInventory software whose INSTALLED VERSION is already end-of-life.
// Name is normalized (strip _for_mac / _(x64) / _(user)) and matched to the vendor token;
// the version is mapped to the correct endoflife release so only the EOL cycles are flagged.
let eol = externaldata(
category:string,
product_id:string,
product:string,
release:string,
release_date:string,
eol_date:string,
is_eol:string,
is_maintained:string,
latest_version:string,
cpe:string,
defender_vendor:string,
defender_softwarename:string,
aliases:string
)
[@"https://raw.githubusercontent.com/Sergio-Albea-Git/Threat-Hunting-KQL-Queries/main/EOL_Products/eol_products.csv"]
with (format="csv", ignoreFirstRecord=true);
let eol_apps =
eol
| where category in ("app", "database")
and isnotempty(defender_vendor) and isnotempty(defender_softwarename) and isnotempty(eol_date)
| extend eolDate = todatetime(eol_date)
// normalize the release label to a numeric key: "8.0 (LTS)"->"8.0", "115 (ESR)"->"115",
// "2013 SP1"->"2013", "2005 'Yukon' SP4"->"2005", "24.8"->"24.8"
| extend rel_clean = replace_regex(tolower(release), @"'[^']*'", "")
| extend rel_clean = replace_regex(rel_clean, @"\(esr\)|\(lts\)|for mac|sp[0-9]+|\(w\)|\(e\)|\(ltsc\)|\(ac\)|\(sac\)", "")
| extend rel_key = extract(@"([0-9]+(?:\.[0-9]+)?)", 1, rel_clean)
| where isnotempty(rel_key);
DeviceTvmSoftwareInventory
| where isnotempty(SoftwareVendor) and isnotempty(SoftwareName) and isnotempty(SoftwareVersion)
| extend v = tolower(SoftwareVendor)
| extend nname = replace_regex(tolower(SoftwareName), @"_for_mac$|_\(x64[^)]*\)$|_\(x86[^)]*\)$|_\(user\)$", "")
| extend vmajor = tostring(split(SoftwareVersion, ".")[0])
| extend vminor = tostring(split(SoftwareVersion, ".")[1])
| extend vmm = iff(isnotempty(vminor), strcat(vmajor, ".", vminor), vmajor)
| join kind=inner eol_apps on $left.v == $right.defender_vendor
// match the Defender name to the endoflife token (exact, or token_ prefix for sub-components)
| where nname == defender_softwarename or nname startswith strcat(defender_softwarename, "_")
// Microsoft products report an internal build, not the marketing year -> map build major to year.
// Office 16.x = 2016/2019/2021/365 and cannot be told apart from the build, so it is left blank.
| extend ms_year = case(
v == "microsoft" and defender_softwarename == "sql_server",
case(vmajor == "9", "2005", vmajor == "10", "2008", vmajor == "11", "2012",
vmajor == "12", "2014", vmajor == "13", "2016", vmajor == "14", "2017",
vmajor == "15", "2019", vmajor == "16", "2022", ""),
v == "microsoft" and defender_softwarename == "office",
case(vmajor == "12", "2007", vmajor == "14", "2010", vmajor == "15", "2013", ""),
"")
| where rel_key == vmajor or rel_key == vmm or (isnotempty(ms_year) and rel_key == ms_year)
| where eolDate < now()
| summarize arg_min(eolDate, product, release, eol_date)
by DeviceName, SoftwareVendor, SoftwareName, SoftwareVersion
| project
DeviceName,
SoftwareVendor,
SoftwareName,
SoftwareVersion,
Matched = product,
EOL_Release = release,
EOL_Date = eol_date,
DaysPastEOL = datetime_diff('day', now(), todatetime(eol_date))
| sort by DaysPastEOL desc
Worth knowing
Shayak Lahiri from the edge security team published a piece on 4 September on securing AI that runs on customer-owned infrastructure rather than in a hosted service, and the framing is useful even if you have no edge AI deployments yet. The argument is that when inference moves onto your own hardware, the model, its credentials and its data all sit in an environment you own and must therefore establish trust in yourself, and that conventional software controls do not cover a component whose behaviour changes with runtime inputs such as prompts and retrieval data. The four proposed patterns are worth borrowing as review questions for any agentic system anyone in your organisation is building: deterministic mediation, where the model recommends an action and a separate policy enforcer authorises it against an allowlist; runtime verification through attestation before sensitive assets are released; artifact verification establishing the provenance and integrity of models, prompts and data; and evidence-gated release, binding credentials to approved runtimes with renewable trust leases rather than long-lived secrets. No product announcements attached. (Microsoft Security Blog)
Also on 1 September, the Detection and Response Team opened up its Cybersecurity IR Workshop, a two to three day scenario-based engagement in which DART researchers walk your incident response plan against realistic events across identity, endpoint, cloud and communications, including threat hunting exercises, and close out with recommendations. It is available to organisations with a Unified Enterprise agreement, booked through your Customer Success Account Manager or Premier Support contact. If the Teams helpdesk impersonation chain above made you wonder how your own team would actually handle a live remote-session compromise, this is the structured way to find out before it happens. (Microsoft Security Blog)