Identity · InfosecFeed Brief
Even MOAR Powershell, looking at Entra logins - the good, the bad and the password sprays, (Fri, Aug 21st)
Identity
What you need to know
One thing that folks never seem to do after "going to the CLOOOOUUUUD" is to look at their logs, logs that they would have checked daily when things were on premise.
 One log that really bears looking at is the log of successful and failed logins. the call for that is:
Source transparency
Read the original report at SANS Internet Storm Center ↗
This is an InfosecFeed curated brief based on reporting from SANS Internet Storm Center. InfosecFeed does not claim ownership of the original reporting.