Ciaran Doherty's SecOps Blog

Ciaran Doherty's SecOps Blog

Ciaran Doherty's SecOps Blog

Immich Deployment on Windows Server Using Docker, WSL, and SMB-Based Persistent Storage

Immich Deployment on Windows Server Using Docker, WSL, and SMB-Based Persistent Storage

Feb 22, 202615 min read8

ClickFix Forensics: Proving Execution Beyond the Browser

ClickFix Forensics: Proving Execution Beyond the Browser

Dec 21, 20257 min read13

Interactive Microsoft Sentinel Incident Notifications in Teams via an Azure Logic App Using Adaptive Cards.

Interactive Microsoft Sentinel Incident Notifications in Teams via an Azure Logic App Using Adaptive Cards.

Security teams need fast, structured, and contextual alerts. This guide shows how to deliver Sentinel incidents to Teams using Logic Apps.

Jun 12, 20254 min read318

LAPS: The Local Administrator Password Solution For Windows Devices In Entra ID.

LAPS: The Local Administrator Password Solution For Windows Devices In Entra ID.

Nov 30, 20252 min read7

SOC Casefile: Microsoft 365 Account Compromise Investigation.

SOC Casefile: Microsoft 365 Account Compromise Investigation.

Nov 30, 20251 min read9

Deploying Level RMM Using A Microsoft Intune Platform Script.

Deploying Level RMM Using A Microsoft Intune Platform Script.

Streamlining Level RMM deployment across Windows devices using PowerShell and a Microsoft Intune deployment script.

Nov 30, 20253 min read20

Attack Simulation Training - Microsoft Defender for Office 365 (MDO)

Attack Simulation Training - Microsoft Defender for Office 365 (MDO)

A Practical Walkthrough of Simulated Phishing and Behavioural Training in Microsoft Defender for Office 365 (MDO).

Nov 16, 202510 min read190

Bypassing Microsoft Intune Compliant Device Conditional Access Requirements Using TokenSmith

Bypassing Microsoft Intune Compliant Device Conditional Access Requirements Using TokenSmith

How adversaries exploit Intune’s Company Portal to obtain access tokens and bypass Microsoft’s compliant device conditional access controls.

Oct 18, 20251 min read15

How Adversaries Execute AiTM Phishing Campaigns (A Practical Demonstration Using Evilginx3)

How Adversaries Execute AiTM Phishing Campaigns (A Practical Demonstration Using Evilginx3)

An in-depth look at proxy phishing and AiTM attacks, adversary operations and SOC detection, containment and prevention strategies.

Oct 18, 20251 min read8

Auditing Microsoft Entra Authentication Methods with Microsoft Sentinel and Azure Logic Apps

Auditing Microsoft Entra Authentication Methods with Microsoft Sentinel and Azure Logic Apps

A practical guide to collecting and analysing user authentication method data with Microsoft Graph, Azure Logic Apps, and Microsoft Sentinel.

Oct 16, 202511 min read135

Automating Azure NSG Inbound Rules for Dynamic IPs Using DDNS and PowerShell Runbooks

Automating Azure NSG Inbound Rules for Dynamic IPs Using DDNS and PowerShell Runbooks

Maintain Azure NSG inbound security rules with a changing source public IP using a PowerShell Runbook and Dynamic DNS in Azure Automation.

Oct 16, 20258 min read82

Ciaran Doherty's SecOps Blog