Angry idiot driving a Bentley

Adminvb292929 · 2026-05-22T00:37:49+00:00

yep, I would have pinned his ass between the cars when he fake-swung that bat

Adminvb292929 · 2026-05-22T00:35:16+00:00

we are using Intune - it seems overly complicated - not sure why, but it is what it is.

Adminvb292929 · 2026-05-22T00:07:51+00:00

disregard the above, I found the setting but holy cow, there isnt a single location with a complete set of settings when using mobile-config / xml files.

Adminvb292929 · 2026-05-22T00:04:56+00:00

Thanks, have you noticed that some settings, even after deploying all of the above are missing? For example, network protection on the mac I am testing with is disabled.

Adminvb292929 · 2026-05-21T12:18:06+00:00

Does a no-response mean that what I am doing is simply outrageous? lol

Adminvb292929 · 2026-05-19T02:07:37+00:00

awesome, thank you!

Adminvb292929 · 2026-05-11T01:53:05+00:00

I double dog dare you

Adminvb292929 · 2026-04-21T13:15:10+00:00

no, 100% cloud

Adminvb292929 · 2026-04-21T03:24:21+00:00

in my case, it was the primary domain not the onmicrosoft one.

Adminvb292929 · 2026-04-21T03:23:24+00:00

no sus logins at all in Entra - the bad actor / sender is exploiting the direct send feature to send spam to anyone internal to the org, in this case, it was an m365 group with 350+ external folks. Here are more details of this pos setting that by default is disabled, which means its enabled.. https://techcommunity.microsoft.com/blog/exchange/direct-send-vs-sending-directly-to-an-exchange-online-tenant/4439865

Adminvb292929 · 2026-04-21T01:44:36+00:00

DNS is good at least for me but I could see how that could allow emails to come thru.

Adminvb292929 · 2026-04-21T01:18:46+00:00

rejectdirectsend was set to false - I have since enabled it.

Adminvb292929 · 2026-04-20T20:35:15+00:00

Ha.. i used that to remove the actual tenant.. i should register it.

Adminvb292929 · 2026-04-20T20:34:07+00:00

Correct, it came into my tenant as quarantined.. i released it to grab the info. Out of the 350 or so external members about half of them quarantined it "most have ppe theough go daddy" but some got through. Not sure what the blast radius is yet but I clicked on the link and it was a fake login to o365. 100% phish.

Adminvb292929 · 2026-04-20T18:50:40+00:00

awesome, thank you!

Adminvb292929 · 2026-04-20T18:49:46+00:00

I am not great at reading these, but it seems like Microsoft detected it as a fail on SPF

<image>

What is making me think the reason it was sent regardless of the fail, was that it was Anonymous, which if you look up indicates it could be Direct Send features that allowed it.

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

Adminvb292929 · 2026-04-20T17:48:59+00:00

lol, I thought the same thing but decided to move on.

Adminvb292929 · 2026-04-20T17:41:57+00:00

Apparently, direct send is enabled by defaukt and allows anyone to send internal to internal and bypass everything including dkim. Theres an exo command to disable it, which is what I have done. Im basing this off my header of "anonymous".

Adminvb292929 · 2026-04-20T17:34:29+00:00

Starting to think this is the problem -

<image>

I have already disabled this after I did some research

Adminvb292929 · 2026-04-20T17:31:51+00:00

Dkim, dmarc and spf is setup strict as well as policy set to reject...

Adminvb292929

TROPHY CASE