Katie Knowles

@_sigil

Senior Security Researcher @ Datadog. 🐕 Head in the (Azure) clouds. Sometimes blogging, always curious. Aim to be, rather than to seem.

Toronto, Ontario

Joined September 2010

292Following

2KFollowers

Pinned

Katie Knowles@_sigil · Jul 16

🕵️‍♀️ Looking to escalate privileges with a first-party Microsoft app? How do federated domain backdoors work? And what's an app reg, really? All this and more in our new @datadoghq Security Labs post: securitylabs.datadoghq.com/articles/i-spy…

4.0K

Katie Knowles@_sigil · Jul 9

We're looking for a curious AI security researcher to join us! 👀

NNick Frichette@Frichette_n · Jul 9

Join my team! We’re looking for a Senior Security Researcher specializing in Generative AI. You’ll have the opportunity to be a part of one of the leading security research organizations in the industry and shape Datadog’s security products! A 🧵 careers.datadoghq.com/detail/7031220…

602

Katie Knowles@_sigil · Jul 3

This is a great point! Ensuring your cloud admins aren't synced users will prevent the federated domain takeover scenario, as only synced users are vulnerable.

DDr. Nestori Syynimaa@DrAzureAD · Jul 3

Nice talk Katie! The easiest way to prevent the attack you demonstrated is to avoid giving admin permissions to synced users (=no ImmutableID)

407

Katie Knowles@_sigil · Jul 3

☁️ My fwd:cloudsec talk, "I SPy: Rethinking Entra ID research for new paths to Global Admin", is up! Learn what a service principal is, how Microsoft's first-party apps could be backdoored, and one weird trick they haven't fixed yet: youtube.com/watch?v=oNpwtt…

9.0K

Katie Knowles@_sigil · Jul 2

Thank you for a great week, @fwdcloudsec!! So many fantastic conversations and sessions. See you next year!

501

Katie Knowles Retweeted

Karl@kfosaaen · Jul 1

I have a new post out on the @NetSPI blog today. This one is on extracting sensitive information from the Azure Load Testing service. netspi.com/blog/technical…

5.0K

Katie Knowles Retweeted

ChrisPy@chrispy_sec · Jul 1

My talk was published mega quickly as its own video by @fwdcloudsec (thanks btw!) So feel free to check it out if you wanna learn some fun SharePoint research outcomes and learn about a “pre-signed url” equivalent method of accessing SharePoint files! youtu.be/l5lpIF_QZCE

3.0K

Katie Knowles@_sigil · Jul 1

Thanks for joining!

NNick Frichette@Frichette_n · Jul 1

It’s a packed house over at @_sigil talk on Azure Service Principals, a history on backdooring them, and more!

856

Katie Knowles@_sigil · Jun 28

When the hotel has a free drink for your panic rehearsals. Looking forward to @fwdcloudsec! 🥂

2.0K

Katie Knowles Retweeted

Dirk-jan@_dirkjan · Jun 27

Since several people already asked: the slides from @fabian_bader and myself for @WEareTROOPERS are available! "Finding Entra ID CA bypasses-the structured way". We talked about FOCI, BroCI, CA bypasses, scopes and getting tons of tokens. Check it at dirkjanm.io/talks/

230

133

20.0K

Katie Knowles Retweeted

Fabian Bader@fabian_bader · Jun 26

One of the results of the joined research with @_dirkjan is entrascopes.com Basically the yellow pages for Microsoft first party apps. #TROOPERS25

198

109

32.0K

Katie Knowles Retweeted

Eric Woodruff | MVP | CIDPRO@ericonidentity · Jun 25

At @WEareTROOPERS I dropped new research on #nOAuth, an abuse of #EntraID that allows you to spoof users in vulnerable SaaS applications. The attack is still alive and well. You can read all about it here: #Entra #M365 #infosec semperis.com/blog/noauth-ab…

9.0K

Katie Knowles@_sigil · Jun 25

This overview of OAuth in Entra is fantastic! Highly recommended:

EElastic Security Labs@elasticseclabs · Jun 25

Deep dive into Azure OAuth phishing & detection! This article from @_xDeJesus shows how rich telemetry is crucial for spotting identity-based attacks. Stop relying on static indicators & start: go.es.io/4k4A7LD #CloudSecurity #ThreatDetection #Azure

1.0K

Katie Knowles@_sigil · Jun 24

My RSAC virtual session is up! Catch "Persisting Unseen: Attacker Methods of Infesting Entra ID" here: youtu.be/ngSFP-tgupM?si… Companion blog: kknowl.es/posts/defendin…

2.0K

Katie Knowles@_sigil · Jun 17

🕵️‍♀️ I'll be presenting "I SPy: Rethinking Entra ID research for new paths to Global Admin” at fwd:cloudsec June 30-July 1, alongside some fantastic other speakers: fwdcloudsec.org/conference/nor… If you can’t make it, talks are streamed at: youtube.com/@fwdcloudsec

10.0K

Katie Knowles@_sigil · Jun 5

🥷 Detect & defend vs Entra ID persistence! From my RSAC Cloud Summit talk, I've shared how attackers persist through Entra ID roles, applications, and authentication... and how you can stop them: kknowl.es/posts/defendin…

_sigil's tweet image. 🥷 Detect &amp; defend vs Entra ID persistence! From my RSAC Cloud Summit talk, I've shared how attackers persist through Entra ID roles, applications, and authentication... and how you can stop them: kknowl.es/posts/defendin…

615

Katie Knowles Retweeted

Karim El-Melhaoui@karimscloud · May 27

Reminder that the fwd:cloudsec Europe 2025 Call for Papers is open! First time speakers who requested feedback by May 30th and meet the submission criteria will receive feedback on how to improve during the second round. For more: fwdcloudsec.org/conference/eur…

1.0K

Katie Knowles Retweeted

SpecterOps@SpecterOps · May 21

Take a journey in Administrative Unit Attack Paths! Check out @_sigil's #SOCON2025 talk, which starts w/ scoped role assignments for privilege escalation against users & groups and finishes w/ protecting accounts using Restricted Management AUs. 👀: ghst.ly/4ksxiEx

2.0K

Katie Knowles@_sigil · May 9

🌐 I'll be speaking at RSA Conference's Virtual Seminar on Cloud Security on June 5, 2025! I'll be sharing a technical overview of Entra persistence techniques for all levels. Sign up to stop by here: rsaconference.com/library/virtua…

425

Katie Knowles Retweeted

Adam Chester 🏴‍☠️@_xpn_ · May 7

My talk from #socon2025 is up, get your “urm” counter ready! youtu.be/RiOtfPM7i3U?si…

15.0K