https://imds.foo/tags/dfir/Recent content in Dfir on imds.fooHugoen-usMon, 05 Oct 2026 19:36:38 +0200https://imds.foo/posts/cross-tenant-private-dns-links/Wed, 02 Sep 2026 00:00:00 +0000https://imds.foo/posts/cross-tenant-private-dns-links/<h2 id="three-months-later">three months later</h2> <p>A developer working on Azure gets compromised via AitM phishing. You catch it: the sign-in is anomalous, the session gets revoked, all credentials are rotated, the device is reimaged. You enumerate what their identity can reach, you look for malicious activity and find that the attacker acted similar to you, they also enumerated permissions and looked up the infrastructure the developer was working on. But only that, no write operations. You close the ticket and move on to the next. Infostealer, boring.</p>