HIGH-PROFILE CLOUD PRIVESC

Summary from the TLDR InfoSec newsletter

This post details an attack path from an Entra service principal with `Files.ReadWrite.All` permissions to admin. The attacker exploited OneDrive for Business's Known File Move feature to load a PowerShell profile with a beacon from OneDrive into admins' filesystems. It concludes with defender tips on detection and credential protection.