Research, product deep-dives, and investigations. Written by the people running the SOC, for the people running the SOC.
What we're researching, what we're shipping, what's happening at the company, and events we're hosting or attending. No spam.
By subscribing, you agree to receive marketing emails from Command Zero. Unsubscribe any time. See our Privacy Notice.
Attackers used ConnectWise's own app credentials to sign in to Microsoft 365 tenants. Here's how to hunt for the sign-ins, the self-assigned roles, and the client secrets they left behind.
Live in under an hour. No migration. No friction.
