[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fw5eCE_NBNvHSlMqjgBTLBPtUmtA3ZJFRH-sHNmfMzpY":3},{"article":4,"iocs":41,"watch_terms":46,"solutions":47,"lesson":102},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"0955eb6f-4be7-45a4-957c-a29dd683cc4b","Breach at the Beach: Play the Ultimate Entra ID CTF","breach-at-the-beach-play-the-ultimate-entra-id-ctf-9d050c","Learn how attackers abuse Entra ID through a free hands-on Capture the Flag. Varonis created the Breach at the Beach CTF to teach defenders how to investigate Entra ID attack techniques using realistic scenarios. [...]","Varonis Threat Labs has released a free online Capture the Flag (CTF) called 'Breach at the Beach' to educate cybersecurity professionals on identifying and investigating attacks targeting Microsoft Entra ID. The CTF uses realistic scenarios inspired by real-world cases, focusing on how threat actors abuse legitimate Entra ID features and non-human identities for data exfiltration, particularly in the context of evolving AI capabilities.","Varonis launches free 'Breach at the Beach' CTF to train defenders on Entra ID attack techniques.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fbreach-at-the-beach-play-the-ultimate-entra-id-ctf\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fposts\u002F2026\u002F07\u002F09\u002Fbreach-at-the-beach.jpg","2026-07-13T14:01:11+00:00","2026-07-13T16:00:04.83836+00:00",7,[17,20,23],{"name":18,"type":19},"Varonis","vendor",{"name":21,"type":22},"Entra ID","technology",{"name":24,"type":22},"AI","02371804-cf6d-4449-98de-f1a2d4d9b266",{"id":25,"icon":27,"name":28,"slug":29},null,"Tools","tools",[31,36],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":37},{"id":38,"icon":27,"name":39,"slug":40},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[42],{"type":43,"value":44,"context":45},"url","https:\u002F\u002Fbreachatthebeach.com","URL for the Breach at the Beach CTF",[18],{"controls":48,"vendors":101},[49,78],{"slug":50,"name":51,"problem":52,"products":53},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[54,62,70],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":79,"name":80,"problem":81,"products":82},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[83,88,93],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":84,"product_name":85,"url":86,"description":87},"entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":89,"product_name":90,"url":91,"description":92},"workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",[],{"slug":103,"title":104,"body":105,"framework_refs":106,"framework_notes":118},"entra-id-abuse-legitimate-features-used-for-data-exfiltration","Entra ID Abuse: Legitimate Features Used for Data Exfiltration","Threat actors increasingly exploit legitimate Microsoft Entra ID features — such as service principals, managed identities, and OAuth applications — to blend malicious activity with normal operations, making detection difficult. Non-human identities (NHIs) like app registrations and service accounts are often over-privileged and poorly monitored, creating stealthy pathways for data exfiltration. The rise of AI-assisted attacks amplifies these risks by enabling faster reconnaissance and abuse of cloud identity configurations. This CTF highlights that many security teams lack the hands-on familiarity needed to detect and investigate Entra ID-specific attack patterns before real incidents occur.",[107,108,109,110,111,112,113,114,115,116,117],"CIS Control 5: Account Management","CIS Control 6: Access Control Management","CIS Control 8: Audit Log Management","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 AU-12: Audit Record Generation","NIST SP 800-53 IA-5: Authenticator Management","MITRE ATT&CK T1098: Account Manipulation","MITRE ATT&CK T1550.001: Use Alternate Authentication Material - Application Access Token","Microsoft Security Benchmark: Identity Management (IM-1 through IM-8)","GDPR Article 32: Security of Processing (data exfiltration risk)",{}]