SANS Stormcast Thursday, August 27th, 2026: Entra ID Admins; Unifi Patches; log4j Vuln; Sleepwalker Malware
Summary
Rob shares a PowerShell script to audit Azure AD admin roles, helping identify excessive privileges. The episode covers Ubiquiti’s security bulletin addressing 22 vulnerabilities, including high-severity issues, and advises limiting control plane access. A new Log4j deserialization flaw is discussed, deemed low risk as it requires direct object acceptance. Finally, Dominic analyzes "Sleepwalker" malware, which uses passive packet listening for command and control.
Topics discussed
Introduction and sponsor announcement
PowerShell script for auditing Entra ID admin roles
Ubiquiti security bulletin and patching advice
New Log4j deserialization vulnerability analysis
Sleepwalker malware with passive C2 mechanism
Listen ad-free on Castria