Cookie Monster Has Entered the Teams Chat with Miriam Wiesner

About this episode

Andrew interviews Miriam Wiesner about PowerShell security and cookie-based attacks at PSConfEU 2026.

Recorded live at PSConfEU 2026, Andrew sits down with returning guest Miriam Wiesner, Senior Security Researcher at Microsoft, for a wide-ranging conversation on PowerShell security, cookie-based attacks, and the evolving threat landscape. Miriam walks through her two conference talks — one on Microsoft Teams session cookie hijacking (a follow-up to her 2025 Entra ID cookie talk, complete with Cookie Monster branding and actual handcuffs), and a joint session with Stéphane van Gulick on using Microsoft Defender's Live Response feature for incident investigation. The conversation also covers the current state of PowerShell security, why sophisticated attackers are moving away from PowerShell, and why defenders who haven't enabled script block logging and AMSI are leaving easy wins on the table. On top of the technical deep dive, Miriam and Andrew get into the human side of the conference community — nerves before presenting, imposter syndrome, and why showing up is already half the battle.Key Takeaways: Cookie-based identity attacks are an active and growing threat. Microsoft Teams, SharePoint, and OneDrive share session cookies, meaning a single cookie theft can give an attacker…

People in this episode

Host: Andrew

Guest: Miriam Wiesner

Topics covered

• PowerShell security
• cookie-based attacks
• Microsoft Teams
• incident investigation
• threat landscape
• conference community

Keywords

• PowerShell
• security
• cookie hijacking
• incident response
• script block logging
• AMSI
• threat actors
• conference

Mentioned in this episode

Organizations: Microsoft, Microsoft Defender

Products: Microsoft Teams, SharePoint, OneDrive

More episodes of The PowerShell Podcast

• Betting on Yourself with Frank Lesniak · June 1, 2026 · 1h 7m
• Solving Problems at the Root with Mark Littlefield · May 25, 2026 · 51 min
• PowerShell After Dark: OnRamp, IoT, and Finding Your People. · May 18, 2026 · 1h 5m
• Splatting, Automation, and Chasing the Sun with Jess Pomfret · May 11, 2026 · 43 min
• From ISE Anxiety to VS Code Every Day with Paula Kingsley · May 4, 2026 · 1h 13m
• PowerShell & DevOps Global Summit Bar session with Josh & Jeff · April 29, 2026 · 51 min