Dad ⚭ Husband 🏛️ Incident Response, M365 Forensics | Defender XDR & Azure Security | DEaTH 🏋🏻♂️IronCult 🏕️ForestHermit
All up in your logs
Joined April 2026
- Tweets122
- Following251
- Followers31
- Likes835
Dylan🛡️AttacktheSOC retweeted
So many possible phishing pretexts around the Microsoft outage and Defender xdr issues 👀
Dylan🛡️AttacktheSOC retweeted
This is good info about Microsoft Defender internals.
protokol-7.github.io/dfir/20…
Dylan🛡️AttacktheSOC retweeted
Basically InstallerFileTakeOver but superior
github.com/MSNightmare/SignD…
Dylan🛡️AttacktheSOC retweeted
A developer who writes a fork of ARTEX messaged me today to call me very naughty name for releasing spikestrip
He didn’t have the dev chops to fix ARTEX to think hard enough to not honor the traps.
github.com/Arcanum-Sec/Spike…
Dylan🛡️AttacktheSOC retweeted
For those still interested in the fridges, @sekoia_io captured an attack on four different honeypots this Sunday evening at 10 PM, potentially linked to the latest wave. It didn't use to "code of the day" but another unauthenticated vuln. 178.83.226[.]215 / 37.16.75[.]128
Dylan🛡️AttacktheSOC retweeted
Since the folks at ThreatBook developed both Artex and CyberStrikeAI, we figured we should contribute a bit to defending against and tracking AI agent attacks by sharing two feeds of instances running these agents on the public internet.
Grab them if needed. Feeds:
threatbook.io/hubfs/Feeds/AR…
threatbook.io/hubfs/Feeds/CS…
Dylan🛡️AttacktheSOC retweeted
Google is now threatening America's schools, saying they will turn off their core search functions if schools choose to entirely block AI.
nytimes.com/2026/11/03/us/go…
Dylan🛡️AttacktheSOC retweeted
Everyone was afraid of being left behind or being the security team holding up AI implementation, so they threw out a lot of their normal policies and controls. Even many coding agents lacked enterprise controls until midyear. Now they’re sorting it all out.
xitter.cf/bradmenezes/status/211…
“Desktops are dirty,” a CISO told me.
Everyone rolled out Claude on the desktop, now every CISOs I speak with wants development and AI agent execution off employee laptops as a p0 priority.
The recent LiteLLM compromise and today’s reports of a malicious Claude Code extension in Cursor’s marketplace show why: trusted desktop tools can become paths to credentials and corporate systems.
My prediction for 2027: a major shift toward isolated, ephemeral compute sandboxes with tightly scoped credentials and controlled network access for all development across engineers and non-engineers suing coding agents.
Builders keep their preferred tools. IT and Security control where the code runs and what it can access with a kill switch.
Been trying to learn circuits and honestly get an elementary grasp on electricity, radio waves and frequencies yada yada.
Built this one with some help from the kids too. Just look at that beautiful Lego enclosure. It’s cool to have something we’re both learning in real time.
2
40
Recently got my N39 kit /w GPS. I fear I’ve become addicted to “collecting” as many nodes in my area as possible. Upgrading the antenna and looking for a base station with coax I’ll feed down to the upstairs office.
Been on Meshtastic but looking to try out Meshcore as well
2
60
Dylan🛡️AttacktheSOC retweeted
Last month, Trump’s DHS asked its cyber division to try and a hack voting machines.
BUT:
-They directed them to NOT alert voting machine companies if flaws were discovered. Violating policy.
-Order to only report directly to White House.
That’s NOT typical at all!!
ProPublica: Trump Appointees Wanted a Voting Machine Hacked
A few months into President Donald Trump’s second term, political appointees at the Department of Homeland Security made an unusual request of its agency focused on cybersecurity: Secretly acquire a voting machine and hack it.
The appointees wanted the Cybersecurity and Infrastructure Security Agency to procure the machine, examine it and report back the findings so they could be given to the White House, according to two former administration officials with knowledge of the request.
propublica.org/article/cisa-…
Dylan🛡️AttacktheSOC retweeted
🤔 Why should the AI Administrator role in #MicrosoftEntra be considered Control Plane (Tier 0)? At first glance, it might seem particularly privileged just to manage #AgentIdentities. But there's an aspect that often gets overlooked. (1/7) 👇
Dylan🛡️AttacktheSOC retweeted
12/ We spent months compiling every case we could find of immigration agents detaining Americans.
We did it because the government hasn't.
And now, we're sharing every one of those cases with you.
Explore our database: propub.li/4y9hxJh
ALT Screenshot of database titled "Explore All Incidents Where Citizens Were Detained." Text below explains that this is every incident ProPublica could find in which one or more citizens were reportedly detained between January 2025 and September 2026. There are 506 citizens' cases in the database, and users can sort by what the incidents involve, where the incident is located, and the recency of the case.
One of those lessons you learn with time in the field is that things will break and continue to work, quietly feeding you false-negatives and a sense that all’s good. Never trust, always verify.
26
Dylan🛡️AttacktheSOC retweeted
I had the domain for quite some time and the website was already up - but finally it's where I wanted it to be.
◽️Full XDR and Sentinel schema coverage
◽️Documentation of XDRInternal modules by @NathanMcNulty and me
◽️Table column relations (partly)
xdrinternals.com/
Dylan🛡️AttacktheSOC retweeted
What a surprise to log in and see a wanted poster for a HAFNIUM operator!!
Our (@volexity's) blog post exposing their Exchange operations:
volexity.com/blog/2021/03/02…
🚨 BREAKING: The US is offering up to $10 million for Zhang Yu, a Chinese national accused of being a key figure in HAFNIUM, the Microsoft Exchange hacking campaign the FBI says was directed by China's MSS and compromised 12,700+ US victims.
He is also accused of stealing COVID-19 research from US universities.
