Dylan🛡️AttacktheSOC

Dad ⚭ Husband
𒉭 Azure Security | IAM | DE&TH
🏋🏻‍♂️#IronCult | 🏕️Forest Hermit

[Dhruv Mehrotra @dmehro]

NEW: While Meta publicly said it was still deciding whether to deploy facial recognition in its smart glasses, the company was distributing it to millions of users

We found an unreleased facial-recognition system embedded in the Meta's AI companion app

https://t.co/2GB1Fql1iT

[Dylan🛡️AttacktheSOC @DylanInfosec]

@4ndr3w6S

[Dylan🛡️AttacktheSOC @DylanInfosec]

This is awesome sauce. Client-side processing of the logs in the Azure Monitor Agent. From filtering to aggregation before landing in Sentinel. Multi-stage transformations in Data Collection Rules:

https://t.co/FKVRny1ynz

[Dylan🛡️AttacktheSOC @DylanInfosec]

@haroonmeer @ThinkstCanary Y’all never fail to be the most awesome 💚

[Dylan🛡️AttacktheSOC @DylanInfosec]

@SamErde

[Dylan🛡️AttacktheSOC @DylanInfosec]

@IceSolst

[Dylan🛡️AttacktheSOC @DylanInfosec]

Wait... did we always have Azure Resource Graph Explorer query history??

[Son Luong @sluongng]

Codex just found a “workaround” of not having sudo on my pc…

[Dylan🛡️AttacktheSOC @DylanInfosec]

@NathanMcNulty @AdamGell Some Marketing Strategy manager somewhere is asking their team to build out target groups for portal behaviors of stressed out IT admins and SOC analysts from those signals.

"Their cortisol must be spiking. Hit 'em with the wegovy!"

[Dylan🛡️AttacktheSOC @DylanInfosec]

@jamieantisocial @JohnHultquist Me: exploiting that sycophancy in order to spit out a one-time use script for a very specific niche case I'll never need to look at again

[Dylan🛡️AttacktheSOC @DylanInfosec]

On the other hand, I see teams wading through an understandable air of frustration, mistrust, and resentment on a path that leads to conversations above your pay grade

[Dylan🛡️AttacktheSOC @DylanInfosec]

Seems it can’t be stated enough but execs looking to replace their SOC with Agentic workflows.. you’re doing it wrong. It ain’t happening. Perhaps it is “not there yet” but fact remains you’re not replacing humans. It’s increasing and optimizing output. Allowing

[Dylan🛡️AttacktheSOC @DylanInfosec]

us to make more informed decisions and put our attention where it’s needed most.

The leaders that understand this have teams that are killing it right now. Unmatched output. Bespoke solutions. And a better understanding of their environment and the tools they use to navigate it.

[Dylan🛡️AttacktheSOC @DylanInfosec]

A pattern that could leave you in hot water. Also, AI-generated queries shouldn’t even be this bad anymore…. Not only was there no effort in verification but there doesn’t appear to have been effort in their prompt engineering. Womp, womp

[Dylan🛡️AttacktheSOC @DylanInfosec]

All points made by @BertJanCyber and you should be asking yourself if any information provided by the source can be trusted. If an appointed MS MVP (and self-proclaimed KQL expert) isn’t catching this many foundational mistakes before hitting “post”.. it may point to a pattern

[Bert-Jan 🛡️ @BertJanCyber]

For people who just started with #KQL and want to learn why this is AI-slop. Some indicators are explained in the 🧵

[Dylan🛡️AttacktheSOC @DylanInfosec]

@fabian_bader @BertJanCyber Same here… idk if I picked it up somewhere else or if it was a miseducated action that just stuck 🤷‍♂️

[calle @callebtc]

Insane. Age verification is a Trojan horse for total control over everything you do on the internet.

[Dylan🛡️AttacktheSOC @DylanInfosec]

@NathanMcNulty @ericonidentity @wpninjasus It’s all in the TAPs

[Dylan🛡️AttacktheSOC @DylanInfosec]

@UK_Daniel_Card The extra ticket is actually pickpocket insurance

[Merill Fernando @merill]

1/ AI agents in Microsoft Entra can involve more than one identity object.

To understand their security model, you need to know how these objects fit together.

Here’s the mental model 👇