Kyle - chaoticflaws.bsky.social 🇺🇦

I'm a forensicating addict, President of MISEC Nonprofit, MiseCon/Converge/BSides Detroit Organizer, CSO Antigen Security #MISEC #DFIR

[Dave McCollough @davemccollough]

Solid Microsoft reference architecture for Foundry chat.

Friendly reminder: the model is only one part of production AI.. the real work is identity, networking, egress, grounding, state, monitoring, and governance. https://t.co/tgBGDvwp2L

[Mr.Un1k0d3r @MrUn1k0d3r]

I decided to publish my internal Azure Entra ID tool. There are a lot of these already available, but I've added some interesting features that have made a difference for me over the years. You can capture token through the browser using playwright

https://t.co/xiZaz0PKsC
#Azure

[Renzon @r3nzsec]

IRFlow Timeline v1.0.7 is live.

This one focuses on a problem I think DFIR teams will see more often: AI assistant usage becoming part of the investigation surface.

You can now collect and normalize local AI usage history from tools like Claude Code, ChatGPT Desktop, Cursor, GitHub Copilot, OpenAI Codex, Gemini CLI, Continue, Windsurf, and Claude Desktop into a unified timeline view.

Also added AI Secret Hunt, which helps identify secrets, tokens, API keys, private keys, and credentials that may have been pasted into AI assistants during real investigations or day-to-day engineering work.

The goal is simple: make AI app activity easier to preserve, search, tag, and correlate during incident response. AI usage is becoming part of the forensic record. We need tooling that treats it that way.

Link in the comment ⬇️

#DFIR #IncidentResponse

[Dino A. Dai Zovi @dinodaizovi]

This is really good, @AnthropicAI posted a document on how to apply the principles behind Zero Trust to AI Agents:

https://t.co/bli719l9M4

[Dave McCollough @davemccollough]

Great reference for Microsoft Entra roles.

Useful for understanding built-in permissions, spotting privileged roles, and supporting least privilege reviews.

https://t.co/28xSenJl2Y

[Phill Moore @phillmoore]

Week 22 - 2026 #DFIR
https://t.co/UJ8yz1wgKK

[DirectoryRanger @DirectoryRanger]

The Lowdown on Lateral Movement
https://t.co/3ly1nvUfhN

[DirectoryRanger @DirectoryRanger]

Active Directory Hardening Series
Part 1 Disabling NTLMv1 https://t.co/9gla1vtQ18
Part 2 Removing SMBv1 https://t.co/KOqpamarcW
Part 3 Enforcing LDAP Signing https://t.co/oW2Ymvu1ZW
Part 4 Enforcing AES for Kerberos https://t.co/iENjEPBOFD

[Ru Campbell @rucam365]

New video: quick tour of Purview’s Microsoft 365 Copilot visibility.

• Prompts and responses
• Where the logs live
• Permissions
• Which tools fit which scenarios

Whistle-stop overview for now, deeper dives later if there’s interest (lmk?)

WATCH: https://t.co/drt21XBxSY

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft has identified an active supply chain attack using typosquatted npm packages to steal cloud and CI/CD secrets. On May 28, 2026, a single threat actor operating under newly created maintainer alias vpmdhaj published 14 malicious packages within a 4-hour window. https://t.co/jC3f2m6EBp

The packages typosquat well-known OpenSearch, ElasticSearch, DevOps, and environment-configuration libraries, and several spoof the upstream OpenSearch project’s repository URL in their package.json to appear legitimate.

Once installed, the packages harvest AWS credentials, HashiCorp Vault tokens, and CI/CD pipeline secrets from the host environment. Read the blog from the Microsoft Defender Research team to an in-depth analysis, as well as mitigation, detection, and hunting guidance.

[Nathan McNulty @NathanMcNulty]

Why risk AI-slop detections that may not even work when you could just block it instead? ;)

https://t.co/qkAmFcOaWp

[DirectoryRanger @DirectoryRanger]

Automating MS-RPC vulnerability research
https://t.co/RhUpZyxEl5

[Vivek | Cybersecurity @VivekIntel]

CVE MCP Server — Turn Claude Into a Full Security Analyst 💀🔥

27 security tools • 21 threat intelligence sources • One MCP protocol 🔥

Analyze CVEs, check KEV status, calculate exploit risk, investigate malicious IPs, scan dependencies, search PoCs, map MITRE ATT&CK techniques, query VirusTotal, Shodan, GreyNoise & more — directly inside Claude.

⚡ Automated vulnerability triage
⚡ Composite risk scoring
⚡ Threat intelligence correlation
⚡ AI-powered security workflows
⚡ MCP-ready security automation

Perfect for SOC analysts, threat hunters, vulnerability management teams & security researchers.

🔗 https://t.co/1upveIkkJV

#CyberSecurity #ThreatIntel #CVE #ThreatHunting #SOC #BlueTeam #MCP #ClaudeAI

[Ayush Anand @Securityinbits]

One host touching 50+ internal IPs across 5+ ports in under 5 minutes is not “normal admin activity.”

That is how ransomware operators map your network before encryption. 👀

The best part?
This detection still works when the tool is renamed, packed, or stripped of metadata. Fully tool-agnostic.

I shared both the KQL and ESQL versions in the article. More discovery-phase detections soon.

[Kostas @Kostastsale]

𝗦𝗺𝗮𝗹𝗹 𝗘𝗗𝗥 𝗧𝗲𝗹𝗲𝗺𝗲𝘁𝗿𝘆 𝗨𝗽𝗱𝗮𝘁𝗲:

We have not posted much about the project lately, but the matrix has not been sitting still.

𝗢𝘃𝗲𝗿 𝗔𝗽𝗿𝗶𝗹 𝗮𝗻𝗱 𝗠𝗮𝘆:

✅ 5 PRs merged
🧩 4 vendors added or updated
💻 Windows, macOS, and Linux coverage touched
🤝 24 community submissions reviewed, merged, or consolidated

𝗧𝗵𝗲 𝗺𝗮𝗶𝗻 𝘂𝗽𝗱𝗮𝘁𝗲𝘀:

- 𝗖-𝗣𝗿𝗼𝘁 was added across Windows and macOS and took the place in the EDR Telemetry scoreboard.
- 𝗨𝗽𝘁𝘆𝗰𝘀 macOS coverage landed across 55 subcategories.
- 𝗘𝗹𝗮𝘀𝘁𝗶𝗰 𝗗𝗲𝗳𝗲𝗻𝗱 macOS got 6 corrections backed by evidence.
- 𝗖𝗼𝗿𝘁𝗲𝘅 𝗫𝗗𝗥 Linux now has an initial profile.

Most of the work is exactly what this project needs: adding coverage, checking evidence, fixing incorrect statuses, and keeping notes clear when explicit telemetry needs to be enabled or needs further confirmation.

We have been quiet publicly, but the data has kept improving.

Check out the updates on our website https://t.co/sVXZplFuKq

[Florian Roth ⚡️ @cyb3rops]

I spent the last weeks building LLM benchmarks for a very specific reason:

We want to use AI in RuneAI to help with THOR finding triage, and I needed a better baseline for model selection than generic LLM leaderboards.

Security-event triage is its own thing.

A model can be great at coding, reasoning or vulnerability writeups and still be a bad fit for deciding whether a messy endpoint finding should be suppressed, reviewed or escalated.

In real deployments this will likely happen inside agentic workflows with tools, memory, context handling and feedback loops. But before testing the whole system, I wanted a clean baseline:

How does the model behave when it only gets the enriched finding itself?

Blog post with the reasoning and methodology:
https://t.co/KQPOPDWP1B

Interactive benchmark results:
https://t.co/pvVhTBJsz0

Repo:
https://t.co/Fw3uW9nu2a

Maybe useful for others building SOC / security-event triage benchmarks.

[Unit 42 @Unit42_Intel]

Offensive and defensive framework ROADtools is being misused by nation-state actors for cloud attacks. Understand how to identify the activity that signals its malicious usage, including proactive hunting for anomalous activity: https://t.co/bq50zF1tFV

[Vivek | Cybersecurity @VivekIntel]

🐝 Bumblebee — A Read-Only Supply Chain Exposure Scanner for Developer Machines

SBOMs show what shipped.
EDRs show what executed.

Bumblebee answers the missing question:
👉 Which developer endpoints currently contain the vulnerable package, extension, lockfile or MCP config?

Built by Perplexity AI:
• Single static Go binary
• Zero external dependencies
• No telemetry
• No package-manager execution
• No source-code parsing

Scans:
npm, pnpm, Yarn, Bun, PyPI, Go, Ruby, Composer, VSCode/Cursor extensions, browser extensions & MCP configs.

Perfect for fast DFIR-style exposure checks during supply-chain incidents.

https://t.co/O1mlJVoqKo

#CyberSecurity #DFIR #SupplyChainSecurity #DevSecOps

[Grzegorz Tworek @0gtweet]

I’ve always claimed that ETW is very fast. I’ve been writing and teaching about it for years (for example, my talk “The Good, the Bad and the ETW” at x33fcon 2020 https://t.co/mRjLi3Jr2D), but I never actually measured its speed - until today. I needed an exact figure, so I wrote a small C app that logs 1 million events and measures the elapsed time. Here’s the code along with the complete test procedure. Enjoy! 🚀
https://t.co/Ow75wzaIHz

[Dhanush N @Dhanush_Nehru]

Cursor is FREE
Windsurf is FREE
Trae is FREE
Claude is FREE
ChatGPT is FREE
Gemini is FREE
Perplexity is FREE
Bolt is FREE
v0 by Vercel is FREE
GitHub Copilot is FREE
Supabase is FREE
Cloudflare is FREE
Docker is FREE
Hugging Face is FREE
Railway is FREE
https://t.co/05hozFFhlv

Who is stopping you from building and learning?