Raphael Waller

Graduate Electronics/Computer Engineering student, full time senior sysadmin. Looking for more hours in the day and more things to automate.

[Raphael Waller @rwllr]

@IAMERICAbooted It's really a question of which will make you happier in life or takes you in that direction.

[Raphael Waller @rwllr]

@SwiftOnSecurity **So when the machines take over it can mock me for how often I forget something behind and go back for it**

[Raphael Waller @rwllr]

@NathanMcNulty @5mukx Iirc minimum license count is something like 250

[Raphael Waller @rwllr]

ClickFix is definitely the largest I see by quite a long way. EDR can usually see from the actions taken and what was pasted into cmd that this was the source.

[Mike Manrod @CroodSolutions]

What are you seeing as the most popular initial access delivery mechanisms for RMM?

Outright social engineering is one answer but kind of inefficient at scale.

ClickFix delivery of RMM is super simple, but I think we lose a lot of telemetry because a lot of ClickFix attacks are missed until later stages when EDR or ZTNA detects some other activity, maybe in the discovery or ingress tool transfer stage. As a result I don’t see much hard data on this pathway (rare vs frequent?).

We have done a few demos of maldoc delivery of RMM install (w/ @Shammahwoods at @BSides_ABQ last year), but the maldoc stuff gets fixed quickly.

We all seem to agree that RMM abuse is happening extremely frequently, but I see a little less data on exactly what delivery methods of RMM are most frequent. Maybe I just haven’t read the right reports.

@M_haggis @UK_Daniel_Card @ZackKorman @christian_tail

[Raphael Waller @rwllr]

@Tech2Wild @MiranHearth But from a where we are now for someone with nothing a Spark and M5 Ulatra w/ 512GB is pretty much the same price and it's not even close which to get to run models?

[Raphael Waller @rwllr]

@NathanMcNulty @ItsReallyNick I see a lot consultancy for building saas apps and process automation but the gap I've been helping customers with is efficient prompting and skill building.

[Raphael Waller @rwllr]

@saenz @IAMERICAbooted This goes all the way up to Microsoft. It took a couple of community volunteers to build https://t.co/uA4mJn4Qc9 because Microsoft are just uninterested in making usable tooling for service providers

[Raphael Waller @rwllr]

@NathanMcNulty @acjuelich @KiPos_info For a new starter processed by LCW when do they stop consuming a license

[Raphael Waller @rwllr]

@IAMERICAbooted It definitely is, but viewed as case studies with practical learnings and pragmatic steps to defend against.
The trouble is details from incidents are rarely published and talked about.

[Raphael Waller @rwllr]

@IAMERICAbooted Echoing it's not just the large tenant audits. Plenty of examples on Reddit of SMB's for P1 license abuse

[Raphael Waller @rwllr]

@IAMERICAbooted My grandmother was telling me she still has the boiler that was there in the house when they moved in the 80's

[Raphael Waller @rwllr]

LAPS is great, but make sure those other local admins are audited and removed too!

[Nathan McNulty @NathanMcNulty]

LAPS continues to be one of the best controls available to prevent lateral movement

The best part? It's free :)

The admin experience is nicer in Entra than it is in Active Directory, and if you need something more, Lithnet Access Manager is awesome: https://t.co/pnHLNEHJ7C

[Paul O'Brien @PaulOBrien]

OVERCLOCKED - Sortation Arena turns a boring enterprise backlog into a live arcade where AI agents race to clear a warehouse sortation line - same model, different silicon. Every parcel isn't a single prompt but a real multi-agent graph: a Router classifies the exception and dispatches it to one of 18 specialist worker agents, an image-aware Verifier independently double-checks the work and bounces it back for a retry when it's wrong, and an Exceptions Specialist makes the final call on adversarial or low-confidence items - all coordinated by an orchestrator that emits a full decision trace.

That's the heart of Track 1 (Multiverse Agents): genuine orchestration over genuinely multimodal work - vision (label photos, hazmat placards, damage), document (customs invoices, manifests), text (tariff, routing, SLA), and video (a conveyor-cam clip the model reads frame-by-frame). And because an agentic loop is latency-bound by design - several sequential model calls per parcel - wafer-scale inference compounds its lead: Cerebras runs Gemma 4 31B at ~1,000 tokens/sec while the identical model on a GPU crawls near 100, its conveyor visibly jamming. The race itself is the benchmark.

This is real work, not a toy: 18 task types across 111 hand-authored scenarios, every output schema-constrained and machine-graded against locked ground truth, with an ROI payoff card that tallies parcels cleared, accuracy, and pounds saved vs. manual handling - Track 3 (Enterprise Impact) made tangible.

It's engineered like production software, too: API keys live only in a Cloudflare Worker (never the browser), every task derives from a single Zod schema (one source of truth for the prompt, parser, grader, and UI), and a per-lane circuit breaker trips a failed provider to OFFLINE so a missing key never kills the demo - the other lanes race on. The whole blueprint is documented end-to-end in the Docusaurus docs - https://t.co/3TpXfq2zJz - and the full source is on GitHub

And it's fun - the People's Choice (Track 2) hook: a coin-op cabinet where animal clerks melt down under the backlog, a rubber-stamp THWACK lands on every cleared parcel, and a crown and confetti drop on the winner. "Watch AIs race to clear a warehouse backlog while their clerks drown in paper - same model, different silicon" is the scroll-stopper, and the side-by-side speed gap is the punchline. Watch the 60-second demo or play the live build right now - https://t.co/OzFWMayCNo - it ships with deterministic mock inference, so the full experience runs in your browser with no keys and no backend (hosted that way to keep it free to run). Same model, different silicon.

Speed is the game. ���

[Raphael Waller @rwllr]

@mrjhnsn Isn't the CA policy evaluated on the laptop signing in? How are you restricting by device type?

[Russell Langer @R_Langer]

"That synagogue has been turned into a mosque so I don't know why someone would petrol bomb it."

The antisemitism crisis in a nutshell

[Raphael Waller @rwllr]

@k1rallik What's the practical difference given Nirsoft Chromepass can export the passwords too?

[Raphael Waller @rwllr]

@awakecoding Can confirm.

I thought for such a long time my team were doing something wrong when they said it doesn't work.

[Raphael Waller @rwllr]

@SwiftOnSecurity My understanding is clicking More forces tweet engagement and monetization so there's an incentive for paid accounts to coerce you into expanding the post.

[Raphael Waller @rwllr]

@IAMERICAbooted Infostealers can also be mitigated with application whitelisting.
For the 99% something like aaronlocker though we use Threatlocker and their SOC

[Raphael Waller @rwllr]

@LahavHarkov The craziest thing is that I'm pretty sure they actually consult for other regions and faiths helping them implement it within their own communities.