Wessel Hissink

Things I say on Twitter are personal opinions and views. Team Blue | DFIR | Bug bounties | Full time Blood Glucose manager

[Wessel Hissink @WesSec_]

@NathanMcNulty ASR is great, I’m only missing logging on excluded executions. Making it harder to reconsider “old” exclusions.

[Wessel Hissink @WesSec_]

@Noctua_at Meanwhile everyone's GPU:

[Wessel Hissink @WesSec_]

@SchizoDuckie I have a Gemini subscription for 6 months but its limits and quality became ass recently, how are the Claude costs/limits for you?

[Nathan McNulty @NathanMcNulty]

Why risk AI-slop detections that may not even work when you could just block it instead? ;)

https://t.co/qkAmFcOaWp

[Wessel Hissink @WesSec_]

@NathanMcNulty Unironically one of the best OS hardening you can do.

[Wessel Hissink @WesSec_]

Thought: npm supply chain being targetted a lot the past weeks. Where are the docker supply chain infections? Or are we not looking (yet)?

[Wessel Hissink @WesSec_]

@BertJanCyber Say it louder for the people in the back!

[Wessel Hissink @WesSec_]

@SecurityAura @BertJanCyber Well, since KQL slop apparently is enough to make someone MVP... it's amazing how bad LLMs are at KQL, it's like they did it on purpose to keep me in my job ;)

[Wessel Hissink @WesSec_]

@Securityinbits Awesome stuff, thanks for sharing, small improvement to the KQL is that i'd also project the DeviceID, this allows for better correlation and automatic remediation.

[Wessel Hissink @WesSec_]

@cyb3rops @nextronsystems Congrats! Excited for what’s up next

[Wessel Hissink @WesSec_]

@NathanMcNulty If i recall correctly these settings can be defined generally, but are editable on user level.

[Wessel Hissink @WesSec_]

@UK_Daniel_Card Just wait until they hear about the export passwords feature in edge!

[Wessel Hissink @WesSec_]

Not many sites reporting on a LPE (CVE-2026-41477) for Deskflow, Deskflow is used in Synergy, Software to share mouse/keyboard across devices.
Patch is available, as is a poc.

Malicious activity is easily detectable, but defender doesn't flag it. KQL: https://t.co/2hyCHWUw0C

[Wessel Hissink @WesSec_]

@UK_Daniel_Card Small shiny button bad
Big functional button good
(I run mostly on or less 90% zoom)

[Wessel Hissink @WesSec_]

AI will find 732 bytes to get you root.
Hackers will find you still use Welkom01 to actually pwn you.

[Wessel Hissink @WesSec_]

@Sandersmit83 En nu op de pont

[Wessel Hissink @WesSec_]

@DarkWebInformer @danielverlaan

[Wessel Hissink @WesSec_]

@maanvis81 @danielverlaan Er zit ook een veld in genaamd "VIP_Customer__c, voor zover ik heb kunnen zien is bij deze release deze waarde altijd False, ik kan me voorstellen dat bij een latere release hier ook een aantal "True" bij gaan zitten. Of dit veld daadwerkelijk gebruikt wordt, is onduidelijk.

[Wessel Hissink @WesSec_]

@jstn_hrn @CheekyTesla @jstern111 @Rustavi @KRoelandschap @TeslaOwnersNL it's slop

[Wessel Hissink @WesSec_]

@DebugPrivilege @UID_ Al die box3 rants laten de ware aard van een boel mensen zien.