ISC2 CC | Building toward Tier 1 SOC and Detection Engineering | Hands-on investigations with Splunk, Wazuh and Sigma | Documenting what I learn
Johannesburg, South Africa
Joined March 2020
- Tweets25.9K
- Following1.5K
- Followers2.7K
- Likes31.2K
William | SOC and Detection Engineering retweeted
Day 26 of our 31 days of cloud and AI security.
Can AI accidentally expose sensitive information? Yes, and nobody has to hack it for that to happen.
Think of an AI assistant like a new intern you handed a master key on day one. Helpful, fast, and happy to open any door you ask. Including the doors you forgot they could open.
That’s how most AI leaks happen. The assistant is wired into SharePoint, Jira, Slack, your CRM. Someone asks the right question, or slips instructions into a form, an email or a document, and the assistant pulls data it was technically allowed to reach and hands it over.
This isn’t theory. This year researchers showed Microsoft Copilot and Salesforce Agentforce leaking customer data through text typed into public forms, and Atlassian Rovo being turned against internal data with one malicious link. All three were patched. The pattern is the lesson.
The fix starts before the prompt. Tighten what the AI can reach, label your sensitive data, and log what it retrieves.
If your AI can read it, assume someone can ask for it.
#AISecurity #DataSecurity #PromptInjection #CybersecurityAwarenessMonth
William | SOC and Detection Engineering retweeted
Update on the TV debloat: my TCL's Netflix button now opens Jellyfin.
Upgraded the launcher to v3, then found the Netflix key sends a vendor keycode (4062) that never reached the key helpers. Disabled Netflix, wrote a 5-line launcher patch, and pressed the button. Jellyfin.
Sent both fixes upstream to CleanYourTV. @gathint merged them this morning, so any TCL owner on the next release gets it too. Thanks Gathin.
Which button on your remote would you remap first?
Pi-hole blocks ads across the 16 devices on my network, but it can't touch the ads baked into a TV's own home screen.
So I ran CleanYourTV by @gathint on the bedroom TV.
It disables the bloat over Wi-Fi, without uninstalling anything, and swaps in a clean launcher.
Before vs after 👇 It's faster as well.
AI won't replace SOC analysts.
It will replace the ones who only close tickets.
Those are not the same job, and the difference is about to matter a lot.
The real job starts where the playbook stops.
Ambiguous alert. Two signals contradicting each other. Someone has to form a hypothesis, pull the telemetry that proves or kills it, and defend the call.
AI can speed up every step of that. It cannot own the judgment at the end.
William | SOC and Detection Engineering retweeted
5 Windows Event IDs worth knowing in SOC
4624 → Successful logon
4625 → Failed logon
4688 → Process creation
4720 → User account created
1102 → Security audit log cleared
Don't just memorize the IDs.
Learn what each event reveals during an investigation.
William | SOC and Detection Engineering retweeted
Oya sope otilo🙆🏾♂️🙆🏾♂️
🚨 BREAKING: Hackers are BYPASSING Microsoft 365 MFA, hijacking corporate accounts, and secretly replacing victims' authentication methods to maintain access.
97 accounts compromised across 79 organizations. In some cases, attackers took over sessions in just 12 MINUTES.
And now, researchers have separately exposed a critical flaw in Microsoft Authenticator that allowed malicious apps to steal login tokens with ZERO permissions.
Microsoft's authentication security is facing two serious threats, and one is already being exploited in the wild.
Here's what's happening:
🔴 1. MICROSOFT 365 ACCOUNTS HIJACKED IN THE WILD
Cybersecurity researchers at Huntress uncovered a widespread token-replay attack campaign targeting Microsoft 365.
The numbers are alarming:
→ 200,000+ failed login attempts observed.
→ 497 successful sign-in events.
→ 97 compromised accounts across 79 organizations.
→ 48 rogue devices registered inside Microsoft Entra environments.
→ 19 organizations had victims' MFA methods removed and replaced.
Attackers used sophisticated phishing techniques to capture legitimate authentication tokens AFTER victims completed MFA.
They then replayed those tokens to access Microsoft 365 without another authentication challenge.
But it gets worse.
Once inside, attackers registered their OWN authenticator apps and devices to maintain persistent access.
They also created hidden email rules to intercept or delete messages involving payroll, banking, and direct deposits.
In one case, attackers hijacked a session just 12 MINUTES after the victim reached the MFA prompt and registered their own authenticator less than an hour later.
Changing your password alone may NOT remove the attacker.
🔴 2. CRITICAL MICROSOFT AUTHENTICATOR TOKEN THEFT FLAW
In a separate discovery, researchers at Enclave exposed CVE-2026-80097 (CVSS 8.6), a vulnerability allowing malicious Android apps to steal Microsoft authentication tokens.
→ ZERO Android permissions required.
→ No password required.
→ No additional MFA prompt.
→ Malicious apps could impersonate Microsoft Teams.
→ Stolen tokens could provide access to corporate email, files, calendars, and sensitive account functionality.
The underlying flaw? Microsoft Authenticator trusted an application's claimed identity without properly verifying the actual caller.
Microsoft has since patched this vulnerability.
These are TWO separate security issues, with no confirmed connection between them.
But they expose the same dangerous reality:
🚨 MFA ALONE IS NO LONGER ENOUGH TO STOP ATTACKERS WHO CAN STEAL OR REPLAY AUTHENTICATION TOKENS.
And businesses relying entirely on MFA for protection may have a serious blind spot.
🛡️ IS YOUR BUSINESS EXPOSED?
At Lucid Security, we're offering FREE security reviews to help businesses identify vulnerabilities, authentication weaknesses, and potential security gaps before attackers exploit them.
Get your free security review:
🌐 lucidsecurity.si
Sources:
thehackernews.com/2026/10/mi…
enclave.ai/blog/authmask-we-…
William | SOC and Detection Engineering retweeted
HIVE Consult is organizing a two-day, in-person Wireless Hacking Course, offering practical training in wireless security testing.
Wireless adapters will be provided for the training. Participants who own adapters that support monitor mode are welcome to bring them.
NB: You need to know basic Linux💪🏻
For registration and further enquiries, please contact the number displayed on the flyer.
#HIVEConsult #WirelessHacking #WirelessSecurity #EthicalHacking #CybersecurityTraining #HandsOnTraining #CybersecurityGhana
William | SOC and Detection Engineering retweeted
This is why agents shouldn't inherit your shell. Instruction files from untrusted folders should be treated as data, not config: run the agent in a sandbox, require approval for installs and network calls, and never open Downloads with it.
William | SOC and Detection Engineering retweeted
Today, I combined several Python concepts to build a Mini Security Incident Manager. 🐍
It uses lists, functions, if statements, and loops to let users add, view, search, and resolve sample security incidents.
Python becomes much more interesting when I apply what you learn.
William | SOC and Detection Engineering retweeted
You discover a vulnerability in a company's website.
Your intentions may be good, but did you have permission to test it?
Grey hat hackers may uncover security flaws without authorization.
Security lesson: Good intentions don't replace permission. Get approval before testing.
William | SOC and Detection Engineering retweeted
Windows Event ID 4672 means special privileges were assigned to a new logon.
But which account? Was it expected?
Practising SOC investigations with Wazuh exposed me to these questions.
Two websites have helped me understand Windows Security Logs.
William | SOC and Detection Engineering retweeted
53 events.
That's what finally gave me evidence that my Ubuntu audit logs had reached Splunk.
Not the installation message.
Not the forwarder startup.
An actual SPL search returning indexed events.
Here's what I verified in Part 04 of my SOC lab.
William | SOC and Detection Engineering retweeted
One misconfigured sudo rule can give an attacker root access.
Run sudo -l -U deploy to check the account's allowed commands.
SOC tip: NOPASSWD: ALL permits commands as root without a password.
For service accounts, verify whether this level of access is necessary.
William | SOC and Detection Engineering retweeted
Kali Linux isn't just for hacking. It's a toolkit for understanding security weaknesses
Nmap → Network discovery
Maltego → OSINT investigations
Burp Suite → Web testing
John the Ripper → Password auditing
BloodHound → AD attack paths
Learn the purpose not just the commands
William | SOC and Detection Engineering retweeted
Port 443 does not prove the traffic is HTTPS.
A protocol defines how systems communicate. A port is only a clue about the service.
In SOC triage, compare the actual protocol with the expected service.
Familiar ports can carry unfamiliar behaviour.
William | SOC and Detection Engineering retweeted
Posting your holiday pictures in real time feels harmless.
But you're also telling strangers exactly when you're away from home.
Enjoy the moment. Share the memories later.
Not everyone online needs to know your location.