Brian Clark

https://infosec.exchange/@deepthoughts10

#InfoSec #Cybersecurity #threatintel and Politics. I try my best.
Also @deepthoughts10@twitter.com

Searchable

Verified by Twittodon: https://twittodon.com/share.php?t=Deepthoughts10&m=deepthoughts10@infosec.exchange
Find my toots: Tootfinder

Public Key

npub1mqq55xavlpm9jj9sqhq3deau3f2swkzmgymk7j9355v0edd6tuzq500jgu

NIP-05 Address

deepthoughts10_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqsdsq22rwk0sajefzcqtsgku77g54g8tpd5zdm0fzc62x8ukka97pqpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsc4cah3

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1mqq55xavlpm9jj9sqhq3deau3f2swkzmgymk7j9355v0edd6tuzq500jgu

Show more details

Last Notes

2026-07-12 19:44:59 UTC

- reply

I’m starting to see some companies log all AI prompts and review them to see what people are using AI to do. The ones I’ve seen do this are positioning it as a way to discover additional training opportunities for their staff — to train them that they gave other, better tools to compare PDFs, for example. It makes sense if you have the tools and resources to put together this kind of analysis.

2026-04-15 19:10:44 UTC

- reply

I have another one of these app hosting platforms to add to your BS lists:
.on-forge.com
It’s the free-tier domain used by Laravel Forge.
Reference:
https://guardz.com/blog/from-keyboard-smash-to-device-control/

2026-04-06 17:08:02 UTC

@npub1ctt…3ll8 I have a few additions to your BS lists for you.
Leapcell.io allows hosting of free-tier apps on the subdomains of .leapcell.dev and .leapcell.app
Railway.com allows hosting of free-tier apps on the subdomain .railway.app
Back4app.com allows hosting of free-tier apps on the subdomains .b4a.io and .b4a.app

2026-02-10 00:29:27 UTC

- reply

unless you live in or do business in Russia, this is not likely to affect you. This issue is about risk to you and your users. Security is always about tradeoffs, and for most people in the West, this tradeoff is a no-brainer.

2026-02-10 00:27:15 UTC

- reply

you probably don’t want any files torrented out of Russia. 😬

2026-02-05 23:48:44 UTC

RE: https://infosec.exchange/@spamhaus/116013190680647542
Folks: block the .ru TLD any and all ways that you can. #cybersecurity
#note1zfn…wtl9

2026-01-19 02:43:24 UTC

JAW DROPPING. That was a Nintendo Tecmo Bowl play! #BEARS #nfl

2026-01-07 23:30:57 UTC

tl;dr Block these domains and you’ll have broken several links in this attack’s kill chain:
Webhook[.]site
My-board[.]org
ngrok-free[.]app
rf[.]gd
If you followed @npub1ctt…3ll8 ‘s advice and used his block lists, you’d have already blocked a couple of them.
https://www.recordedfuture.com/research/gru-linked-bluedelta-evolves-credential-harvesting #cybersecurity

2026-01-06 13:45:12 UTC

- reply

you ever look at Thuma? They have nice furniture made of real wood. https://www.thuma.co

2025-11-25 22:49:25 UTC

- reply

you sure they are not just blocking your scanner?

2025-11-25 03:42:05 UTC

- reply

thank you for sharing your knowledge and experience with us. I’ve learned a lot from you over the decade or so I’ve followed you.

2025-11-24 16:57:28 UTC

- reply

it doesn’t appear that the csv files themselves are accessible. Just the listing. Or at least that’s the behavior I’m seeing right now. You seeing anything different?

2025-11-13 13:49:51 UTC

- reply

just apply the policy blocking those exe’s after initial deployment

2025-11-13 02:20:02 UTC

- reply

hasn’t had a significant impact in my environment. But I imagine it depends on how much old software you have hanging around.

2025-11-13 01:51:23 UTC

- reply

you absolutely should block the execution of mshta.exe. It will only block some of the ClickFix attacks, but block some other techniques too. Mshta.exe is an attacker favorite.
While you are at it, block cscript.exe and wscript.exe too.

2025-11-04 02:52:45 UTC

- reply

I’m glad you are here. 🙂

2025-09-23 22:19:53 UTC

- reply

Steven Lim has written a Microsoft KQL detection for EDR Freeze and made it available here:
https://detections.ai/share/rule/cicyA1JW

2025-09-21 22:48:32 UTC

Zensec has a good article on the Akira ransomware group's tactics taken directly from their DFIR experience on 16+ incidents. A few key take-aways:
- Initial Access: Please, please please patch your Internet-facing VPN and firewall devices including your Sonicwall, Cisco ASA and Watchguard devices.
- Patch our Veeam software. They used vulnerable Veeam installs to perform privilege escalation
- Block access to Anydesk.com and remotedesktop.google.com if you don't use those services
#cybersecurity #ransomware
https://zensec.co.uk/blog/unmasking-akira-the-ransomware-tactics-you-cant-afford-to-ignore/

2025-09-11 22:49:55 UTC

- reply

oh boy, I thought I had run out of stupidity for the day

2025-09-03 23:02:55 UTC

- reply

song is giving me Avril Lavigne vibes

2025-08-24 16:38:09 UTC

- reply

I do t really know why, but I never watched B5 despite being a sci-fi fan and watching all the Star Trek series. Is B5 worth watching now? Does it hold up?

2025-08-20 12:51:14 UTC

- reply

I’m worried that they got documentation on their customer network and router configurations. That could open up a lot of new attack paths.

2025-08-20 00:16:31 UTC

- reply

love it!

2025-08-10 17:18:05 UTC

- reply

cool event
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/005/604/583/486/818/original/bf8dfe6209b82509.jpeg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/005/604/159/370/185/original/e197c24b3a4d3ffe.jpeg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/005/604/087/408/166/original/bf8ab58f54cd18bf.jpeg

2025-08-08 17:53:49 UTC

Hello #DEFCON33
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/994/419/769/447/084/original/7fbbfddb01668fb1.jpeg

2025-08-03 19:59:08 UTC

- reply

it’s uncanny how much she looks like Taylor.

2025-07-13 19:46:49 UTC

- reply

<sigh> sold out

2025-07-07 01:15:36 UTC

- reply

Doritos and cannabis is a winning combination if there ever was one

2025-07-07 01:14:54 UTC

- reply

is this a sub-toot?

2025-07-04 21:24:32 UTC

- reply

can confirm. I’ve got two of these.

2025-06-23 01:45:36 UTC

Please raise your hand if you've disabled PowerShell 2.0 on your Windows systems. What? Didn't know that was a thing you should do? PowerShell 2.0 does not have any of the modern logging and security features that newer versions like v5.1 or 7.x have. But if you don't remove or disable the old 2.0 version, it can be used and abused by malware, info stealers, ransomware operators, etc. Here's an article that provides you with several ways to remove it from you systems (while keeping the newer version in place) #cybersecurity
https://powershellcommands.com/disable-powershell-20

2025-05-31 14:44:06 UTC

For this edition of #caturday I present a #cat and his stuffy toy cat buddy. Which one is the real cat? 😉
#catsofmastodon
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/602/974/290/583/757/original/f1aeb930785b109f.jpeg

2025-05-28 01:00:31 UTC

- reply

I can barely comprehend the awesomeness of her sparkly emerald green dress!

2025-05-14 12:39:27 UTC

- reply

<sigh> yes, this is true. Will be made worse after all the cuts to social services like Medicare and Medicaid the Republicans are putting in.

2025-05-08 22:54:52 UTC

- reply

I assume this doesn’t work if Tamper Protection is enabled?

2025-05-04 22:39:38 UTC

Hey @npub1dqd…8xy4 is your website down? I cannot get to https://defcon.org

2025-04-28 22:19:20 UTC

- reply

I’m just glad the feature is off by default on managed systems and you have to have an admin specifically allow it to be enabled by an end user.

2025-04-17 21:55:37 UTC

- reply

I didn’t realize this part. It won’t show up in MDE logs?

2025-04-17 13:02:47 UTC

Sekoia has a good report out on Interlock ransomware. One thing that jumped out at me is the continued abuse of Cloudflare’s free trycloudflare[.]com service. This domain should be blocked if you want to avoid ransomware as this isn’t the only group using this service for C2 and remote access. If your developers need this kind of functionality, you should have them sign up for the inexpensive paid version of the service that allows for the use of your own custom domain name. #cybersecurity
From: [@sekoia_io](https://infosec.exchange/@sekoia_io )
https://infosec.exchange/@sekoia_io/114346873677895469

2025-04-17 01:08:09 UTC

Security Firm @npub1xrh…fkxn published another report, this one on incidents at small and medium-sized businesses by @npub1557…mf0x and Anna Szalay. One of the things I always look for in these reports are easy #cybersecurity wins -- and this report has a bunch of them.
First off - take a look at this chart: Top 15 dual-use tools. Imagine the pain you can cause threat actors by blocking the use of these tools and disrupting their playbooks!
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/350/603/475/705/098/original/35b29599747d242d.webp

2025-03-20 12:22:33 UTC

- reply

dark

2025-03-15 18:58:32 UTC

The free service from portmap.io is being abused to support malware C2 communications. If you don’t use it, I suggest blocking *.portmap.io via DNS, NGFW and/or web proxy.
#cybersecurity #threatintel
From: @npub1vcn…s5ug
https://infosec.exchange/@ScumBots/114167879065509347

2025-03-13 02:40:59 UTC

I’ve never heard of the MSP-focused bluetrait.io but add it to the list of legitimate services that get abused. If you don’t use this RMM service, I suggest blocking it via DNS, NGFW or Web security proxy. #cybersecurity
From: @npub1n2h…4lsk
https://infosec.exchange/@threatinsight/114144688263847941

2025-03-01 22:54:30 UTC

There’s been a #Microsoft #outage going on all day today resulting in email and other M365 services including Teams being unavailable. Microsoft says they’ve rolled back the code change that caused the problem so things should start working again soon. Check on MO1020913 in the Microsoft Admin Portal for details.

2025-02-18 05:00:35 UTC

- reply

I’m glad you are here!

2025-02-16 23:55:32 UTC

- reply

so this is a post about Telegram, but i also advocate for blocking entire categories of apps, such as messengers and chat apps, and only allowing those that are vetted and approved in your org. The only way you can effectively do that is with a tool that keeps track of those apps for you, such as Netskope, Zscaler, an NGFW or maybe a DNS-based service like Cisco Umbrella.

2025-02-16 23:30:08 UTC

- reply

Also, I’d add that blocking an app in your environment that has more than a few users requires communicating with those users beforehand. Doesn’t seem like that happened in your case.

2025-02-16 19:23:37 UTC

If you help maintain #cybersecurity on a business network you should absolutely block Telegram—there’s nothing good there. If you have a web security proxy like Netskope or Zscaler, or an NGFW, block it there. You can also block it via DNS. Blocking these domains should do the job:
telegram.me
telegram.org
t.me
cdn-telegram.org
telegram-cdn.org
From: @npub1nfc…yzp9
https://swecyb.com/@nopatience/114009822145442393

2025-02-16 19:08:06 UTC

If you can completely disable device code flows using Conditional Access, you should do so. If you cannot, at least limit which user IDs can use them. If you allow any users to use device code flows, use the #KQL provided to hunt for abuse.
#cybersecurity #microsoft
From: [@fabian_bader](https://infosec.exchange/@fabian_bader )
https://infosec.exchange/@fabian_bader/114013896376345681

2025-01-21 19:36:22 UTC

This tactic of sending unsolicited messages and calls via Teams has an easy solution—only allow specific external domains to communicate with your end users. Review your Teams logs, see which domains your users are communicating with, add them to the allow list and enable the control. Make your end users open up a support ticket for future domain adds so you can vet them.
Forget about Zero Trust and apply best practice security configurations. Let the marketing people and the CISO worry about whether something is “zero trust” or not. #Cybersecurity
Microsoft docs:
https://learn.microsoft.com/en-us/microsoft-365/solutions/trusted-vendor-onboarding?view=o365-worldwide#allow-the-vendors-domain-in-teams-external-access
From: @npub14g0…znd6
https://infosec.exchange/@screaminggoat/113867636525001029

2025-01-14 23:49:04 UTC

- reply

I’m glad you still do these write-ups!

2024-12-08 01:50:35 UTC

My daughter put a sweater on the #cat and now he looks like a Dr. Seuss character #caturday #catsofmastodon
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/614/686/491/245/515/original/20941eb6b238babf.jpeg

2024-12-05 23:18:30 UTC

- reply

they just went GA (for Microsoft anyway) last month. Who’s going to widely deploy something from Microsoft that’s not GA?

2024-12-04 03:08:40 UTC

- reply

“The Man from Earth” is an underrated movie. Hard to believe it is so good when it’s really just a bunch of people talking for almost two hours.

2024-12-04 00:40:48 UTC

- reply

no interest was ever shown where I am — until Copilot PC’s were promoted by Microsoft. Now we have some interest.

2024-11-23 19:35:44 UTC

- reply

it’s faithful to the book too. The author was the show runner.

2024-11-22 22:49:21 UTC

- reply

I love nerd insults!

2024-11-18 23:54:49 UTC

- reply

aren’t all forward web proxies identity-aware these days?

2024-10-08 02:56:04 UTC

- reply

that hurricane is TIGHT!

2024-10-05 21:51:45 UTC

This #cat is well-snuggled #caturday #catsofmastodon
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/257/026/456/836/508/original/d3d39d4fb2ef2f55.jpeg