Lee Holmes :donor:

Partner Security Architect, Azure Security. PowerShell developer, fanatical hobbyist, and author of the PowerShell Cookbook.

Blog: https://www.leeholmes.com

Public Key

npub10nrg25d2v23mxukzvqtptr25cp6dlsxzwunm7jnsd5cavkmsmc8svyvymp

NIP-05 Address

lee_holmes_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqs8e3592x4x9ganwtpxq9s4342vqaxlcrp8wfalffcx6vwktdcdurcpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsnw5nx8

Publishing to

yabu.me

relay.damus.io

nos.lol

Author Public Key

npub10nrg25d2v23mxukzvqtptr25cp6dlsxzwunm7jnsd5cavkmsmc8svyvymp

Show more details

Last Notes

2026-03-26 19:49:08 UTC

THE BLOOMSCROLLING WILL CONTINUE UNTIL MORALE IMPROVES
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/297/204/852/167/147/original/383af77551222f5b.png

2026-03-11 00:41:48 UTC

- reply

This seems more likely to be an acquihire. I doubt they care about a social network for bots. But somebody that can make a viral AI one is definitely a better hire than a rando that stuffed their resume with the right keywords :)

2026-02-23 23:04:25 UTC

- reply

Whoa, this post is doing some numbers on social media! https://www.leeholmes.com/projects/mastodon-engagement-viewer/?url=https%3A%2F%2Finfosec.exchange%2Fdeck%2F%40jerry%2F116121792535418308

2026-02-06 19:14:33 UTC

Good update to the MSRC leaderboards now that everything is in scope by default: https://www.microsoft.com/en-us/msrc/blog/2026/02/points-to-payouts-evolution-of-microsoft-security-researcher-leaderboard

2026-02-06 17:06:08 UTC

- reply

Congrats, Brian. You deserve it.

2026-02-03 20:23:08 UTC

Updated pyco to work even better on mobile (with a virtual keyboard and function browser)
https://www.leeholmes.com/projects/pyco/
If you have any reason to use any other calculator, let me know :)
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/008/560/577/789/096/original/444f7d18cc0d0389.png

2026-01-12 17:24:10 UTC

This is a super thought-provoking read: "your password doesn't matter": https://techcommunity.microsoft.com/blog/microsoft-entra-blog/your-paword-doesnt-matter/731984
It looks at all of the major failure cases of passwords, pointing out that only one password complexity choice (avoiding a password in the top 10) really influences those failure modes.
The rest can only be addressed with MFA.

2025-11-28 18:10:38 UTC

- reply

I had a lot of fun writing a PowerShell module to expose the cdb engine into PowerShell itself so you could use the full features of the shell rather than be stuck in cdb's implementation of one: https://www.leeholmes.com/extracting-forensic-script-content-from-powershell-process-dumps/
Also, this other project hasn't seen a lot of love recently, but I love the idea: a shell that exposes cdb information as structured data, letting you CD into stack traces, etc.: https://github.com/microsoft/DbgShell

2025-11-24 23:37:50 UTC

- reply

For a long time, Microsoft had a "frontline" program where everybody promoted to a certain level spent a week on customer support. It for sure gives you empathy of what real people are dealing which, and it's rarely what you think.

2025-10-07 23:51:10 UTC

- reply

This is where evaluation frameworks that focus only on "likelihood" and "impact" struggle so much. Super high likelihood but low impact events ("A user gets their password phished therefore their insta gets hacked") will always fall behind the low likelihood but super high impact scenarios ("Nation state inverts spacetime and takes over our company and all of our customers.") Grounding these things in what you've observed can go a long way.

2025-09-24 20:12:12 UTC

- reply

This is my primary name confusion: https://www.amazon.com/Heal-Your-Gut-Supercharged-Food/dp/1743365616

2025-09-04 22:45:13 UTC

- reply

I haven't used APK lab - was it giving reports, or were you using it to get the source and then later looking through the source and resources?

2025-08-07 21:48:21 UTC

OK, Mesh hackers @npub1dqd…8xy4 . Don't disappoint.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/989/678/138/109/825/original/c4ae77eb47047083.png

2025-07-11 20:01:20 UTC

- reply

Sometimes, both the machine and the human are doing mechanical work and it's wonderful. I've had the pleasure of using several Curtas and even the simplest of calculations brings joy.
https://youtu.be/P0cGjC62XRQ?t=265

2025-07-03 19:04:05 UTC

- reply

The security industry is made up of people from the security community, so it's a weird distinction to make.

2025-06-18 00:05:58 UTC

- reply

Could be BS or could be video amplification! Here's a fantastic video from Steve Mould showing detecting pulse two ways (motion of the vein as well as color change in the face) that actually works.
https://youtu.be/rEoc0YoALt0?t=504

2025-05-08 17:57:28 UTC

- reply

I'm sure there's something here, but I don't have the patience to find it :)
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/473/501/074/152/027/original/68ca177c0aeea792.png

2025-05-08 17:45:25 UTC

It makes me super uncomfortable that globbing in Bash can turn into code execution. The fact that the name of a file can change the behavior of ls is scary. This also works for other commands that you tend to glob with, such as rm.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/473/365/560/779/121/original/e99ebbf9bf333d0f.png

2025-04-23 22:34:55 UTC

- reply

I love finding "always done this way" things at work that are wasting time and then killing them :)

2025-04-21 01:42:04 UTC

Accidentally unzipped an archive via Gnome into a directory called "~" in my home directory. I did not trust myself to delete it without renaming it first 😂

2025-04-15 20:26:18 UTC

- reply

I wonder how FEDRAMP's vulnerability scanning and reporting requirement feels about this. https://www.fedramp.gov/assets/resources/documents/CSP_Vulnerability_Scanning_Requirements.pdf

2025-03-18 00:45:41 UTC

- reply

We need to stop being so binary about VPN shaming in the same way that we realized we needed to be less binary about SMS-based 2FA shaming.
The Wall of Sheep at DEF CON still claims victims.

2025-03-06 08:07:34 UTC

- reply

The last music player generation to have a gyroscopic effect when you moved it.

2025-02-12 18:47:03 UTC

- reply

The whole caliber of VPN discourse is so stupid. Dozens of times a year - our industry takes something the public generally considers safe, finds a huge flaw in it, gives it a name, and then shames users for not doing more to protect themselves. Or worse, takes something that is not a real problem (*cough juice jacking*) and shames them yet again.
But somehow VPNs are the thing we're going to start being grown-ups about, throw around words like "depending on your threat model", and then shame users for falling for security theater?
And then we wonder why nobody listens to us.

2025-01-28 01:29:38 UTC

Pebble Watches are coming back! https://ericmigi.com/blog/why-were-bringing-pebble-back

2024-11-27 21:19:42 UTC

https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/556/997/442/879/267/original/c40f1b388b4ce825.gif

2024-11-27 18:28:33 UTC

- reply

Nice try, robot.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/556/331/489/407/594/original/ecfa395e8f2345fc.png

2024-11-20 17:04:53 UTC

- reply

Also interesting at scale is that when patch availability is made more predictable (rather than releasing randomly throughout the month), companies are better able to deploy them quickly. Hence Patch Tuesday: https://msrc.microsoft.com/blog/2023/11/reflecting-on-20-years-of-patch-tuesday/

2024-11-20 16:23:20 UTC

- reply

This is very interesting. What do you think is causing the jumps with Apache, Apple, and F5?
Also, the shape of the blue graph is primarily driven by a the defender company's operational practices right? Once a patch is available, a company could technically enforce immediate patching of all systems if they were interested and capable.

2024-10-24 18:14:38 UTC

Whoa, that's easy!
-----BEGIN MASTODON E2EE MESSAGE-----
Version: GnuPG v1.0.6 (MingW32) - WinPT 0.5.13
qANQR1DBwU4DCvEOP3P2HscQCAC1WEffP8p9FbVT02q/pixpOWMe7nyiMcJSqx9q
+DpiM84MTDActM9dBXJgwwnGRMYs0SYky2ZZKjoWbIh43rTVx2qIA50Bg0zNZVZ8
ZnL1ZY2guMWENw5fIIls8sLYEk+MErdCvkAgDIAXKzRE7Dk7lMa1ncbgkiZgURHO
S3Zy81LRc/1J+vDatddDT0J9AofZw0Cd1cxcqOZBNrk1Ia7cYBiyEMtFij9ovZXu
wx8AgM25l28gz5v1NrG7wXpXmZE5duUPYKV3IvmMAJsa5nhlD9cj72/UwFpjv7Xs
KHN7FYZ3yRcS7Mk5n8lZJCeKD+bgEsED1dwam8SNDg==
=h1A1
-----END MASTODON E2EE MESSAGE-----

2024-10-17 16:41:59 UTC

- reply

I.e., don't focus on making the attacker's life harder by constraining yourself to their playing field, but rather focus on making the defender's life easier by focusing on the things that we control
Great point, and our industry misses opportunities for this all the time. When we were looking to make PowerShell less attractive to attackers, attempting only to remove its power would have been a fool's errand.
By focusing on making it the noisiest possible tool to use, we made far more progress: https://devblogs.microsoft.com/powershell/powershell-the-blue-team/

2024-09-20 17:51:31 UTC

- reply

Those watches 🤩