<unnamed>

Public Key

npub1r2y7ca3u08g8vpfwtj56sxm8w7c8un6cd0rth68rrfseq4tk92dqs4wyfl

Profile Code

nprofile1qqsp4z0vwc78n5rkq5h9e2dgrdnh0vr7favxh34mar335cvs24mz4xsprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntu7u4rq

Publishing to

relay.momostr.pink

Last Notes

2026-07-21 16:08:16 CEST

Investigation Scenario 🔎
Alert: Microsoft Defender for Endpoint: Behavior:Win32/SuspClickFix.F detected on a Windows 11 workstation.
No additional context is provided. What artifacts would you examine first to determine whether the user executed the ClickFix command?
To go further, what would you look for to determine whether the alert represents the beginning of an ACR Stealer intrusion?
#InvestigationPath #DFIR #SOC

2026-07-09 17:15:25 CEST

"Show your work."
When I was in school, kids would get mad when teachers would ask them that. "What does it matter so long as I get the right answer?"
Showing your work has always been the essential lesson, because eventually, someone will tell you that you’re wrong. If you can’t explain how you reached your conclusion, you can’t defend it.
Your value isn’t just producing an answer... It’s being able to explain, defend, and adapt your reasoning.
It's never been more valuable than now.

2026-06-19 15:38:54 CEST

- reply

I promise this isn't focused on any one specific company; you can call it my naive idealism if nothing else.

2026-06-19 15:38:54 CEST

With all the recent M&A activity and more certainly to come, I keep arriving back at the same question... are people going to be safer?

2026-06-11 16:14:57 CEST

I use LLMs for a variety of tasks every day and frequently benchmark domain-specific tasks across different models for my research. So, where am I on LLM use for security analysis and investigation work? In short summary:

2026-05-14 16:47:56 CEST

Many of the same people who don't understand how analysts think are trying to tell AI how to do it and sell you the results. You shouldn't trust any of them.
I’m not anti-AI. It makes me a better analyst. I’m anti pretending that complex investigative reasoning can be reduced to prompts and dashboards by people who never understood the reasoning process to begin with. It's gonna continue to be a wild ride for a bit.

2026-04-21 19:07:28 CEST

Investigation Scenario 🔎
You believe a Linux server was used as a jump box to pivot into another network segment, but the network traffic would not have crossed a sensor boundary for logging.
What evidence do you look for to prove the belief?
#InvestigationPath #DFIR #SOC

2025-11-12 15:44:26 CET

"This has an em dash—it must be AI!" 😩
GenAI uses em dashes, in part, because it was trained on material written by authors like me. Without our consent, might I add.
The machines can pry my em dashes from my cold, dead hands.

2025-04-03 15:32:51 CEST

We have a space-themed children's book coming out next month.
The new tariffs announced yesterday mean we'll have to charge 54% more for it bc we'll have to pay that tariff tax.
Get it printed in the US, you say? We'd have to charge 130% more for it bc of the production cost.

2024-10-30 01:02:14 CET

It was a beautiful day to get out and vote!
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/393/436/657/673/113/original/52655faeef9bb01d.png