The Client's Website Got Blocklisted, Then ZAP Came for Their Inbox
A URL reputation hit turned ZAP against a client's own mail. How we proved it, beat the quarantine expiry clock, and released 1,600 messages safely.
Posts
The Fake Microsoft Login Page That Registered a Device
An AiTM phishing page proxied a real Microsoft 365 sign-in and registered an attacker device. Covers triage, containment, and the controls that stop it.
The Vendor Was the Phish: Responding to an AiTM Compromise in Microsoft 365
A trusted vendor's share link led to AiTM token theft and a phishing run from our user's mailbox. How we scoped it, cleaned it up and what stops it.
Killing Sweet32 on Windows with PowerShell
Sweet32 (CVE-2016-2183) is one of the most common scan findings on Windows. Here's how to find and kill 3DES suites with built-in PowerShell cmdlets.
Shutting Down Direct Send in Microsoft 365 (Without Breaking Your Printers)
Block unauthenticated Direct Send spoofing in M365 without breaking legacy apps and printers. Find your legitimate senders, create inbound connectors, and flip RejectDirectSend.
The NetBIOS Finding That Wasn't About NetBIOS
A null session finding pointed at NetBIOS. NetBIOS was already off. The real gap was a named pipe exception list our hardening never touched.