https://secderr.tech/Field notes on incident response, compliance, and hardening real-world systems.https://secderr.tech/images/og-default.pnghttps://secderr.tech/images/og-default.pngHugoen-usSun, 11 Oct 2026 00:00:00 +0000https://secderr.tech/posts/zap-quarantine-mass-release/Sat, 10 Oct 2026 00:00:00 +0000https://secderr.tech/posts/zap-quarantine-mass-release/A URL reputation hit turned ZAP against a client's own mail. How we proved it, beat the quarantine expiry clock, and released 1,600 messages safely.https://secderr.tech/posts/fake-microsoft-login-aitm-device-registration/Fri, 09 Oct 2026 00:00:00 +0000https://secderr.tech/posts/fake-microsoft-login-aitm-device-registration/An AiTM phishing page proxied a real Microsoft 365 sign-in and registered an attacker device. Covers triage, containment, and the controls that stop it.https://secderr.tech/posts/aitm-vendor-phish-microsoft-365/Thu, 08 Oct 2026 00:00:00 +0000https://secderr.tech/posts/aitm-vendor-phish-microsoft-365/A trusted vendor's share link led to AiTM token theft and a phishing run from our user's mailbox. How we scoped it, cleaned it up and what stops it.https://secderr.tech/posts/disabling-sweet32-cipher-suites-powershell/Wed, 07 Oct 2026 00:00:00 +0000https://secderr.tech/posts/disabling-sweet32-cipher-suites-powershell/Sweet32 (CVE-2016-2183) is one of the most common scan findings on Windows. Here's how to find and kill 3DES suites with built-in PowerShell cmdlets.https://secderr.tech/posts/blocking-direct-send/Tue, 06 Oct 2026 00:00:00 +0000https://secderr.tech/posts/blocking-direct-send/Block unauthenticated Direct Send spoofing in M365 without breaking legacy apps and printers. Find your legitimate senders, create inbound connectors, and flip RejectDirectSend.https://secderr.tech/posts/netbios-finding-that-wasnt/Tue, 06 Oct 2026 00:00:00 +0000https://secderr.tech/posts/netbios-finding-that-wasnt/A null session finding pointed at NetBIOS. NetBIOS was already off. The real gap was a named pipe exception list our hardening never touched.