← Feed

Posts

• View post

  Cloud Incident Response: What Changes and What Doesn’t Cloud incident response keeps the fundamentals of IR but changes where the evidence lives, how fast attackers move and what containment means. https://www.halkynconsulting.co.uk/a/2026/10/cloud-incident-response/

• View post

  Prompt Injection Evidence: What It Leaves Direct and indirect injection leave different traces, and both leave less than an investigator would like. https://www.halkynconsulting.co.uk/a/2026/10/prompt-injection-evidence/

• View post

  Linux System Calls at the Assembly Level Every meaningful action a program takes eventually becomes a system call. This post explains how Linux system calls work at the instruction level and why they are a goldmine for behavioural analysis. https://www.halkynconsulting.co.uk/a/2026/10/linux-system-calls-assembly/

• View post

  Open Source Honeypots: Choosing the Right One Open source honeypots deliver detection with almost no false positives. A practical comparison of the main projects, where to place them, and how to run them safely. https://www.halkynconsulting.co.uk/a/2026/10/open-source-honeypots/

• View post

  Departing Employee Evidence: The Leaver Window The window between resignation and last day is where a great deal of insider activity happens, and where the evidence is most easily lost. https://www.halkynconsulting.co.uk/a/2026/10/departing-employee-evidence/

• View post

  Linux File Attributes Attackers Rely On Permissions are only part of the picture. This guide covers SUID and SGID hunting, the sticky bit, chattr flags including immutable, and the extended attributes that stay invisible during a routine listing. https://www.halkynconsulting.co.uk/a/2026/10/linux-file-attributes/

• View post

  The Unified Audit Log: A Responder’s Guide to Microsoft 365 What the Microsoft 365 unified audit log records, how long it keeps it, how to search it at scale and the gaps responders need to plan around. https://www.halkynconsulting.co.uk/a/2026/10/unified-audit-log/

• View post

  Poisoned Model Triage: Provenance First You cannot read a set of weights and tell whether it is safe. What you can do is establish where it came from. https://www.halkynconsulting.co.uk/a/2026/10/poisoned-model-triage/

• View post

  The First 48 Hours After a Breach: Leadership Decisions The decisions in the first 48 hours after a breach that belong to leadership rather than the technical team, and how to prepare for them now. https://www.halkynconsulting.co.uk/a/2026/10/first-48-hours-after-a-breach/

• View post

  Build a Python Honeypot: A Hands-On Guide A complete hands-on guide to building a multi-service Python honeypot: asyncio listeners, structured logging, systemd hardening, log shipping and alerting. https://www.halkynconsulting.co.uk/a/2026/10/python-honeypot/

• View post

  Building an Insider Investigation Timeline Timelining an insider case means correlating mediocre sources, establishing what was normal first, and being honest about the gaps. https://www.halkynconsulting.co.uk/a/2026/10/insider-investigation-timeline/

• View post

  Linux Capabilities and Why ls Doesn’t Show Them Capabilities split root's authority into individual privileges, and they hide in extended attributes where routine checks never look. This guide covers finding them, reading them and judging whether one matters. https://www.halkynconsulting.co.uk/a/2026/10/linux-capabilities/

• View post

  Entra ID Sign-in Logs: Scoping a Compromised Account Using Entra ID sign-in logs to scope a compromised Microsoft account: log types, retention, key fields and a worked adversary-in-the-middle example. https://www.halkynconsulting.co.uk/a/2026/10/entra-id-sign-in-logs/

• View post

  AI Coding Assistant Forensics on Linux Developer workstations now carry full transcripts of what people asked, what tools ran and what those tools returned. https://www.halkynconsulting.co.uk/a/2026/10/ai-coding-assistant-forensics/

• View post

  Incident Notification Deadlines: Who Needs Telling and When A leader's guide to UK incident notification deadlines: which regulators, which clocks, when they start and what is changing, as of October 2026. https://www.halkynconsulting.co.uk/a/2026/10/incident-notification-deadlines/

• View post

  Writing an Incident Response Report That Works An incident response report has to serve executives, lawyers and engineers at once. How to structure it, what to include, and how to make it land. https://www.halkynconsulting.co.uk/a/2026/10/incident-response-report/

• View post

  Covert Evidence Preservation in Insider Cases Collecting quietly is sometimes necessary and always exceptional. The practical limits, and the point at which covert work stops being defensible. https://www.halkynconsulting.co.uk/a/2026/10/covert-evidence-preservation/

• View post

  Linux Namespaces: Where Evidence Hides The filesystem view you get from the host is not necessarily the view the suspect process has. This guide covers enumerating namespaces, entering them with nsenter and spotting mount namespace evasion. https://www.halkynconsulting.co.uk/a/2026/10/linux-namespaces-forensics/

• View post

  Business Email Compromise Investigation in Microsoft 365 How to run a business email compromise investigation in Microsoft 365, from the initial access through inbox rules and consent grants to what was read. https://www.halkynconsulting.co.uk/a/2026/10/business-email-compromise-investigation/

• View post

  Finding a Model in Memory and Nowhere Else Weights staged in temporary storage, deleted files held open by a running process, and keys that exist only in an environment block. https://www.halkynconsulting.co.uk/a/2026/10/model-in-memory/

• View post

  Reading the Linux Process Tree During Triage A flat process list tells you what is running. The tree tells you what started it. This guide covers reading Linux process lineage, exposing renamed processes and recovering a deleted binary through /proc. https://www.halkynconsulting.co.uk/a/2026/09/linux-process-tree/

• View post

  Reading Prompt History as Evidence An employee's AI prompt history is a record of what they asked for, including the requests they thought better of. It needs handling with care. https://www.halkynconsulting.co.uk/a/2026/09/prompt-history-as-evidence/

• View post

  What a Threat Hunting Capability Really Costs The tooling is rarely the expensive part. Data retention and protected analyst time are where a hunting budget actually goes. https://www.halkynconsulting.co.uk/a/2026/09/threat-hunting-capability/

• View post

  Does anyone know a good website where I can find a list of all the DIRECT flights out of Toulouse on a given day in April 2024?

• View post

  I've found something I don't hate ChatGPT's output with. Holiday planning. It is surprisingly _acceptable_ here. If you do things like say "I have a weekend in Amsterdam at the end of August. I'd like to go to the Rijksmuseum for at least part of the trip. Give me an itinerary of things to do", it actually gives some good plans.

• View post

  In the last month, I did some "AI" experimentation. I used ChatGPT 3.5 and 4 to write some marketing-style LinkedIn posts. The content they produced was (to me) pretty awesome tbh. It felt a lot better than anything I could write. I posted it to LinkedIn and, really, the response was very lukewarm. So next I wrote some myself. Now I am not good at this, but I tried to put some words into sentences. The end result did not read as well (to me) and certainly felt less appealing....

• View post

  Recently, I've asked questions on BlueSky, Twitter and Mastodon. Most of the time, the fastest and most useful answers come from Mastodon. Twitter users are, generally, most likely to misread the question and answer something else. BlueSky, generally, doesn't get any response.

• View post

  !!Cybersecurity Job seekers in UK or Spain!! There is an awesome cybersecurity role, for a mid-senior (L2/L3?) SOC analyst for a great team looking after global security in a complex environment. The role is remote but you must already be based in the UK or Spain with a right to work in that country. You will get to work with some incredible people and for an awesome boss. The hours are good, with (currently) no expectation of shifts or objectionable hours and the pay is excellent. The organi...

• View post

  I've sat in on loads of interviews in the last few months with #DFIR/#SOC candidates who don't understand the order of volatility. So I wrote a quick LinkedIn post about it: https://www.linkedin.com/posts/taswake_linux-dfir-for577-activity-7124461789123112961-lR5A #forensics #incidentresponse #CyberSecurity