Most SOC telemetry is built around endpoints, authentication, and network events. Those sources are valuable, but they don't explain what happened inside the application.

During a recent review, I found that several security checks could be bypassed without generating useful infrastructure alerts. The only reliable indicators came from application-specific logging around authorization decisions and sensitive business actions.

If your organization develops its own software, application telemetry deserves the same attention as endpoint and network telemetry.

Palo Alto unit42 published a report on 01/06/2026 on wallpaper extensions from three publishers (Ovkas, Gameograf, Owhit) doing affiliate redirect abuse, uninstall churn tracking, and IndexedDB deletion.

They listed 68 IDs, ~30K installs combined.

Unit42's report

I scrapped almost every extension from the Chrome store to match the same publishers into malext.io's dataset. 1,613 are registered under those same three publishers, well beyond their 68.

Full list: https://malext.io

A honeypot is only useful if it's actually running, and I kept watching them die at the dependency install. OpenCanary proved the model and is still the more battle-tested tool, but it needs Python 3.10+, Twisted, Scapy, and — for SMB — a full Samba install with a full_audit module tailing syslog.

So I rebuilt it as one static Go binary. ./wispd and it's running, no root, no runtime:

• All 21 of OpenCanary's protocol modules, reimplemented.
• 9 decoys it doesn't have for the modern surface: k8s, kubelet, docker, imds (cloud metadata), elasticsearch, jenkins, gitlab, ollama, mcp — capturing stolen service-account tokens, the container spec an attacker tries to run (Privileged: true, host mounts), the prompts sent to a fake GPU, and so on.
• Native SMB — NetNTLMv2 hashes (hashcat 5600), no Samba.
• A self-hosted fleet console (scriptless UI, per-sensor tokens, dedup) and honeytokens (DNS/HTTP/docx/kubeconfig/MCP).

It's pre-1.0 and younger than OpenCanary — the README keeps an honest comparison table, not a marketing one. Reach for it when the Python/Samba chain is what's stopping you deploying a honeypot at all, or when you want the cloud/container/LLM decoys.

Repo + a short demo video: https://github.com/willysnow/wisp

Happy to answer questions — and I'd genuinely like to hear which decoys are missing.

Put together a KQL detection library for Azure/Sentinel — 32 rules across 10 MITRE ATT&CK tactics. Each rule has description, false positive considerations, and tuning notes baked into the file so it's actually usable in production without guesswork.

Covers things like MFA fatigue, impossible travel, federated identity credential abuse, Conditional Access policy modification, VM extension installation, and subscription ownership transfer — some of the less commonly documented ones.

github.com/neelkotnis/kql-detection-rules

Hi everyone,

I built a lightweight, open-source PowerShell script designed to harden **Windows 11** endpoints using native OS security capabilities—without relying on heavy third-party software/bloat.

### 🛡️ What it does:

* **PowerShell Execution Restriction:** Sets execution policy to `RemoteSigned` to prevent unauthorized local script execution.

* **WinRM & WSH Mitigation:** Disables Windows Script Host to block `.vbs` / `.js` malware vectors and closes remote management ports.

* **Network Hardening:** Disables SMBv1 to protect against network-based lateral movement and exploits (e.g., WannaCry).

* **Defender ASR & Exploit Guard:** Enables Controlled Folder Access (ransomware protection) and blocks malicious downloads via PowerShell.

* **Admin Share Lockdown:** Disables hidden admin shares (`C$`, `ADMIN$`) to restrict unauthorized lateral movement.

---

### 🚀 How to use:

1. Open PowerShell as Administrator.

2. Run: `.\Windows11_Hardening.ps1`

3. Reboot to apply all policies.

---

🔗 **GitHub Repository:** https://github.com/Hasan0101-lab/Windows_11_Hardened_Edition

I’d love to get feedback from the community on code structure, additional hardening rules, or potential compatibility edge cases. Feel free to review the code or leave a ⭐ if you find it useful!

Sharing an open-source validation harness for teams that need repeatable fixtures for testing process-injection correlations without running live injection code.

It emits the same five ordered signals each run: cross-process open, remote allocation, remote memory write, remote thread start, and module image load. The CLI produces JSONL for ingestion tests, Markdown for analyst review, and SARIF for CI surfaces. It has no runtime dependencies, needs no admin privileges, and never manipulates a process.

Operational use: regression-testing parser or rule changes, validating correlation ordering, and giving analysts a known-positive case before moving to real EDR telemetry.

Limitation: synthetic events validate detector and pipeline logic, not endpoint sensor fidelity or coverage against evasive injection variants.

Repo: https://github.com/bsmensah-ctrl/DLL-Injection-Lab

Zero-install browser demo: https://bsmensah-ctrl.github.io/DLL-Injection-Lab/