https://themikewylie.com/blog/Cybersecurity, AI, and leadership.https://themikewylie.com/blog/etendo-exposure-of-sensitive-data-in-cleartext-via-url/https://themikewylie.com/blog/etendo-exposure-of-sensitive-data-in-cleartext-via-url/Wed, 28 May 2025 12:00:00 GMTDuring a hunt for cleartext credentials in a client network searching for URL parameters matching to password=, pass=, psd=, etc., I discovered a url similar to:…https://themikewylie.com/blog/the-responds-threat-hunting-framework/https://themikewylie.com/blog/the-responds-threat-hunting-framework/Sun, 11 May 2025 12:00:00 GMTThreat hunting is not simply about reacting to alerts; it’s about proactively searching for threats that have not yet been detected by technology. This typically involves…https://themikewylie.com/blog/books-every-cybersecurity-leader-needs-to-read/https://themikewylie.com/blog/books-every-cybersecurity-leader-needs-to-read/Fri, 07 Mar 2025 12:00:00 GMTThere’s a flawed logic that exists within many tech and cyber teams. High-performing individual contributors are offered leadership opportunities, because there’s an assumption…https://themikewylie.com/blog/insider-threat-training-program-development/https://themikewylie.com/blog/insider-threat-training-program-development/Wed, 26 Feb 2025 12:00:00 GMTBuilding an Insider Threat Program: Essential Resources Insider threats are often downplayed, but they pose a significant risk to organizations, as employees, contractors, and…https://themikewylie.com/blog/insider-threat-hunting-preceed-framework/https://themikewylie.com/blog/insider-threat-hunting-preceed-framework/Fri, 15 Nov 2024 12:00:00 GMTAs I reflect on my early days learning about digital forensics and incident response, I recall a particularly challenging experience that had an impact on my approach to threat…https://themikewylie.com/blog/threat-hunting-hypothesis-chaining/https://themikewylie.com/blog/threat-hunting-hypothesis-chaining/Fri, 11 Oct 2024 12:00:00 GMTHypothesis chaining is a method that enables threat hunters to narrow down search results during a hunt by appending or branching off of their original hypothesis. This…https://themikewylie.com/blog/hunting-punycode-idns-using-carbon-black-edr/https://themikewylie.com/blog/hunting-punycode-idns-using-carbon-black-edr/Thu, 17 Sep 2020 12:00:00 GMTRunning a “ipport:53” process search in Carbon Black has helped to locate hosts and/or processes performing an abnormal number of DNS queries, however recently I wanted to hunt…https://themikewylie.com/blog/acquiring-a-triage-image-using-kape-and-carbon-black-go-live/https://themikewylie.com/blog/acquiring-a-triage-image-using-kape-and-carbon-black-go-live/Fri, 27 Mar 2020 12:00:00 GMTBefore starting, big shout out to Eric Zimmerman (https://github.com/EricZimmerman/) for creating so many great free DFIR tools. KAPE can be downloaded here:…https://themikewylie.com/blog/infosec-reading-list/https://themikewylie.com/blog/infosec-reading-list/Sun, 12 Jan 2020 12:00:00 GMTI often get asked which books are worth reading for an aspiring InfoSec pro. While there are many great books out there, each serving a unique purpose, here are my general…https://themikewylie.com/blog/intuit-lacerte-vulnerability-and-data-exposure-cve-2018-11338-cve-2018-14833/https://themikewylie.com/blog/intuit-lacerte-vulnerability-and-data-exposure-cve-2018-11338-cve-2018-14833/Tue, 21 May 2019 12:00:00 GMTNOTE: This vulnerability was discovered in early April of 2018. I immediately contacted Intuit support and their security team to responsibly disclose the vulnerability. I…https://themikewylie.com/blog/ultratax-cs-data-exposure-vulnerability-cve-2018-14608-cve-2018-14607/https://themikewylie.com/blog/ultratax-cs-data-exposure-vulnerability-cve-2018-14608-cve-2018-14607/Tue, 21 May 2019 12:00:00 GMTNOTE: This vulnerability was discovered in late July of 2018. I immediately contacted Thompson Reuter support, their sales team, and Tweeted to them to responsibly disclose the…