WMouton/Security research notes, findings, lab write-ups and case studies.enSat, 03 Oct 2026 12:00:00 +0000A matcher is not a security boundary/thoughts/#matcher-is-not-a-boundary/thoughts/#matcher-is-not-a-boundarySat, 03 Oct 2026 12:00:00 +0000Routing filters decide which requests reach a handler, not who may use it.Tool output is untrusted input/thoughts/#tool-output-is-untrusted-input/thoughts/#tool-output-is-untrusted-inputSat, 03 Oct 2026 12:00:00 +0000Text a tool returns lands in the same context as the instructions.If you cannot rebuild it, you cannot trust it/thoughts/#rebuild-or-do-not-trust/thoughts/#rebuild-or-do-not-trustSat, 03 Oct 2026 12:00:00 +0000Reviewing source means little if the binary came from somewhere else.An air gap is a process, not a product/thoughts/#air-gap-is-a-process/thoughts/#air-gap-is-a-processSat, 03 Oct 2026 12:00:00 +0000The gap holds only as long as every transfer, device and habit around it does.Document the threat model, not just the bug/thoughts/#document-the-threat-model/thoughts/#document-the-threat-modelSat, 03 Oct 2026 12:00:00 +0000A finding without a threat model is a trick.Detection: PowerShell launched with an encoded command/detections/encoded-powershell/det-encoded-powershellSat, 03 Oct 2026 12:00:00 +0000Attackers pass Base64-encoded PowerShell on the command line to hide the script from casual inspection and from simple string matching. The rule flags PowerShell started with an encoded-command flag.Detection: Burst of failed logons followed by a success from one source/detections/password-guessing-then-success/det-password-guessing-then-successSat, 03 Oct 2026 12:00:00 +0000Password guessing and spraying generate many failed network logons from one source before one succeeds. The query counts failures and successes per source in a short window and flags sources with both.Detection: Office application launching a shell or script host/detections/office-spawns-script-host/det-office-spawns-script-hostSat, 03 Oct 2026 12:00:00 +0000Malicious documents typically run code by having the Office application start a command shell or script interpreter. Office programs rarely do this in normal use.Acceptable use policy (sample)/policies/#acceptable-use-policyart-acceptable-use-policySat, 03 Oct 2026 12:00:00 +0000A short, readable acceptable use policy of the kind that people will actually read and follow.Incident response plan (sample)/policies/#incident-response-planart-incident-response-planSat, 03 Oct 2026 12:00:00 +0000A one-page incident response plan: who does what, how serious it is, and what happens in each phase.Vendor security assessment checklist (sample)/policies/#vendor-assessment-checklistart-vendor-assessment-checklistSat, 03 Oct 2026 12:00:00 +0000A framework for judging a supplier's security before data or access is shared with them.