Some articles I worked on elsewhere, mostly from my time at Palantir. A little less rambling than the notes here :)
Windows privilege abuse
Windows Privilege Abuse: Auditing, Detection, and Defense
Written with help from friends at SpecterOps. We looked at Windows privileges that are easy to overlook, how they can be abused, and what to collect if you want a chance of spotting it.
Restricting SMB-based lateral movement
Restricting SMB-based Lateral Movement in a Windows Environment
Another collaboration with friends at SpecterOps, this time on restricting SMB-based lateral movement. The awkward part is putting the restrictions in place while keeping the things that actually need SMB working.
Microsoft Defender Attack Surface Reduction
Microsoft Defender Attack Surface Reduction Recommendations
The approach we used to deploy Attack Surface Reduction rules: which rules to start with, what audit mode tells you, and how to work through exceptions before enforcing them.
Managing browser extensions at scale
Managing and Automating Browser Extensions at Scale
The DevOps workflow we designed for browser extension requests, reviews, and rollout. Useful if extension management has become a long list of one-off decisions that nobody particularly wants to own.