Investigation writeups by Aiden Knecht: what the data showed, how it was found, and what it means.https://aidenknecht.devhttps://aidenknecht.dev/writeups/hunting-shadow-it-with-defender-for-cloud-appshttps://aidenknecht.dev/writeups/hunting-shadow-it-with-defender-for-cloud-appsAn audit of 200+ unsanctioned cloud apps turned up a consumer file-sync service with foreign data residency and active uploads, which was blocked the same week.Mon, 10 Aug 2026 00:00:00 GMThttps://aidenknecht.dev/writeups/catching-a-dangling-dns-recordhttps://aidenknecht.dev/writeups/catching-a-dangling-dns-recordCloudflare already knew about the dangling record; the fix was getting its security insights into the SIEM where someone would act on them.Wed, 15 Jul 2026 00:00:00 GMThttps://aidenknecht.dev/writeups/what-3500-brute-force-attempts-look-likehttps://aidenknecht.dev/writeups/what-3500-brute-force-attempts-look-likeOne exposed VM, one day, 3,516 failed logons. Most of them came from a single address, which changes what the right defense is.Sat, 20 Jun 2026 00:00:00 GMT