Ryan Williams Detection Engineering & Cloud Security https://rwilliams.dev/ 2026-10-01T17:44:05+00:00 Ryan Williams FedRAMP 2026 vulnerability deadlines, worked through a real scan https://rwilliams.dev/article/fedramp-2026-vulnerability-evaluation/ 2026-10-01T00:00:00+00:00 Severity-based deadlines are gone. How the new exploitability, reachability and impact evaluation changes what is due when, and how I built a first pass of it into VulnAnalyzer. Five CloudTrail detections to deploy first https://rwilliams.dev/article/cloudtrail-detections/ 2026-10-01T00:00:00+00:00 Logging tampering, root use, console logins without MFA, credentials created for someone else, and resources opened to the internet. Splunk and Sentinel queries with tuning notes. Catching shadow copy deletion before the encryption starts https://rwilliams.dev/article/inhibit-system-recovery/ 2026-10-01T00:00:00+00:00 One detection for vssadmin, wmic, wbadmin, bcdedit and PowerShell recovery tampering (T1490), written for Splunk, Sentinel and Elastic. Detecting ransomware encryption by behavior, not file extension https://rwilliams.dev/article/ransomware-encryption/ 2026-10-01T00:00:00+00:00 Why extension watchlists fail, and two behavioral detections that hold up: mass renames that collapse many file types into one, and the same note dropped in every folder. AD account deletion: turning event 4726 into a useful alert https://rwilliams.dev/article/ad-account-deletion/ 2026-10-01T00:00:00+00:00 Alerting on every deletion is noise. Three variants that carry signal: who deleted what, bulk deletion, and accounts created and deleted within a day. FedRAMP's 2026 rules: what changes for continuous monitoring https://rwilliams.dev/article/fedramp-2026/ 2026-10-01T00:00:00+00:00 POA&Ms are gone, ConMon is now Ongoing Certification, and impact levels became classes. A summary of the Consolidated Rules for 2026 and the dates that matter. One-liners for triage https://rwilliams.dev/article/triage-one-liners/ 2026-10-01T00:00:00+00:00 Short Python, Bash and PowerShell snippets for hashing, pulling URLs, checking listeners, startup items and AD password expiry. What makes a SOC analyst stand out https://rwilliams.dev/article/analyst-tips/ 2026-10-01T00:00:00+00:00 Six habits that separate analysts who close alerts from analysts who improve the SOC.