shanemccausland.com
detections/people/shane_mccausland.yml

title:

Shane McCausland

status: production

level: high

description: >

Lead technical engineer for an insider threat program, based in Dublin. I build the detection, risk-scoring and triage systems that help analysts find the few people who need their attention each day.

author: The Paranoids, Yahoo (since 2022)

education: M.Sc. Cybersecurity, First Class Honours

logsource: [endpoint, identity, cloud, email, saas]

detection:

detections_authored: 200+

alert_noise_cut: ~85%

condition: all of them

falsepositives:

- fewer every week

live probes on this site322 this week
  1. 05 Nov 21:36 GET /actuator/env src=2001:470:6d::xT1190 high
  2. 05 Nov 21:36 GET /config.json src=2001:470:6d::xT1552.001 high
  3. 05 Nov 21:36 GET /actuator/health src=2001:470:6d::xT1190 high
  4. 05 Nov 21:35 GET /actuator/env src=2001:470:6d::xT1190 high
  5. 05 Nov 21:35 GET /config.json src=2001:470:6d::xT1552.001 high
  6. 05 Nov 21:35 GET /actuator/health src=2001:470:6d::xT1190 high
  7. 05 Nov 21:34 GET /config.json src=2001:470:6d::xT1552.001 high
  8. 05 Nov 21:34 GET /actuator/health src=2001:470:6d::xT1190 high
  9. 05 Nov 21:34 GET /actuator/env src=2001:470:6d::xT1190 high
  10. 05 Nov 21:34 GET /actuator/env src=2001:470:6d::xT1190 high
  11. 05 Nov 21:34 GET /actuator/health src=2001:470:6d::xT1190 high
  12. 05 Nov 21:34 GET /config.json src=2001:470:6d::xT1552.001 high
  13. 05 Nov 21:33 GET /actuator/env src=2001:470:6d::xT1190 high
  14. 05 Nov 21:33 GET /actuator/health src=2001:470:6d::xT1190 high
  15. 05 Nov 21:33 GET /config.json src=2001:470:6d::xT1552.001 high
  16. 05 Nov 19:03 GET /wp-login.php src=103.125.146.xT1595.003 medium
  17. 05 Nov 18:29 GET /config.json src=2001:470:6d::xT1552.001 high
  18. 05 Nov 18:29 GET /actuator/env src=2001:470:6d::xT1190 high
  19. 05 Nov 18:29 GET /actuator/health src=2001:470:6d::xT1190 high
  20. 05 Nov 18:28 GET /actuator/health src=2001:470:6d::xT1190 high
  21. 05 Nov 18:28 GET /config.json src=2001:470:6d::xT1552.001 high
  22. 05 Nov 18:28 GET /actuator/env src=2001:470:6d::xT1190 high
  23. 05 Nov 18:20 GET /favicon.png src=54.91.119.x
  24. 05 Nov 18:00 GET /wp-login.php src=156.59.26.xT1595.003 medium
  25. 05 Nov 17:17 GET /packages/barryvdh/elfinder/js/elfinder.min.js src=2400:6180::x
  26. 05 Nov 13:27 GET /wp-login.php src=103.152.103.xT1595.003 medium
  27. 05 Nov 13:00 GET /wp-login.php src=62.169.135.xT1595.003 medium
  28. 05 Nov 11:37 GET /wp-login.php src=2a09:bac1:b60::xT1595.003 medium
  29. 05 Nov 08:38 GET /wp-content/uploads/2019/11/kingssquare-300x300.png src=2602:ffe4:8::xT1595.003 medium
  30. 05 Nov 07:21 GET /wp-login.php src=162.128.181.xT1595.003 medium
  31. 05 Nov 06:10 GET /sitemap/ src=84.17.35.x
  32. 05 Nov 06:10 GET /llms.txt src=84.17.35.x
  33. 05 Nov 06:10 GET /sitemap.xml src=84.17.35.x
  34. 05 Nov 06:10 GET /sitemap_index.xml src=84.17.35.x
  35. 05 Nov 04:57 GET /wp-login.php src=2a09:bac5:49c::xT1595.003 medium
  36. 05 Nov 04:46 GET /shop/wp-admin/install.php src=170.64.191.xT1595.003 medium
  37. 05 Nov 04:46 GET /oldsite/wp-admin/install.php src=170.64.191.xT1595.003 medium
  38. 05 Nov 04:46 GET /site/wp-admin/install.php src=170.64.191.xT1595.003 medium
  39. 05 Nov 04:46 GET /web/wp-admin/install.php src=170.64.191.xT1595.003 medium
  40. 05 Nov 04:46 GET /backup/wp-admin/install.php src=170.64.191.xT1595.003 medium
  41. 05 Nov 21:36 GET /actuator/env src=2001:470:6d::xT1190 high
  42. 05 Nov 21:36 GET /config.json src=2001:470:6d::xT1552.001 high
  43. 05 Nov 21:36 GET /actuator/health src=2001:470:6d::xT1190 high
  44. 05 Nov 21:35 GET /actuator/env src=2001:470:6d::xT1190 high
  45. 05 Nov 21:35 GET /config.json src=2001:470:6d::xT1552.001 high
  46. 05 Nov 21:35 GET /actuator/health src=2001:470:6d::xT1190 high
  47. 05 Nov 21:34 GET /config.json src=2001:470:6d::xT1552.001 high
  48. 05 Nov 21:34 GET /actuator/health src=2001:470:6d::xT1190 high
  49. 05 Nov 21:34 GET /actuator/env src=2001:470:6d::xT1190 high
  50. 05 Nov 21:34 GET /actuator/env src=2001:470:6d::xT1190 high
  51. 05 Nov 21:34 GET /actuator/health src=2001:470:6d::xT1190 high
  52. 05 Nov 21:34 GET /config.json src=2001:470:6d::xT1552.001 high
  53. 05 Nov 21:33 GET /actuator/env src=2001:470:6d::xT1190 high
  54. 05 Nov 21:33 GET /actuator/health src=2001:470:6d::xT1190 high
  55. 05 Nov 21:33 GET /config.json src=2001:470:6d::xT1552.001 high
  56. 05 Nov 19:03 GET /wp-login.php src=103.125.146.xT1595.003 medium
  57. 05 Nov 18:29 GET /config.json src=2001:470:6d::xT1552.001 high
  58. 05 Nov 18:29 GET /actuator/env src=2001:470:6d::xT1190 high
  59. 05 Nov 18:29 GET /actuator/health src=2001:470:6d::xT1190 high
  60. 05 Nov 18:28 GET /actuator/health src=2001:470:6d::xT1190 high
  61. 05 Nov 18:28 GET /config.json src=2001:470:6d::xT1552.001 high
  62. 05 Nov 18:28 GET /actuator/env src=2001:470:6d::xT1190 high
  63. 05 Nov 18:20 GET /favicon.png src=54.91.119.x
  64. 05 Nov 18:00 GET /wp-login.php src=156.59.26.xT1595.003 medium
  65. 05 Nov 17:17 GET /packages/barryvdh/elfinder/js/elfinder.min.js src=2400:6180::x
  66. 05 Nov 13:27 GET /wp-login.php src=103.152.103.xT1595.003 medium
  67. 05 Nov 13:00 GET /wp-login.php src=62.169.135.xT1595.003 medium
  68. 05 Nov 11:37 GET /wp-login.php src=2a09:bac1:b60::xT1595.003 medium
  69. 05 Nov 08:38 GET /wp-content/uploads/2019/11/kingssquare-300x300.png src=2602:ffe4:8::xT1595.003 medium
  70. 05 Nov 07:21 GET /wp-login.php src=162.128.181.xT1595.003 medium
  71. 05 Nov 06:10 GET /sitemap/ src=84.17.35.x
  72. 05 Nov 06:10 GET /llms.txt src=84.17.35.x
  73. 05 Nov 06:10 GET /sitemap.xml src=84.17.35.x
  74. 05 Nov 06:10 GET /sitemap_index.xml src=84.17.35.x
  75. 05 Nov 04:57 GET /wp-login.php src=2a09:bac5:49c::xT1595.003 medium
  76. 05 Nov 04:46 GET /shop/wp-admin/install.php src=170.64.191.xT1595.003 medium
  77. 05 Nov 04:46 GET /oldsite/wp-admin/install.php src=170.64.191.xT1595.003 medium
  78. 05 Nov 04:46 GET /site/wp-admin/install.php src=170.64.191.xT1595.003 medium
  79. 05 Nov 04:46 GET /web/wp-admin/install.php src=170.64.191.xT1595.003 medium
  80. 05 Nov 04:46 GET /backup/wp-admin/install.php src=170.64.191.xT1595.003 medium
Real requests for paths that don't exist here that got past the CDN firewall, last 24 hours. 138 flagged by these rules, from 105 sources. IPs truncated, deleted after 7 days. See this week's report.

Coverage

What I work on, mapped the way a detection team maps its own coverage.

Data

Databricks and Delta Lake PySpark and SQL Schema normalisation (ECS) AWS serverless pipelines

Detect

Detection-as-code Testing rules on live data Evidence-based tuning MITRE ATT&CK and threat hunting

Insider risk

Behavioural analytics User risk scoring Triage and case management AI-assisted triage

Ship

CI/CD with GitHub Actions AI-assisted engineering Python, FastAPI and React Terraform

Daily work Regular use

How I build detections

Work

  1. Lead Technical Engineer, Insider Threat, Yahoo

    I lead engineering for the insider threat program in the Paranoids, Yahoo's security team. I designed and built the program's detection, risk-scoring and triage platform from scratch, and it's in daily use. I also brought AI into the team's work, from AI-assisted triage to how we write and review code.

  2. Detection Engineer, Yahoo

    I became the largest single author of new detections on the team, across endpoint, identity, cloud and email. I built the CI that tests every rule change against real data before it ships.

  3. Security Data Engineer, Yahoo

    Main engineer on the pipeline that brings security telemetry into one normalised data lake. Much of the team's detection work still runs on that data.

  4. Freelance developer

    Websites and IT for small Irish businesses, including running the whole IT stack for a phone-repair retailer.

Research and education

The IoT risk landscape and threat mitigation techniques

My M.Sc. thesis. I built an isolated sandbox, recruited simulated factory-configured IoT devices into a working Mirai botnet and captured its attacks. I then compared three ways of defending against it and built IoT-Hawk, a Python tool that finds vulnerable devices on a network and hardens them. After one run, none of the devices could be reinfected.

Read the thesis PDF, 113 pages, 2.8 MB

I also give careers talks to students thinking about a path into security.

Get in touch

shanemcc94@gmail.com

Or find me on LinkedIn. Found a problem with this site? The disclosure contact is in security.txt.