Stopping a ClickFix attack before it executed

A user at a fuel-transport company was walked through a fake "verify you are human" prompt designed to get them to paste a malicious command into Windows.

• Isolated the endpoint and pulled EDR, DNS and firewall telemetry
• Confirmed the network layer blocked the payload download
• Checked for persistence, reset credentials, coached the user

• No compromise. The payload never executed, and the endpoint was cleared to return to service.

• EDR
• FortiGate
• DNS filtering
• Incident response

Five-location move off on-prem file servers

A multi-location dental specialty practice relied on an aging server and Windows Sync Center to share files, with all the conflicts and fragility that comes with it.

• Assessed the current environment at all five sites
• Designed a path to Entra ID join and OneDrive Known Folder Move
• Wrote a plain-language plan the practice owner could approve

• A phased migration roadmap to retire the server dependency and put files in the cloud where they belong.

• Entra ID
• OneDrive KFM
• Microsoft 365

Fixing bounced mail across several client domains

After GoDaddy-to-Microsoft 365 migrations, multiple clients started seeing 550 5.7.1 rejections. Separately, a dealership on Google Workspace was hard-bouncing to Yahoo.

• Traced rejections to stale Proofpoint Essentials records left behind by the migrations
• Cleaned up MX, SPF and connectors per tenant
• Rebuilt DKIM signing on Google Workspace and verified DMARC alignment

• Mail flow restored for the affected domains, and a known pattern to check for on every future migration.

• Exchange Online
• Google Workspace
• SPF / DKIM / DMARC
• DNS

Security audit against three frameworks at once

A regulated gaming operation needed its IT controls measured against industry rules, a national cybersecurity framework and card-data requirements.

• Mapped controls across NIGC MICS (25 CFR 543), NIST CSF 2.0 and PCI DSS v4.0.1
• Ran assessments and evidence collection in Compliance Manager GRC
• Turned findings into a prioritized remediation list

• A clear picture of gaps, ranked by risk, that leadership could actually act on.

• NIST CSF 2.0
• PCI DSS 4.0.1
• NIGC MICS
• RapidFire Tools

Silent runtime deployment at scale

Line-of-business apps kept failing on machines missing .NET Framework 4.8 or Visual C++ runtimes, and nobody could see which endpoints were affected.

• Built Datto RMM components for silent .NET 4.8 and VC++ Redistributable installs
• Wrote status back to user-defined fields for fleet-wide visibility

• One click to remediate, and a dashboard view of what is installed where.

• Datto RMM
• PowerShell
• UDF reporting

Finding the real cause, not the obvious one

A string of tickets that looked like software problems: recurring blue screens and a firewall that kept dropping.

• Traced a 0x139 BSOD to an EDR kernel filter driver colliding with scheduled scans
• Linked another BSOD to a failed Intel driver update corrupting the CSME stack
• Read FortiGate logs to prove a power delivery fault, not a firmware bug

• Fixes that stuck, instead of reimaging and hoping.

• Crash dump analysis
• Event logs
• FortiOS
• Hardware diagnostics

Brandon Auction

A full rebuild of an auction company website on WordPress and Avada, staged privately while the old site stays live, with clean hand-offs to the third-party bidding platform.

• WordPress
• Avada
• SiteGround

District99-FIB & Nexus

Two sites built on a shared codebase. I keep the common core in sync across both so features and fixes ship once instead of twice.

• GitHub
• Shared codebase
• Git

daltonsweet.com

Rebuilt on the Leven theme with a custom design layer: dark glass panels, a grid backdrop, monospace accents and hand-written components for these case studies.

• WordPress
• Custom CSS
• HTML