---
title: "Ciaran Doherty, AfCIIS, MBCS (@cdoherty) | Hashnode"
description: "Cyber Security Analyst. Read the latest articles by Ciaran Doherty, AfCIIS, MBCS on Hashnode."
url: "https://hashnode.com/@cdoherty"
---

@cdoherty

# Ciaran Doherty, AfCIIS, MBCS

@cdoherty · United Kingdom · Joined April 2025

Cyber Security Analyst

### [Immich Deployment on Windows Server Using Docker, WSL, and SMB-Based Persistent Storage](https://blog.cdoherty.co.uk/immich-deployment-on-windows-server-using-docker-wsl-and-smb-based-persistent-storage?utm_source=hashnode&utm_medium=feed)

Designing a Resilient Linux Application Stack on Windows Infrastructure.

15 min read · [blog.cdoherty.co.uk](https://blog.cdoherty.co.uk/immich-deployment-on-windows-server-using-docker-wsl-and-smb-based-persistent-storage?utm_source=hashnode&utm_medium=feed)

[Feb 22](https://hashnode.com/posts/immich-deployment-on-windows-server-using-docker-wsl-and-smb-based-persistent-storage/699aeac5e25d1517a5f9b4cd)

### [ClickFix Forensics: Proving Execution Beyond the Browser](https://blog.cdoherty.co.uk/clickfix-forensics-proving-execution-beyond-the-browser?utm_source=hashnode&utm_medium=feed)

A deep dive on ClickFix, mapping fake CAPTCHA lures to endpoint code execution, covering investigation, response, and preventative controls.

7 min read · [blog.cdoherty.co.uk](https://blog.cdoherty.co.uk/clickfix-forensics-proving-execution-beyond-the-browser?utm_source=hashnode&utm_medium=feed)

[Dec 21, 2025](https://hashnode.com/posts/clickfix-forensics-proving-execution-beyond-the-browser/69484e02087981473e04b3f6)

### [LAPS: The Local Administrator Password Solution For Windows Devices In Entra ID.](https://blog.cdoherty.co.uk/laps-the-local-administrator-password-solution-for-windows-devices-in-entra-id?utm_source=hashnode&utm_medium=feed)

Overview. Prerequisites. Join types. LAPS is only supported on: Microsoft Entra joined devices. Microsoft Entra hybrid joined devices. Microsoft Entra registered devices are not supported. License requirements. LAPS is available to all customers ...

2 min read · [blog.cdoherty.co.uk](https://blog.cdoherty.co.uk/laps-the-local-administrator-password-solution-for-windows-devices-in-entra-id?utm_source=hashnode&utm_medium=feed)

[Nov 30, 2025](https://hashnode.com/posts/laps-the-local-administrator-password-solution-for-windows-devices-in-entra-id/692c8f9933f4d46ae49eaaf2)

### [Bypassing Microsoft Intune Compliant Device Conditional Access Requirements Using TokenSmith](https://blog.cdoherty.co.uk/bypassing-microsoft-intune-compliant-device-conditional-access-requirements-using-tokensmith?utm_source=hashnode&utm_medium=feed)

How adversaries exploit Intune’s Company Portal to obtain access tokens and bypass Microsoft’s compliant device conditional access controls.

1 min read · [blog.cdoherty.co.uk](https://blog.cdoherty.co.uk/bypassing-microsoft-intune-compliant-device-conditional-access-requirements-using-tokensmith?utm_source=hashnode&utm_medium=feed)

[Oct 18, 2025](https://hashnode.com/posts/bypassing-microsoft-intune-compliant-device-conditional-access-requirements-using-tokensmith/68f41f603642755c8a5b3aef)

### [How Adversaries Execute AiTM Phishing Campaigns (A Practical Demonstration Using Evilginx3)](https://blog.cdoherty.co.uk/how-adversaries-execute-aitm-phishing-campaigns-a-practical-demonstration-using-evilginx3?utm_source=hashnode&utm_medium=feed)

An in-depth look at proxy phishing and AiTM attacks, adversary operations and SOC detection, containment and prevention strategies.

1 min read · [blog.cdoherty.co.uk](https://blog.cdoherty.co.uk/how-adversaries-execute-aitm-phishing-campaigns-a-practical-demonstration-using-evilginx3?utm_source=hashnode&utm_medium=feed)

[Oct 18, 2025](https://hashnode.com/posts/how-adversaries-execute-aitm-phishing-campaigns-a-practical-demonstration-using-evilginx3/68f41e6335dde649d8ec0cae)