Security

GOAD writeups I’ve seen are outdated and several commands no longer work on current Kali builds. This post provides working, tested command examples that align with the latest tool versions and typical GOAD lab topologies. All examples were validated in a fresh Kali install. 1. Initial Network and Service Enumeration Read more

When it comes to automated vulnerability scanning, Nuclei is one of the best open source tools out there. It’s fast, flexible, and extensible with thousands of community templates. Masscan is like nmap on steroids. We’ll use it to enumerate HTTP, SSH, RDP, Active Directory, and SMB services, then feed those Read more

In the CISSP world, understanding Security and Risk Management is like building a solid foundation for a house. It supports everything else you do in cybersecurity. This domain forms the core of the CISSP Common Body of Knowledge (CBK) and is crucial for both passing the exam and excelling in Read more

T-Pot is an open-source honeypot framework designed to emulate multiple attack surfaces and gather data on malicious activities. This blog post walks through the installation process on an Ubuntu 20.04 server, and demonstrates how to test its capabilities. Setting Up T-Pot System Requirements Installation Steps Follow the official installation steps Read more

I’ve been running Cuckoo since it came out in 2011. The original project is no longer maintained, but the folks at CERT-EE have released Cuckoo3. Setting up Cuckoo has never been easy for me, but they’ve made it a breeze. By the end of this guide, you’ll have a fully Read more

Introduction As more organizations move to cloud environments, incident handling in platforms like AWS has become essential for SOC operations. This post will cover strategies for managing incidents in cloud environments, specifically AWS, and wrap up with comprehensive malware analysis techniques that apply across both on premise and cloud systems. Read more

Introduction One of the goals for incident response is not just stopping an attack but making sure attackers can’t get back in. Attackers often use persistence techniques to maintain access, setting up mechanisms that survive reboots or system updates. Powershell has also become a common vector for threats, especially for Read more

Introduction In a SOC environment, specialized incident handling skills are essential for managing complex attack types like phishing, malware, and network based intrusions. This post dives into practical approaches for handling phishing attempts, investigating malware alerts, and using network forensics to support incident response. Mastering these techniques enables SOC analysts Read more

Introduction For a SOC, using structured frameworks like MITRE ATT&CK enhances incident detection and provides a clear methodology for tracking and understanding adversarial behavior. This post will cover the basics of operationalizing MITRE ATT&CK in a SOC environment and handling high severity incidents (SEV0). We’ll explore how MITRE ATT&CK improves Read more

Introduction A well architected SIEM is one of the most valuable tools in a SOC, central to both detecting and responding to security incidents. This post will cover the essentials of setting up and configuring a SIEM, then move into effective log analysis techniques. For new analysts, this overview provides Read more

Introduction Starting out in a SOC requires a mix of technical and practical skills to handle a range of security incidents effectively. This post covers essential skills for SOC analysts, introduces core SOC playbooks, and explores basic automation within AWS environments. If you’re a new analyst, this guide will help Read more

Introduction In incident response, following a structured approach is fundamental to maintaining clarity, control, and precision. This post covers the essential concepts in incident handling, breaking down the life cycle stages and key operations within a SOC. Using NIST 800-61 as the primary guide, I’ll walk through the basics of Read more

The goal of detection engineering isn’t just to identify potential threats but to take meaningful action based on those findings. After documenting and analyzing your results, it is time to determine which findings require escalation, how to initiate an effective response, and how to use what you’ve learned to continuously Read more

As you analyze and interpret detection results, effective documentation becomes essential. Documentation provides a clear record of what has been observed, what steps have been taken, and where the investigation is headed. In this post, we’ll discuss how to document findings, organize investigation steps, and expand the investigation by connecting Read more