OffSec CTF: ProtoVault BreachThe challenge provides a zip file. Download & Extract it with the PSW: BloodBreathSoulFire it gives us the project folders. You’ve been tasked with tracing the origin of the breach and uncovering the vulnerability before the anonymous adversary can...Oct 10, 2025 · 6 min readeddie-pena.com
PlaceholderI have to rethink how I’ll approach this series using Sysmon and PowerShell queries as I was hoping to use some scripts I gathered from my OffSec labs. Sadly, after reading their ToS, I found out they do not allow the posting, sharing, or external us...Sep 16, 2025 · 1 min readeddie-pena.com
Tuning Sentinel Analytic Rules: Malicious IP Signon AttemptToday’s analytic rule had be second guessing myself. For starters, I believe this was a custom rule slapped together by one of the junior analyst. The rule logic is as follows: SigninLogs | where ResultsDescription contains "Sign-in was blocked becau...Sep 16, 2025 · 3 min readeddie-pena.com
How to use Watchlists in Microsoft SentinelIn yesterday’s article, I went over how to create an allow list in a Sentinel Analytics query to exclude benign files. In that article, I hinted that a better solution was to create a watchlist in Sentinel to use as an allow list of safe files to avo...Sep 11, 2025 · 2 min readeddie-pena.com
OffSec Linux System Administrator Skill PathAlbert Einstein once said "The more I learn, the more I realize how much I don't know". As much as I'd rather be sharing a new credential/certification, I'm very happy to report that I've been hard at work to fill in some knowledge gaps. While I find...Sep 8, 2025 · 3 min readeddie-pena.com
