OffSec CTF: ProtoVault BreachThe challenge provides a zip file. Download & Extract it with the PSW: BloodBreathSoulFire it gives us the project folders. You’ve been tasked with tracing the origin of the breach and uncovering the vulnerability before the anonymous adversary can...6 min read·eddie-pena.comOct 10, 2025
PlaceholderI have to rethink how I’ll approach this series using Sysmon and PowerShell queries as I was hoping to use some scripts I gathered from my OffSec labs. Sadly, after reading their ToS, I found out they do not allow the posting, sharing, or external us...1 min read·eddie-pena.comSep 16, 2025
Tuning Sentinel Analytic Rules: Malicious IP Signon AttemptToday’s analytic rule had be second guessing myself. For starters, I believe this was a custom rule slapped together by one of the junior analyst. The rule logic is as follows: SigninLogs | where ResultsDescription contains "Sign-in was blocked becau...3 min read·eddie-pena.comSep 16, 2025
How to use Watchlists in Microsoft SentinelIn yesterday’s article, I went over how to create an allow list in a Sentinel Analytics query to exclude benign files. In that article, I hinted that a better solution was to create a watchlist in Sentinel to use as an allow list of safe files to avo...2 min read·eddie-pena.comSep 11, 2025
OffSec Linux System Administrator Skill PathAlbert Einstein once said "The more I learn, the more I realize how much I don't know". As much as I'd rather be sharing a new credential/certification, I'm very happy to report that I've been hard at work to fill in some knowledge gaps. While I find...3 min read·eddie-pena.comSep 8, 2025
