--- title: "Edward Pena (@Cryptosrage) | Hashnode" description: "Security Engineer by day, Security Researcher by night. Read the latest articles by Edward Pena on Hashnode." url: "https://hashnode.com/@Cryptosrage" --- @Cryptosrage # Edward Pena @Cryptosrage · Joined September 2025 Security Engineer by day, Security Researcher by night [Website](https://eddie-pena.com/) ### [OffSec CTF: ProtoVault Breach](https://eddie-pena.com/offsec-ctf-protovault-breach?utm_source=hashnode&utm_medium=feed) The challenge provides a zip file. Download & Extract it with the PSW: BloodBreathSoulFire it gives us the project folders. You’ve been tasked with tracing the origin of the breach and uncovering the vulnerability before the anonymous adversary can... 6 min read · [eddie-pena.com](https://eddie-pena.com/offsec-ctf-protovault-breach?utm_source=hashnode&utm_medium=feed) [Oct 10, 2025](https://hashnode.com/posts/offsec-ctf-protovault-breach/68e910967efa52d454092b93) ### [Placeholder](https://eddie-pena.com/placeholder?utm_source=hashnode&utm_medium=feed) I have to rethink how I’ll approach this series using Sysmon and PowerShell queries as I was hoping to use some scripts I gathered from my OffSec labs. Sadly, after reading their ToS, I found out they do not allow the posting, sharing, or external us... 1 min read · [eddie-pena.com](https://eddie-pena.com/placeholder?utm_source=hashnode&utm_medium=feed) [Sep 16, 2025](https://hashnode.com/posts/placeholder/68c8de6d003a06d8f94dabc0) ### [Tuning Sentinel Analytic Rules: Malicious IP Signon Attempt](https://eddie-pena.com/tuning-sentinel-analytic-rules-malicious-ip-signon-attempt?utm_source=hashnode&utm_medium=feed) Today’s analytic rule had be second guessing myself. For starters, I believe this was a custom rule slapped together by one of the junior analyst. The rule logic is as follows: SigninLogs | where ResultsDescription contains "Sign-in was blocked becau... 3 min read · [eddie-pena.com](https://eddie-pena.com/tuning-sentinel-analytic-rules-malicious-ip-signon-attempt?utm_source=hashnode&utm_medium=feed) [Sep 16, 2025](https://hashnode.com/posts/tuning-sentinel-analytic-rules-malicious-ip-signon-attempt/68c8dd26426f31f128be0deb) ### [How to use Watchlists in Microsoft Sentinel](https://eddie-pena.com/how-to-use-watchlists-in-microsoft-sentinel?utm_source=hashnode&utm_medium=feed) In yesterday’s article, I went over how to create an allow list in a Sentinel Analytics query to exclude benign files. In that article, I hinted that a better solution was to create a watchlist in Sentinel to use as an allow list of safe files to avo... 2 min read · [eddie-pena.com](https://eddie-pena.com/how-to-use-watchlists-in-microsoft-sentinel?utm_source=hashnode&utm_medium=feed) [Sep 11, 2025](https://hashnode.com/posts/how-to-use-watchlists-in-microsoft-sentinel/68c23d40a1872eee7b6c038c) ### [OffSec Linux System Administrator Skill Path](https://eddie-pena.com/offsec-linux-system-administrator-skill-path?utm_source=hashnode&utm_medium=feed) Albert Einstein once said "The more I learn, the more I realize how much I don't know". As much as I'd rather be sharing a new credential/certification, I'm very happy to report that I've been hard at work to fill in some knowledge gaps. While I find... 3 min read · [eddie-pena.com](https://eddie-pena.com/offsec-linux-system-administrator-skill-path?utm_source=hashnode&utm_medium=feed) [Sep 8, 2025](https://hashnode.com/posts/offsec-linux-system-administrator-skill-path/68bf340774fbb1b8422b5094)