Malware Analysis FundamentalsWhen a hash hits VirusTotal with one detection out of seventy, that's not enough to call it malicious. When it hits zero, that's also not enough to call it clean. Malware analysis is the work that filJun 23 · 9 min readwoogi.me
Threat Hunting MethodologyMost security tools are reactive. Alerts fire after a rule matches, and analysts triage. Threat hunting flips that: you assume something has already evaded the tools, and you go look for it. This postJun 6 · 8 min readwoogi.me
Wireshark: Traffic Analysis for IRWhen a Snort alert fires or a NetFlow anomaly surfaces, the next question is always the same: what actually happened on the wire? Wireshark is the answer most blue teamers reach for. This post is a wo1May 25 · 8 min readwoogi.me
Network Security: IDS/IPS and SnortNetwork defense splits cleanly into two questions: what gets through the perimeter, and what do you do when something does? This post covers the second question. IDS, IPS, the detection techniques behMay 18 · 7 min readwoogi.me
From FIX Sessions to SIEM Alerts: A Pre-SOC Career on the Trading DeskI'm not a SOC analyst yet. I'm a Master of Cybersecurity student at RMIT, transitioning from a four-year career on a Korean securities trading desk where I owned the FIX-protocol connections to overseMay 16 · 9 min readwoogi.me
