--- title: "#blue-team articles | Hashnode" description: "Explore 27 articles tagged #blue-team on Hashnode. Tutorials, guides, and how-tos from the community." url: "https://hashnode.com/tag/blue-team" --- Tag # #blue-team 27 posts · 28 followers [Matin Ghorbani](https://hashnode.com/@matin-ghorbani) · [3d ago](https://hashnode.com/posts/attack-based-vs-data-based-threat-hunting/6af14d766ce2dd689d52b446) ### [Attack-Based vs Data-Based Threat Hunting: Two Ways to Start](https://matin-ghorbani.hashnode.dev/attack-based-vs-data-based-threat-hunting?utm_source=hashnode&utm_medium=feed) Study notes on two threat hunting approaches: starting from an attack (ABH) or from a data source (DBH), with Windows Event ID examples. 6 min read · [matin-ghorbani.hashnode.dev](https://matin-ghorbani.hashnode.dev/attack-based-vs-data-based-threat-hunting?utm_source=hashnode&utm_medium=feed) [TH](https://hashnode.com/@H4p00n) · [Oct 30](https://hashnode.com/posts/not-so-common-common-sense-security-adcs-esc8/6ae4dc81505307b14a02388f) ### [Not-So-Common, Common-Sense Security: ADCS ESC8](https://operationally-insecure.hashnode.dev/not-so-common-common-sense-security-adcs-esc8?utm_source=hashnode&utm_medium=feed) ⚠️ Legal & Ethical Disclaimer The information presented in this post is provided for educational and informational purposes only. All techniques, tools, and examples discussed are intended to be used 11 min read · [operationally-insecure.hashnode.dev](https://operationally-insecure.hashnode.dev/not-so-common-common-sense-security-adcs-esc8?utm_source=hashnode&utm_medium=feed) [Yash Gulati](https://hashnode.com/@yashgulatii) · [Oct 29](https://hashnode.com/posts/post-0-intro/6ae321c406652e3301f77c08) ### [Chakravyuha: I'm Building a Purple Team AD Lab - Here's the Plan](https://yashgulatii.hashnode.dev/post-0-intro?utm_source=hashnode&utm_medium=feed) I've spent years building things - applications, websites, personal projects - but always from the builder's side. Make it work, ship it, move on. Security was never part of how I thought about those 7 min read · [yashgulatii.hashnode.dev](https://yashgulatii.hashnode.dev/post-0-intro?utm_source=hashnode&utm_medium=feed) [Zero Trust Threads](https://hashnode.com/@zerotrustthreads) · [Sep 7](https://hashnode.com/posts/what-are-logs-cybersecurity-beginners/6a9f063ae124a9e84f260450) ### [What Are Logs, and Why Do Security Teams Care About Them?](https://zerotrustthreads.hashnode.dev/what-are-logs-cybersecurity-beginners?utm_source=hashnode&utm_medium=feed) Learn what computer logs are, where they come from, how security teams use them, and why logging is essential to defensive cybersecurity. 5 min read · [zerotrustthreads.hashnode.dev](https://zerotrustthreads.hashnode.dev/what-are-logs-cybersecurity-beginners?utm_source=hashnode&utm_medium=feed) [Abdulmujeeb Uthman](https://hashnode.com/@devwithmujeeb) · [Sep 7](https://hashnode.com/posts/how-we-built-a-centralized-security-monitoring-environment-for-a-healthcare-supply-chain-company/6a9e0bca608cd851389554fd) ### [How We Built a Centralized Security Monitoring Environment for a Healthcare Supply Chain Company](https://devwithmujeeb.hashnode.dev/how-we-built-a-centralized-security-monitoring-environment-for-a-healthcare-supply-chain-company?utm_source=hashnode&utm_medium=feed) Building a real security operations environment from scratch using Wazuh, AWS, and Azure 5 min read · [devwithmujeeb.hashnode.dev](https://devwithmujeeb.hashnode.dev/how-we-built-a-centralized-security-monitoring-environment-for-a-healthcare-supply-chain-company?utm_source=hashnode&utm_medium=feed) [Kajal Dhanjal](https://hashnode.com/@kajalbuilds) · [Aug 18](https://hashnode.com/posts/anatomy-of-an-identity-compromise/6a8435894bf6c7f3da41b104) ### [Anatomy of an identity compromise](https://kajalbuilds.hashnode.dev/anatomy-of-an-identity-compromise?utm_source=hashnode&utm_medium=feed) A login-only intrusion, step by step, and where the detection actually lives 12 min read · [kajalbuilds.hashnode.dev](https://kajalbuilds.hashnode.dev/anatomy-of-an-identity-compromise?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Aug 10](https://hashnode.com/posts/tryhackme-overflow-the-jackpot-writeup/6a794fea8a2cc2d5fef1993b) ### [TryHackMe : Overflow The Jackpot writeup](https://exploitnotes.hashnode.dev/tryhackme-overflow-the-jackpot-writeup?utm_source=hashnode&utm_medium=feed) Complete TryHackMe Overflow The Jackpot walkthrough covering crypto, web, forensics, detection engineering, malware analysis, and boot2root. coverage. 35 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/tryhackme-overflow-the-jackpot-writeup?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Aug 8](https://hashnode.com/posts/tryhackme-after-hours-writeup/6a76a02b3f6d8c8758516242) ### [TryHackMe : After Hours Writeup](https://exploitnotes.hashnode.dev/tryhackme-after-hours-writeup?utm_source=hashnode&utm_medium=feed) Complete TryHackMe WMI CIM repository forensics walkthrough covering WMI persistence, PowerShell, raw DEFLATE, .NET payloads, and flag recovery layer 9 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/tryhackme-after-hours-writeup?utm_source=hashnode&utm_medium=feed) [Kajal Dhanjal](https://hashnode.com/@kajalbuilds) · [Aug 5](https://hashnode.com/posts/what-your-logs-can-t-see/6a730b75b39665a1df5f6f78) ### [What your logs can't see](https://kajalbuilds.hashnode.dev/what-your-logs-can-t-see?utm_source=hashnode&utm_medium=feed) Nine common sources and the gaps they carry by design 9 min read · [kajalbuilds.hashnode.dev](https://kajalbuilds.hashnode.dev/what-your-logs-can-t-see?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Aug 4](https://hashnode.com/posts/tryhackme-packed-light-writeup/6a7165161ce7b8c122d6bcfa) ### [TryHackMe : Packed Light Writeup](https://exploitnotes.hashnode.dev/tryhackme-packed-light-writeup?utm_source=hashnode&utm_medium=feed) Complete Packed Light THM walkthrough covering PCAP analysis, malware investigation, network forensics, traffic decoding, and flag recovery. 6 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/tryhackme-packed-light-writeup?utm_source=hashnode&utm_medium=feed)