Tag feed

#blueteam

215 posts22 followers

Explore Hashnode

Alternatives

Trending tags this week

LVLong Volongvh0904.hashnode.dev19h ago · 22 min read

Investigation Diary: HTB — Brutus

Introduction "Logs never lie. They just sit quietly, waiting for someone who knows the right question to ask." Brutus is a Very Easy Sherlock on HackTheBox, built around two artifacts every Linux in

0

JJJeji Jamesjeji-james.hashnode.dev4d ago · 2 min read

Linux Log Fortress — Access Control & Threat Pattern Detection

In a real SOC environment, a log file is forensic evidence. Before you can analyze it, you need to protect it. This lab walks through the full workflow from locking down file permissions to hunting fo

0

TSTech Skill Schooltechskillschool.hashnode.dev5d ago · 9 min read

Splunk vs Microsoft Sentinel vs IBM QRadar: Which SIEM Should You Learn First?

In today’s hyper-connected digital landscape, organizations generate enormous volumes of security data every second from firewalls and endpoints to cloud workloads and applications. Security Informati

0

RMRodrigo Martinez Nuñezcyberdefenseprocess.hashnode.dev6d ago · 3 min read

Detecting brute force attacks with Splunk

Note: The dataset used is fictional Introduction When a malicious actor wants to log in to a user account, usually they use a password dictionary, and try to log in with each password. In this article

0

JJJeji Jamesjeji-james.hashnode.dev5d ago · 7 min read

Linux Basics Every SOC Analyst Must Know

Introduction Every SOC analyst lives in the terminal. Before you can hunt threats, analyse logs, or respond to incidents — you need to be fluent in the command line. This post documents my hands-on La

0

LBLuis Balderalbcyberdefense.hashnode.devJul 6 · 1 min read

Detect AD Attacks with Wazuh

Sysmon logs Source: https://wazuh.com/blog/how-to-detect-active-directory-attacks-with-wazuh-part-2/ # Deployment Guide: Sysmon & Wazuh Integration 1. Preparation Download Sysmon: Sysinternals Sysmon

0

KDKajal Dhanjalkajalbuilds.hashnode.devJun 30 · 4 min read

Building a Sentinel Detection Lab, Part 6: Shadow AI and the Detection That's Honest About What It Hasn't Proven Yet

Repo: github.com/Kajal-Dhanjal/sentinel-detection-lab Five detections in, every one of them pointed at a fairly traditional attacker: brute force, malicious PowerShell, registry persistence, recon, an

0

KDKajal Dhanjalkajalbuilds.hashnode.devJun 30 · 4 min read

Building a Sentinel Detection Lab, Part 7: The Detection That Taught Me My Own Telemetry's Blind Spot

Repo: github.com/Kajal-Dhanjal/sentinel-detection-lab Part 6 caught AI tooling launching. The natural next question was what happens once it's running—specifically, where does it talk to? This is the

0

KDKajal Dhanjalkajalbuilds.hashnode.devJun 30 · 4 min read

Building a Sentinel Detection Lab, Part 8: Watching for Agents, Not Just Attackers

Repo: github.com/Kajal-Dhanjal/sentinel-detection-lab Most process-lineage detections in SOC content are written to catch attackers—Office spawning PowerShell, a browser spawning cmd.exe. Part 8 is th

0

JJJeji Jamesjeji-james.hashnode.devJun 27 · 9 min read

Digital Forensic Investigation Using Windows Security Event Logs

Introduction In cybersecurity, knowing how to investigate a compromised system is just as important as knowing how to defend one. Digital forensics is the process of collecting, preserving, and analys

0

#blueteam

Search Hashnode

#blueteam

Explore Hashnode

Trending tags this week

Investigation Diary: HTB — Brutus

Linux Log Fortress — Access Control & Threat Pattern Detection

Splunk vs Microsoft Sentinel vs IBM QRadar: Which SIEM Should You Learn First?

Detecting brute force attacks with Splunk

Linux Basics Every SOC Analyst Must Know

Detect AD Attacks with Wazuh

Building a Sentinel Detection Lab, Part 6: Shadow AI and the Detection That's Honest About What It Hasn't Proven Yet

Building a Sentinel Detection Lab, Part 7: The Detection That Taught Me My Own Telemetry's Blind Spot

Building a Sentinel Detection Lab, Part 8: Watching for Agents, Not Just Attackers

Digital Forensic Investigation Using Windows Security Event Logs