Vvictor nkereuwem·Oct 18Port Security Rules Master core network port exposure rules (SSH, SMB, RDP, MySQL) and reconstruct Windows attack narratives using SHA-256, Event IDs, and Prefetch.2 min read·iameskor.hashnode.dev1
Rrathsara·Sep 21Network Data Hiding: Covert Channels and Traffic ManipulationFrom IP headers to DNS queries: how covert channels work and how their traffic patterns give them away17 min read·rr-cyber.hashnode.dev
Rrathsara·Sep 18Windows: Where Data Hides and How It's FoundA file reports 25 bytes. A different command reveals 19MB attached to it. Where NTFS actually hides data, and the exact commands that find it.15 min read·rr-cyber.hashnode.dev
Rrathsara·Sep 18GNU/Linux: Where Data Hides and How It's FoundA partition table entry reading "Hidden FAT16." An inode field nobody writes to. A nanosecond timestamp carrying encoded data. Where GNU/Linux hides evidence and how investigators find it.13 min read·rr-cyber.hashnode.dev
JJebitok·Sep 9Response and Recovery (TryHackMe)Link to the challenge on TryHackMe: Response and Recovery Introduction Response and Recovery picks up where Detection and Analysis left off: the investigation into the compromised l.chen@nexusfinancia2 min read·sharonjebitok.com
JJebitok·Sep 9Post-Incident Activity (TryHackMe)Link to the challenge on TryHackMe: Post-Incident Activity Introduction Post-Incident Activity closes out the Nexus Financial BEC investigation series, shifting from "what happened during the incident2 min read·sharonjebitok.com
Rrathsara·Sep 3Windows Memory Forensics: Finding a Live Infection with VolatilityTracing a live Windows infection through volatile memory, from a suspicious process to injected code, persistence, and attacker intent.11 min read·rr-cyber.hashnode.dev
Rrathsara·Sep 3GNU/Linux Memory Forensics: Is the Compromise Still Live?Following the evidence in memory to determine what survived after an attack9 min read·rr-cyber.hashnode.dev
MMagesh·Aug 24APIWizards Breach-Tryhackme WalkthroughInvestigate a security breach at APIWizards Inc.6 min read·0xog.hashnode.dev
Rrathsara·Aug 15What We Got: From Cloud Security Platform to Operational CapabilityThis is the fifth and final article in a series on deploying Prisma Cloud across a multi-cloud enterprise estate. It covers what the programme actually delivered a few months into steady-state operation: the metrics that mattered, what the platform caught that we would otherwise have missed, and the closing lesson the whole series has been building toward.10 min read·rr-cyber.hashnode.dev
