Vvictor nkereuwem4d ago · 2 min readPort Security Rules The Rule of Least Exposure When configuring network firewalls or assessing endpoint risk, one principle holds true: if a service isn't meant for public consumption, it shouldn't be publicly reachable.1iameskor.hashnode.dev
RrathsaraSep 21 · 17 min readNetwork Data Hiding: Covert Channels and Traffic ManipulationConsider a packet capture from a corporate network segment: 23 DNS queries in 21 seconds. Nothing about that number is alarming; DNS is background noise on any live network. Two of those queries are wrr-cyber.hashnode.dev
RrathsaraSep 18 · 13 min readGNU/Linux: Where Data Hides and How It's FoundA filesystem can tell an investigator that everything is consistent while still leaving data outside the paths that ordinary tools inspect. Hidden filenames are the easy case. More interesting cases irr-cyber.hashnode.dev
RrathsaraSep 18 · 15 min readWindows: Where Data Hides and How It's FoundA file called Secret.exe reports 25 bytes on disk. Nothing in Explorer, nothing in a standard dir listing, and nothing in Task Manager disagrees with that number. Run dir /r instead of dir, and the sarr-cyber.hashnode.dev
JJebitokSep 9 · 2 min readResponse and Recovery (TryHackMe)Link to the challenge on TryHackMe: Response and Recovery Introduction Response and Recovery picks up where Detection and Analysis left off: the investigation into the compromised l.chen@nexusfinanciasharonjebitok.com
JJebitokSep 9 · 2 min readPost-Incident Activity (TryHackMe)Link to the challenge on TryHackMe: Post-Incident Activity Introduction Post-Incident Activity closes out the Nexus Financial BEC investigation series, shifting from "what happened during the incidentsharonjebitok.com
RrathsaraSep 3 · 11 min readWindows Memory Forensics: Finding a Live Infection with VolatilityPID 1484 had been running since boot. Nothing about that was unusual: it was Explorer.exe, the process every Windows machine on earth is running right now. What was unusual was the process hanging offrr-cyber.hashnode.dev
RrathsaraSep 3 · 9 min readGNU/Linux Memory Forensics: Is the Compromise Still Live?It's easy to think of memory forensics purely as a hunt for something malicious. On this case, a GNU/Linux server that had already been through a full attack chain, initial access, privilege escalatiorr-cyber.hashnode.dev
MMageshAug 24 · 6 min readAPIWizards Breach-Tryhackme WalkthroughLink to the room https://tryhackme.com/room/apiwizardsbreach Task 1:Preparation You were hired as a dedicated external DFIR specialist to help the APIWizards Inc. company with a security incident in t0xog.hashnode.dev
RrathsaraAug 15 · 10 min readWhat We Got: From Cloud Security Platform to Operational CapabilityA few months after the operationalizing work covered in the last article, it stopped being a project. It became part of how we worked. This article is about what changed once that happened. The Metrirr-cyber.hashnode.dev
