Tag feed

#socanalyst

15 posts4 followers

Explore Hashnode

Alternatives

Trending tags this week

00x8r41nr07braindump.0x8r41nr07.xyz4d ago · 5 min read

Every Break-In Has a Three-Act Structure

Part 8 of an ongoing series. Read Part 1 here. "You really need to study past attacks to know what to look for." I wrote that in my journal this week, halfway through Linux Security Monitoring, half-f

0

00x8r41nr07braindump.0x8r41nr07.xyz6d ago · 6 min read

I Used to Hunt Audiences. Now I Hunt Attackers.

Part 7 of an ongoing series. Start with part 1 here. It happened on a Tuesday, somewhere between a DNS tunneling exercise and my third cup of coffee. I was staring at a network log — VPN entries, fire

0

00x8r41nr07braindump.0x8r41nr07.xyzAug 23 · 3 min read

Where Things Stand (And Where They're Going)

Part 6 of an ongoing series. Start from Part 1 here. A year ago, June 2025, the MacBook Air arrived and everything felt alien. Here's what a year looks like: three certifications passed. Hundreds of h

0

TSTech Skill Schooltechskillschool.hashnode.devJul 8 · 9 min read

Splunk vs Microsoft Sentinel vs IBM QRadar: Which SIEM Should You Learn First?

In today’s hyper-connected digital landscape, organizations generate enormous volumes of security data every second from firewalls and endpoints to cloud workloads and applications. Security Informati

0

TSTech Skill Schooltechskillschool.hashnode.devJun 10 · 7 min read

Start Your SOC Journey with SOC Analyst Training 101

In today’s digital landscape, cyber threats are evolving at an unprecedented pace. From ransomware attacks targeting critical infrastructure to sophisticated phishing campaigns and advanced persistent

0

JJebitoksharonjebitok.comFeb 12 · 17 min read

AWS Security Logging (TryHackMe)

This write-up covers TryHackMe’s AWS Security Logging room, which focuses on monitoring AWS cloud environments using CloudTrail and GuardDuty. The challenge explores three key security areas: Control Plane monitoring, Managed Services, and Workload s...

0

RRridesh raju bijwerideshcyber.hashnode.devFeb 10 · 4 min read

SOC257 – VPN Connection Detected from Unauthorized Country (EventID:225)

Today we are going to investigate SOC257 – VPN Connection Detected from Unauthorized Country. Even though the severity of this alert is Low, it still has its own importance. The main challenge here is confirming whether the attacker actually gained a...

0

UBUmamaheswari Bbit01net.hashnode.devJan 16 · 3 min read

Snapped Phish-ing Line

Disclaimer Based on real-world occurrences and past analysis, this scenario presents a narrative with invented names, characters, and events. Please note: The phishing kit used in this scenario was retrieved from a real-world phishing campaign. Hence...

0

UBUmamaheswari Bbit01net.hashnode.devJan 12 · 4 min read

h4cked | Tryhackme Walkthrough

Task 1: Oh no! We've been hacked! It seems like our machine got hacked by an anonymous threat actor. However, we are lucky to have a .pcap file from the attack. Can you determine what happened? Download the .pcap file and use Wireshark to view it. ...

0

JJebitoksharonjebitok.comDec 12, 2025 · 12 min read

SOC Alert Triaging - Tinsel Triage (TryHackMe) 🎉🧑‍🎄

This write-up came a little later than expected. The initial version of the Microsoft Sentinel environment was quite difficult to access, and it slowed down a lot of the hands-on progress. Thankfully, TryHackMe updated the Azure access, making everyt...

0

#socanalyst

Search Hashnode

#socanalyst

Explore Hashnode

Trending tags this week

Every Break-In Has a Three-Act Structure

I Used to Hunt Audiences. Now I Hunt Attackers.

Where Things Stand (And Where They're Going)

Splunk vs Microsoft Sentinel vs IBM QRadar: Which SIEM Should You Learn First?

Start Your SOC Journey with SOC Analyst Training 101

AWS Security Logging (TryHackMe)

SOC257 – VPN Connection Detected from Unauthorized Country (EventID:225)

Snapped Phish-ing Line

h4cked | Tryhackme Walkthrough

SOC Alert Triaging - Tinsel Triage (TryHackMe) 🎉🧑‍🎄