/Cybersecurity

After the Alert: Did the Attacker Actually Get In? A SOC Investigation with Splunk

Investigate failed logins followed by a success in Splunk. A fictional SOC case with downloadable logs, simple searches, session correlation, and a completed handoff.

Your First SOC Investigation in Splunk: Find the Logs, Then Follow the Alert

New to Splunk in a SOC? Learn where to search, how to find indexes and log types, read your first event, and investigate a realistic failed-login alert with simple SPL.

How to Investigate a Hacked WordPress Site (A SOC Playbook)

A hands-on guide for SOC analysts on how to investigate a hacked or defaced WordPress site. Learn how to scope the compromise, contain without destroying evidence, read Apache and PHP logs, tell a dropped webshell apart from live AJAX abuse, and harden the site so it doesn't happen again.

How to Investigate WAF Login Attacks (A SOC Playbook)

A hands-on guide for SOC analysts on how to investigate WAF login attacks in real-world environments. Learn how to triage alerts, identify attack patterns, reduce false positives, and make confident response decisions.

AI in the SOC: How Artificial Intelligence Became My Strongest Teammate

Discover how AI in the SOC is transforming alert triage, threat detection, and incident response. Learn from a SOC analyst’s first-hand experience with automation, real-world challenges, and 7 actionable steps for AI-powered security operations.

Building a Basic Cyber Threat Intelligence Program for Any Size Business

Learn how to set up a basic Cyber Threat Intelligence (CTI) program for your business, regardless of its size. This guide covers the essentials, from understanding CTI to choosing the right tools and getting your team on board.

Evil Genius: Turning EDR into Malware - A Deep Dive into Shmuel Cohen's Cortex XDR Exploit

This blog post explores a groundbreaking discovery by Shmuel Cohen at SafeBreach Labs, where Palo Alto Networks' Cortex XDR, a leading EDR platform, was turned into a tool for attackers. Dive into the technical details of the exploit and its implications for cybersecurity.

Unraveling the XZ Backdoor: A Close Call for Open Source Security

An in-depth analysis of the recent XZ Backdoor incident, highlighting the resilience of the open source community in the face of a sophisticated supply chain attack. This post unpacks the details of the CVE-2024-3094 event, where a well-executed backdoor nearly compromised major Linux distributions, and the collaborative effort that led to its discovery and mitigation.

Hack The Box Write-Up: Analytics

Dive into the fascinating world of penetration testing with my latest adventure on Hack The Box's "Analytics" challenge. From initial reconnaissance to successful system exploitation, explore the intricate steps of a cyber sleuth.