From Splunk to Sigma: Building and Validating Vendor-Neutral Detection Logic
A detection-engineering exercise using Sigma, Splunk, Windows telemetry, and Atomic Red Team to validate vendor-neutral detection logic
From Manual Testing to Repeatable Detection Validation with Atomic Red Team
How to Validate PowerShell Detections in Splunk with Sysmon, Atomic Red Team, and MITRE ATT&CK
TryHackMe SOC Level 2: What Changed, and What It Says About the Future of the SOC Analyst Role
Exploring the new skills, technologies and investigative mindset behind TryHackMe's updated L2 curriculum
Beyond AI Security: Learning How to Assess AI Systems
My Experience with INE’s AI Systems Security Specialist (eAIS) Learning Path
AI Security: Cybersecurity Applied to a New Attack Surface
A reflection on completing TryHackMe’s AI Security learning path
Building a Tier 1 SOC Dashboard in Splunk
Designing an Operational Monitoring Dashboard for Authentication, Endpoint, Network, and Threat Hunting Visibility
Investigating Lateral Movement and Authentication Activity in Active Directory Using Splunk
Correlating failed logons, Kerberos authentication events, SMB access, and blocked lateral movement attempts in a hardened Active Directory environment
Investigating Suspicious PowerShell Activity with Splunk
Simulating common PowerShell abuse techniques and investigating endpoint telemetry in Splunk
6 Real Problems I Solved While Building My SOC Homelab
Root Cause Analysis, Fixes and Lessons Learned During My SOC Homelab Deployment
SOC Incident Report: Investigation of a Volt Typhoon-Inspired Intrusion
A Complete Write-Up Demonstrating Real SOC Investigation Methodology
Building a SOC Homelab from Scratch: Active Directory, pfSense, Sysmon and Splunk
Designing an Enterprise-Style Security Monitoring Environment for Blue Team Skill Development
I Completed 100 Cybersecurity Labs. Why Build a SOC Homelab Too?
Lessons learned building a SOC homelab with Splunk, Active Directory, Sysmon, and pfSense
CyberDefenders CCDL1: Practical SOC Analyst Training Beyond the Fundamentals
A hands-on path into modern blue team operations
SOC Alert: Conti Ransomware Investigation
Simulating Real-World SOC Triage, Threat Hunting, and Incident Reporting Through a Conti Ransomware Investigation
Investigating a Phishing Attack with Volatility and Olevba | TryHackMe Boogeyman 2
A hands-on DFIR walkthrough covering phishing analysis, malicious macros, memory forensics, C2 investigation, and persistence detection.
Unraveling a Ransomware Attack Chain: TryHackMe First Shift CTF — Task 8: Promotion Night
Hands-on Splunk investigation covering ransomware deployment, persistence mechanisms, lateral movement, and AWS data exfiltration
Exposing a Network-Based Attack: TryHackMe First Shift CTF — Task 7: The Crown Jewel
Network Traffic Analysis and Forensics to Identify C2 Channels, ARP Spoofing, and Data Exfiltration Techniques
Investigating a Multi-Stage Attack: TryHackMe First Shift CTF — Task 6: Zero Tolerance
A SOC Threat Intelligence Investigation into Brute Force, File Upload Exploitation, and Web Shell Persistence
What Future Crimes Taught Me About Cybersecurity
Context is the key to understanding modern cyber threats
Inside a Web Shell Attack: TryHackMe First Shift CTF — Task 5: Portal Drop
A SOC Threat Intelligence Investigation into Brute Force, File Upload Exploitation, and Web Shell Persistence
Inside a Phishing Attack: TryHackMe First Shift CTF — Task 4: Phishing Books
A SOC phishing analysis; email header forensics, obfuscated payload decoding, and adversary attribution
A SOC Threat Intelligence Investigation. TryHackMe First Shift CTF — Task 3: Probably Just Fine
A practical walkthrough of SOC investigation techniques, including IOC analysis, malware classification, and MITRE ATT\&CK mapping
Splunk 2 TryHackMe Writeup (Part 2) — BOTS v2 SOC Investigation (300 & 400 Series)
Practical Log Analysis from the Boss of the SOC (BOTS v2) Dataset
Splunk 2 TryHackMe Writeup (Part 1) — BOTS v2 SOC Investigation (100 & 200 Series)
Practical Log Analysis from the Boss of the SOC (BOTS v2) Dataset
Investigating Malicious Activity with Sysmon and Splunk — TryHackMe New Hire Old Artifacts Writeup
A practical SOC-style investigation walkthrough using Windows telemetry to identify attacker activity and defense evasion techniques.
Invite Only: A Threat Intelligence Investigation and Malware Analysis writeup
A practical SOC analyst investigation of malicious hashes, phishing techniques, and malware delivery chains from the Invite Only TryHackMe room
Wireshark Traffic Analysis: A Comprehensive Guide
A Complete Guide to Solving TryHackMe’s Wireshark Traffic Analysis Room - A Step-by-Step Walkthrough of All Tasks and Insights
How I Built a Splunk Homelab for Splunk Certified Core User (SPLK-1001) — Installation, SPL Queries & Dashboard Practice
A step-by-step hands-on lab to practice Windows log ingestion, SPL commands, reporting and dashboard creation using Splunk Enterprise
Regular Expressions
A TryHackMe Regex Practical Exercise Writeup
Elastic Stack (ELK) for SOC Log Investigations
Essential ELK techniques for investigating and querying logs
Wireshark Traffic Analysis: Cleartext Credentials & Firewall Rules
Identifying cleartext credentials inside packet captures and generating actionable firewall rules
TryHackMe ShadowTrace Walkthrough: Malware Analysis and IOC Extraction
Complete writeup with binary analysis, string decoding, and DFIR techniques
How I Passed TryHackMe’s Security Analyst Level 1 (SAL1): A Practical Study Guide
A breakdown of the SAL1 exam, its SOC scenarios, tools, and how to prepare effectively using TryHackMe
Detecting Web Shells in WordPress Through Apache Log Analysis
A TryHackMe writeup from the “Detecting Web Shells” room — Task 6 Investigation
Wireshark Traffic Analysis: Encrypted Protocol Analysis: Decrypting HTTPS
Unlocking Encrypted Traffic - From TLS Handshake to Decrypted HTTP/2 Data
Sysmon Investigation Walkthrough, Using Event Viewer and PowerShell
TryHackMe Sysmon Task 10 - Practical Investigations Explained (With PowerShell)
Wireshark Traffic Analysis: HTTP Cleartext Protocol Analysis
Anomalous user agents, subtle anomalies in packet data and specific attack patterns
Leveraging Splunk SIEM to Detect DoS Attacks
TryHackMe Detecting Web DDoS Room, Task 5 Writeup
Wireshark Traffic Analysis: DNS and ICMP Traffic Tunneling & FTP Cleartext Protocol Analysis
ICMP and DNS exfiltration techniques and malicious cleartext FTP behavior
Wireshark Traffic Analysis: Identifying Hosts: DHCP, NetBIOS and Kerberos
Practical examples of how to use Wireshark to answer specific questions about network activity
Splunk Incident Response: Reconstructing an Attack Using Perimeter Logs
TryHackMe — Network Security Essentials (Task 7 Practical Exercise)
Searching, Filtering, and Correlation: Threat Hunting with Brim
Using Brim capabilities to identify malicious activities
Wireshark Traffic Analysis: ARP Poisoning & Man In The Middle
Analyzing network traffic to identify ARP requests, HTTP packets, and sniffed login credentials
Cloud-based Threat Detection with Splunk
Solving Rotten Cloud Investigation — Blue Team Labs Online (Halloween 2025 Special Event)
Wireshark Traffic Analysis: Nmap Scans
Investigating a .pcap file to analyze a suspected Nmap scan
Exposing a Vast Phishing Campaign by Probing Malicious Emails and URLs
TryHackMe Snapped Phish-ing Line Room Write‑Up
Network Forensics with NetworkMiner
Investigating PCAP files and email metadata
The new TryHackMe SOC Level 1 Path
Now getting ready for the job got even better
Mastering Snort: Stopping Real-Time Attacks
Learn how to detect and block brute-force and reverse shell attacks using Snort IDS/IPS
Windows Forensics: How I Traced Suspicious Activity Using Registry Hives
Using Eric Zimmerman’s Registry Explorer to locate key forensic artifacts
Mastering Snort Rule Creation: A Step-by-Step Guide for Network Analysts
Fine-tune Snort rules for effective packet analysis
Snort Challenge: The Basics Writeup
A hands-on walkthrough covering Snort IDS rule creation, traffic analysis, signature-based detection and troubleshooting
My Experience with the Blue Team Level 1 (BTL1) Certification
A Broad and Professional Blue-Team Skillset
Investigating and Decrypting PowerShell Web Requests with Splunk and CyberChef
A detailed writeup of TryHackMe’s “Investigating with Splunk” final question
Efficient Algorithm for Allow List File Updates in Python
Practical experience with the Google Cybersecurity Certificate
Linux Workstation Hardening: Enhancing Security with UFW
Master UFW and Kernel Hardening to Fortify Your Linux Workstation Against Threats
Apply Filters to SQL Queries: A Cybersecurity Use Case
Practical experience with the Google Cybersecurity Certificate
USBferry, Tropic Trooper, and ATT&CK: A Practical CTI Exercise
Identifying Tactics, Techniques and Procedures of an APT
Managing File Permissions in Linux Using chmod
Practical experience with the Google Cybersecurity Certificate
Why You Should Disable Bluetooth on Linux (and How to Do It)
All the Ways to Disable Bluetooth for Good
Conducting a Security Audit
Practical experience with the Google Cybersecurity Certificate
What’s Next After CompTIA Security+? My Experience with the Google Cybersecurity Certificate
Excellent cybersecurity fundamentals with practical assignments
