Building a Tier 1 SOC Dashboard in Splunk
Designing an Operational Monitoring Dashboard for Authentication, Endpoint, Network, and Threat Hunting Visibility
active-directory
Investigating Lateral Movement and Authentication Activity in Active Directory Using Splunk
Correlating failed logons, Kerberos authentication events, SMB access, and blocked lateral movement attempts in a hardened Active Directory environment
allowlist
Efficient Algorithm for Allow List File Updates in Python
Practical experience with the Google Cybersecurity Certificate
aws
Unraveling a Ransomware Attack Chain: TryHackMe First Shift CTF — Task 8: Promotion Night
Hands-on Splunk investigation covering ransomware deployment, persistence mechanisms, lateral movement, and AWS data exfiltration
azure-security
Cloud-based Threat Detection with Splunk
Solving Rotten Cloud Investigation — Blue Team Labs Online (Halloween 2025 Special Event)
blue-team
6 Real Problems I Solved While Building My SOC Homelab
Root Cause Analysis, Fixes and Lessons Learned During My SOC Homelab Deployment
SOC Incident Report: Investigation of a Volt Typhoon-Inspired Intrusion
A Complete Write-Up Demonstrating Real SOC Investigation Methodology
Building a SOC Homelab from Scratch: Active Directory, pfSense, Sysmon and Splunk
Designing an Enterprise-Style Security Monitoring Environment for Blue Team Skill Development
I Completed 100 Cybersecurity Labs. Why Build a SOC Homelab Too?
Lessons learned building a SOC homelab with Splunk, Active Directory, Sysmon, and pfSense
CyberDefenders CCDL1: Practical SOC Analyst Training Beyond the Fundamentals
A hands-on path into modern blue team operations
Splunk 2 TryHackMe Writeup (Part 2) — BOTS v2 SOC Investigation (300 & 400 Series)
Practical Log Analysis from the Boss of the SOC (BOTS v2) Dataset
Splunk 2 TryHackMe Writeup (Part 1) — BOTS v2 SOC Investigation (100 & 200 Series)
Practical Log Analysis from the Boss of the SOC (BOTS v2) Dataset
Wireshark Traffic Analysis: Cleartext Credentials & Firewall Rules
Identifying cleartext credentials inside packet captures and generating actionable firewall rules
How I Passed TryHackMe’s Security Analyst Level 1 (SAL1): A Practical Study Guide
A breakdown of the SAL1 exam, its SOC scenarios, tools, and how to prepare effectively using TryHackMe
Detecting Web Shells in WordPress Through Apache Log Analysis
A TryHackMe writeup from the “Detecting Web Shells” room — Task 6 Investigation
Sysmon Investigation Walkthrough, Using Event Viewer and PowerShell
TryHackMe Sysmon Task 10 - Practical Investigations Explained (With PowerShell)
Wireshark Traffic Analysis: DNS and ICMP Traffic Tunneling & FTP Cleartext Protocol Analysis
ICMP and DNS exfiltration techniques and malicious cleartext FTP behavior
Splunk Incident Response: Reconstructing an Attack Using Perimeter Logs
TryHackMe — Network Security Essentials (Task 7 Practical Exercise)
The new TryHackMe SOC Level 1 Path
Now getting ready for the job got even better
My Experience with the Blue Team Level 1 (BTL1) Certification
A Broad and Professional Blue-Team Skillset
Investigating and Decrypting PowerShell Web Requests with Splunk and CyberChef
A detailed writeup of TryHackMe’s “Investigating with Splunk” final question
bluetooth
Why You Should Disable Bluetooth on Linux (and How to Do It)
All the Ways to Disable Bluetooth for Good
books
What Future Crimes Taught Me About Cybersecurity
Context is the key to understanding modern cyber threats
brim
Searching, Filtering, and Correlation: Threat Hunting with Brim
Using Brim capabilities to identify malicious activities
btlo
Cloud-based Threat Detection with Splunk
Solving Rotten Cloud Investigation — Blue Team Labs Online (Halloween 2025 Special Event)
certification
How I Built a Splunk Homelab for Splunk Certified Core User (SPLK-1001) — Installation, SPL Queries & Dashboard Practice
A step-by-step hands-on lab to practice Windows log ingestion, SPL commands, reporting and dashboard creation using Splunk Enterprise
certifications
CyberDefenders CCDL1: Practical SOC Analyst Training Beyond the Fundamentals
A hands-on path into modern blue team operations
How I Passed TryHackMe’s Security Analyst Level 1 (SAL1): A Practical Study Guide
A breakdown of the SAL1 exam, its SOC scenarios, tools, and how to prepare effectively using TryHackMe
The new TryHackMe SOC Level 1 Path
Now getting ready for the job got even better
My Experience with the Blue Team Level 1 (BTL1) Certification
A Broad and Professional Blue-Team Skillset
What’s Next After CompTIA Security+? My Experience with the Google Cybersecurity Certificate
Excellent cybersecurity fundamentals with practical assignments
chmod
Managing File Permissions in Linux Using chmod
Practical experience with the Google Cybersecurity Certificate
cloud-security
Cloud-based Threat Detection with Splunk
Solving Rotten Cloud Investigation — Blue Team Labs Online (Halloween 2025 Special Event)
compliance
Conducting a Security Audit
Practical experience with the Google Cybersecurity Certificate
cyber-security-awareness
What Future Crimes Taught Me About Cybersecurity
Context is the key to understanding modern cyber threats
cyberchef
Investigating and Decrypting PowerShell Web Requests with Splunk and CyberChef
A detailed writeup of TryHackMe’s “Investigating with Splunk” final question
cybercrime
What Future Crimes Taught Me About Cybersecurity
Context is the key to understanding modern cyber threats
cybersecurity
What Future Crimes Taught Me About Cybersecurity
Context is the key to understanding modern cyber threats
cybersecurity-lab
Building a Tier 1 SOC Dashboard in Splunk
Designing an Operational Monitoring Dashboard for Authentication, Endpoint, Network, and Threat Hunting Visibility
Investigating Lateral Movement and Authentication Activity in Active Directory Using Splunk
Correlating failed logons, Kerberos authentication events, SMB access, and blocked lateral movement attempts in a hardened Active Directory environment
Investigating Suspicious PowerShell Activity with Splunk
Simulating common PowerShell abuse techniques and investigating endpoint telemetry in Splunk
6 Real Problems I Solved While Building My SOC Homelab
Root Cause Analysis, Fixes and Lessons Learned During My SOC Homelab Deployment
Building a SOC Homelab from Scratch: Active Directory, pfSense, Sysmon and Splunk
Designing an Enterprise-Style Security Monitoring Environment for Blue Team Skill Development
I Completed 100 Cybersecurity Labs. Why Build a SOC Homelab Too?
Lessons learned building a SOC homelab with Splunk, Active Directory, Sysmon, and pfSense
dashboards
How I Built a Splunk Homelab for Splunk Certified Core User (SPLK-1001) — Installation, SPL Queries & Dashboard Practice
A step-by-step hands-on lab to practice Windows log ingestion, SPL commands, reporting and dashboard creation using Splunk Enterprise
data-filtering
Apply Filters to SQL Queries: A Cybersecurity Use Case
Practical experience with the Google Cybersecurity Certificate
data-protection
Conducting a Security Audit
Practical experience with the Google Cybersecurity Certificate
ddos
Leveraging Splunk SIEM to Detect DoS Attacks
TryHackMe Detecting Web DDoS Room, Task 5 Writeup
detection-engineering
Building a Tier 1 SOC Dashboard in Splunk
Designing an Operational Monitoring Dashboard for Authentication, Endpoint, Network, and Threat Hunting Visibility
Investigating Lateral Movement and Authentication Activity in Active Directory Using Splunk
Correlating failed logons, Kerberos authentication events, SMB access, and blocked lateral movement attempts in a hardened Active Directory environment
dfir
CyberDefenders CCDL1: Practical SOC Analyst Training Beyond the Fundamentals
A hands-on path into modern blue team operations
Investigating a Phishing Attack with Volatility and Olevba | TryHackMe Boogeyman 2
A hands-on DFIR walkthrough covering phishing analysis, malicious macros, memory forensics, C2 investigation, and persistence detection.
TryHackMe ShadowTrace Walkthrough: Malware Analysis and IOC Extraction
Complete writeup with binary analysis, string decoding, and DFIR techniques
Windows Forensics: How I Traced Suspicious Activity Using Registry Hives
Using Eric Zimmerman’s Registry Explorer to locate key forensic artifacts
dfir tryhackme
Exposing a Vast Phishing Campaign by Probing Malicious Emails and URLs
TryHackMe Snapped Phish-ing Line Room Write‑Up
digital-forensics
Wireshark Traffic Analysis: Identifying Hosts: DHCP, NetBIOS and Kerberos
Practical examples of how to use Wireshark to answer specific questions about network activity
Windows Forensics: How I Traced Suspicious Activity Using Registry Hives
Using Eric Zimmerman’s Registry Explorer to locate key forensic artifacts
My Experience with the Blue Team Level 1 (BTL1) Certification
A Broad and Professional Blue-Team Skillset
elastic
Elastic Stack (ELK) for SOC Log Investigations
Essential ELK techniques for investigating and querying logs
elastic-search
Elastic Stack (ELK) for SOC Log Investigations
Essential ELK techniques for investigating and querying logs
elastic-stack
Elastic Stack (ELK) for SOC Log Investigations
Essential ELK techniques for investigating and querying logs
elk
Elastic Stack (ELK) for SOC Log Investigations
Essential ELK techniques for investigating and querying logs
ez-tools
Windows Forensics: How I Traced Suspicious Activity Using Registry Hives
Using Eric Zimmerman’s Registry Explorer to locate key forensic artifacts
file-permissions
Managing File Permissions in Linux Using chmod
Practical experience with the Google Cybersecurity Certificate
firewall
Linux Workstation Hardening: Enhancing Security with UFW
Master UFW and Kernel Hardening to Fortify Your Linux Workstation Against Threats
homelab
Building a Tier 1 SOC Dashboard in Splunk
Designing an Operational Monitoring Dashboard for Authentication, Endpoint, Network, and Threat Hunting Visibility
Investigating Lateral Movement and Authentication Activity in Active Directory Using Splunk
Correlating failed logons, Kerberos authentication events, SMB access, and blocked lateral movement attempts in a hardened Active Directory environment
Investigating Suspicious PowerShell Activity with Splunk
Simulating common PowerShell abuse techniques and investigating endpoint telemetry in Splunk
6 Real Problems I Solved While Building My SOC Homelab
Root Cause Analysis, Fixes and Lessons Learned During My SOC Homelab Deployment
Building a SOC Homelab from Scratch: Active Directory, pfSense, Sysmon and Splunk
Designing an Enterprise-Style Security Monitoring Environment for Blue Team Skill Development
I Completed 100 Cybersecurity Labs. Why Build a SOC Homelab Too?
Lessons learned building a SOC homelab with Splunk, Active Directory, Sysmon, and pfSense
incident-response
SOC Incident Report: Investigation of a Volt Typhoon-Inspired Intrusion
A Complete Write-Up Demonstrating Real SOC Investigation Methodology
SOC Alert: Conti Ransomware Investigation
Simulating Real-World SOC Triage, Threat Hunting, and Incident Reporting Through a Conti Ransomware Investigation
Exposing a Network-Based Attack: TryHackMe First Shift CTF — Task 7: The Crown Jewel
Network Traffic Analysis and Forensics to Identify C2 Channels, ARP Spoofing, and Data Exfiltration Techniques
Inside a Web Shell Attack: TryHackMe First Shift CTF — Task 5: Portal Drop
A SOC Threat Intelligence Investigation into Brute Force, File Upload Exploitation, and Web Shell Persistence
TryHackMe ShadowTrace Walkthrough: Malware Analysis and IOC Extraction
Complete writeup with binary analysis, string decoding, and DFIR techniques
Detecting Web Shells in WordPress Through Apache Log Analysis
A TryHackMe writeup from the “Detecting Web Shells” room — Task 6 Investigation
Sysmon Investigation Walkthrough, Using Event Viewer and PowerShell
TryHackMe Sysmon Task 10 - Practical Investigations Explained (With PowerShell)
Exposing a Vast Phishing Campaign by Probing Malicious Emails and URLs
TryHackMe Snapped Phish-ing Line Room Write‑Up
My Experience with the Blue Team Level 1 (BTL1) Certification
A Broad and Professional Blue-Team Skillset
infosec
What Future Crimes Taught Me About Cybersecurity
Context is the key to understanding modern cyber threats
intrusion-detection
Regular Expressions
A TryHackMe Regex Practical Exercise Writeup
Mastering Snort: Stopping Real-Time Attacks
Learn how to detect and block brute-force and reverse shell attacks using Snort IDS/IPS
Mastering Snort Rule Creation: A Step-by-Step Guide for Network Analysts
Fine-tune Snort rules for effective packet analysis
Snort Challenge: The Basics Writeup
A hands-on walkthrough covering Snort IDS rule creation, traffic analysis, signature-based detection and troubleshooting
kerberos
Building a Tier 1 SOC Dashboard in Splunk
Designing an Operational Monitoring Dashboard for Authentication, Endpoint, Network, and Threat Hunting Visibility
Investigating Lateral Movement and Authentication Activity in Active Directory Using Splunk
Correlating failed logons, Kerberos authentication events, SMB access, and blocked lateral movement attempts in a hardened Active Directory environment
linux-hardening
Linux Workstation Hardening: Enhancing Security with UFW
Master UFW and Kernel Hardening to Fortify Your Linux Workstation Against Threats
Managing File Permissions in Linux Using chmod
Practical experience with the Google Cybersecurity Certificate
Why You Should Disable Bluetooth on Linux (and How to Do It)
All the Ways to Disable Bluetooth for Good
linux-security
Linux Workstation Hardening: Enhancing Security with UFW
Master UFW and Kernel Hardening to Fortify Your Linux Workstation Against Threats
Managing File Permissions in Linux Using chmod
Practical experience with the Google Cybersecurity Certificate
Why You Should Disable Bluetooth on Linux (and How to Do It)
All the Ways to Disable Bluetooth for Good
log-analysis
Exposing a Network-Based Attack: TryHackMe First Shift CTF — Task 7: The Crown Jewel
Network Traffic Analysis and Forensics to Identify C2 Channels, ARP Spoofing, and Data Exfiltration Techniques
malware-analysis
Investigating a Phishing Attack with Volatility and Olevba | TryHackMe Boogeyman 2
A hands-on DFIR walkthrough covering phishing analysis, malicious macros, memory forensics, C2 investigation, and persistence detection.
Invite Only: A Threat Intelligence Investigation and Malware Analysis writeup
A practical SOC analyst investigation of malicious hashes, phishing techniques, and malware delivery chains from the Invite Only TryHackMe room
TryHackMe ShadowTrace Walkthrough: Malware Analysis and IOC Extraction
Complete writeup with binary analysis, string decoding, and DFIR techniques
mitm
Wireshark Traffic Analysis: ARP Poisoning & Man In The Middle
Analyzing network traffic to identify ARP requests, HTTP packets, and sniffed login credentials
mitre
USBferry, Tropic Trooper, and ATT&CK: A Practical CTI Exercise
Identifying Tactics, Techniques and Procedures of an APT
mitre-attck
SOC Incident Report: Investigation of a Volt Typhoon-Inspired Intrusion
A Complete Write-Up Demonstrating Real SOC Investigation Methodology
network-analysis
Wireshark Traffic Analysis: A Comprehensive Guide
A Complete Guide to Solving TryHackMe’s Wireshark Traffic Analysis Room - A Step-by-Step Walkthrough of All Tasks and Insights
Wireshark Traffic Analysis: HTTP Cleartext Protocol Analysis
Anomalous user agents, subtle anomalies in packet data and specific attack patterns
Searching, Filtering, and Correlation: Threat Hunting with Brim
Using Brim capabilities to identify malicious activities
network-forensics
Exposing a Network-Based Attack: TryHackMe First Shift CTF — Task 7: The Crown Jewel
Network Traffic Analysis and Forensics to Identify C2 Channels, ARP Spoofing, and Data Exfiltration Techniques
Wireshark Traffic Analysis: A Comprehensive Guide
A Complete Guide to Solving TryHackMe’s Wireshark Traffic Analysis Room - A Step-by-Step Walkthrough of All Tasks and Insights
Network Forensics with NetworkMiner
Investigating PCAP files and email metadata
network-security
Exposing a Network-Based Attack: TryHackMe First Shift CTF — Task 7: The Crown Jewel
Network Traffic Analysis and Forensics to Identify C2 Channels, ARP Spoofing, and Data Exfiltration Techniques
Wireshark Traffic Analysis: Cleartext Credentials & Firewall Rules
Identifying cleartext credentials inside packet captures and generating actionable firewall rules
Wireshark Traffic Analysis: Encrypted Protocol Analysis: Decrypting HTTPS
Unlocking Encrypted Traffic - From TLS Handshake to Decrypted HTTP/2 Data
Wireshark Traffic Analysis: HTTP Cleartext Protocol Analysis
Anomalous user agents, subtle anomalies in packet data and specific attack patterns
Wireshark Traffic Analysis: DNS and ICMP Traffic Tunneling & FTP Cleartext Protocol Analysis
ICMP and DNS exfiltration techniques and malicious cleartext FTP behavior
Wireshark Traffic Analysis: Identifying Hosts: DHCP, NetBIOS and Kerberos
Practical examples of how to use Wireshark to answer specific questions about network activity
Splunk Incident Response: Reconstructing an Attack Using Perimeter Logs
TryHackMe — Network Security Essentials (Task 7 Practical Exercise)
Wireshark Traffic Analysis: ARP Poisoning & Man In The Middle
Analyzing network traffic to identify ARP requests, HTTP packets, and sniffed login credentials
Wireshark Traffic Analysis: Nmap Scans
Investigating a .pcap file to analyze a suspected Nmap scan
Mastering Snort: Stopping Real-Time Attacks
Learn how to detect and block brute-force and reverse shell attacks using Snort IDS/IPS
Mastering Snort Rule Creation: A Step-by-Step Guide for Network Analysts
Fine-tune Snort rules for effective packet analysis
Snort Challenge: The Basics Writeup
A hands-on walkthrough covering Snort IDS rule creation, traffic analysis, signature-based detection and troubleshooting
networking
6 Real Problems I Solved While Building My SOC Homelab
Root Cause Analysis, Fixes and Lessons Learned During My SOC Homelab Deployment
Building a SOC Homelab from Scratch: Active Directory, pfSense, Sysmon and Splunk
Designing an Enterprise-Style Security Monitoring Environment for Blue Team Skill Development
networkminer
Network Forensics with NetworkMiner
Investigating PCAP files and email metadata
nmap
Wireshark Traffic Analysis: Nmap Scans
Investigating a .pcap file to analyze a suspected Nmap scan
opencti
USBferry, Tropic Trooper, and ATT&CK: A Practical CTI Exercise
Identifying Tactics, Techniques and Procedures of an APT
osint
A SOC Threat Intelligence Investigation. TryHackMe First Shift CTF — Task 3: Probably Just Fine
A practical walkthrough of SOC investigation techniques, including IOC analysis, malware classification, and MITRE ATT\&CK mapping
packet-analysis
Wireshark Traffic Analysis: A Comprehensive Guide
A Complete Guide to Solving TryHackMe’s Wireshark Traffic Analysis Room - A Step-by-Step Walkthrough of All Tasks and Insights
Wireshark Traffic Analysis: Encrypted Protocol Analysis: Decrypting HTTPS
Unlocking Encrypted Traffic - From TLS Handshake to Decrypted HTTP/2 Data
Wireshark Traffic Analysis: Identifying Hosts: DHCP, NetBIOS and Kerberos
Practical examples of how to use Wireshark to answer specific questions about network activity
Wireshark Traffic Analysis: ARP Poisoning & Man In The Middle
Analyzing network traffic to identify ARP requests, HTTP packets, and sniffed login credentials
Wireshark Traffic Analysis: Nmap Scans
Investigating a .pcap file to analyze a suspected Nmap scan
pcap-analysis
Wireshark Traffic Analysis: HTTP Cleartext Protocol Analysis
Anomalous user agents, subtle anomalies in packet data and specific attack patterns
Network Forensics with NetworkMiner
Investigating PCAP files and email metadata
phishing
Investigating a Phishing Attack with Volatility and Olevba | TryHackMe Boogeyman 2
A hands-on DFIR walkthrough covering phishing analysis, malicious macros, memory forensics, C2 investigation, and persistence detection.
Inside a Phishing Attack: TryHackMe First Shift CTF — Task 4: Phishing Books
A SOC phishing analysis; email header forensics, obfuscated payload decoding, and adversary attribution
Exposing a Vast Phishing Campaign by Probing Malicious Emails and URLs
TryHackMe Snapped Phish-ing Line Room Write‑Up
powershell
Investigating Suspicious PowerShell Activity with Splunk
Simulating common PowerShell abuse techniques and investigating endpoint telemetry in Splunk
Sysmon Investigation Walkthrough, Using Event Viewer and PowerShell
TryHackMe Sysmon Task 10 - Practical Investigations Explained (With PowerShell)
Investigating and Decrypting PowerShell Web Requests with Splunk and CyberChef
A detailed writeup of TryHackMe’s “Investigating with Splunk” final question
programming
Efficient Algorithm for Allow List File Updates in Python
Practical experience with the Google Cybersecurity Certificate
python
Efficient Algorithm for Allow List File Updates in Python
Practical experience with the Google Cybersecurity Certificate
ransomware
SOC Alert: Conti Ransomware Investigation
Simulating Real-World SOC Triage, Threat Hunting, and Incident Reporting Through a Conti Ransomware Investigation
Unraveling a Ransomware Attack Chain: TryHackMe First Shift CTF — Task 8: Promotion Night
Hands-on Splunk investigation covering ransomware deployment, persistence mechanisms, lateral movement, and AWS data exfiltration
regex
Regular Expressions
A TryHackMe Regex Practical Exercise Writeup
security-audit
Conducting a Security Audit
Practical experience with the Google Cybersecurity Certificate
siem
CyberDefenders CCDL1: Practical SOC Analyst Training Beyond the Fundamentals
A hands-on path into modern blue team operations
Splunk 2 TryHackMe Writeup (Part 2) — BOTS v2 SOC Investigation (300 & 400 Series)
Practical Log Analysis from the Boss of the SOC (BOTS v2) Dataset
Splunk 2 TryHackMe Writeup (Part 1) — BOTS v2 SOC Investigation (100 & 200 Series)
Practical Log Analysis from the Boss of the SOC (BOTS v2) Dataset
How I Built a Splunk Homelab for Splunk Certified Core User (SPLK-1001) — Installation, SPL Queries & Dashboard Practice
A step-by-step hands-on lab to practice Windows log ingestion, SPL commands, reporting and dashboard creation using Splunk Enterprise
Leveraging Splunk SIEM to Detect DoS Attacks
TryHackMe Detecting Web DDoS Room, Task 5 Writeup
Splunk Incident Response: Reconstructing an Attack Using Perimeter Logs
TryHackMe — Network Security Essentials (Task 7 Practical Exercise)
snort
Mastering Snort: Stopping Real-Time Attacks
Learn how to detect and block brute-force and reverse shell attacks using Snort IDS/IPS
Mastering Snort Rule Creation: A Step-by-Step Guide for Network Analysts
Fine-tune Snort rules for effective packet analysis
Snort Challenge: The Basics Writeup
A hands-on walkthrough covering Snort IDS rule creation, traffic analysis, signature-based detection and troubleshooting
soc
SOC Incident Report: Investigation of a Volt Typhoon-Inspired Intrusion
A Complete Write-Up Demonstrating Real SOC Investigation Methodology
SOC Alert: Conti Ransomware Investigation
Simulating Real-World SOC Triage, Threat Hunting, and Incident Reporting Through a Conti Ransomware Investigation
soc-analyst
SOC Incident Report: Investigation of a Volt Typhoon-Inspired Intrusion
A Complete Write-Up Demonstrating Real SOC Investigation Methodology
CyberDefenders CCDL1: Practical SOC Analyst Training Beyond the Fundamentals
A hands-on path into modern blue team operations
Investigating a Multi-Stage Attack: TryHackMe First Shift CTF — Task 6: Zero Tolerance
A SOC Threat Intelligence Investigation into Brute Force, File Upload Exploitation, and Web Shell Persistence
Inside a Web Shell Attack: TryHackMe First Shift CTF — Task 5: Portal Drop
A SOC Threat Intelligence Investigation into Brute Force, File Upload Exploitation, and Web Shell Persistence
Inside a Phishing Attack: TryHackMe First Shift CTF — Task 4: Phishing Books
A SOC phishing analysis; email header forensics, obfuscated payload decoding, and adversary attribution
A SOC Threat Intelligence Investigation. TryHackMe First Shift CTF — Task 3: Probably Just Fine
A practical walkthrough of SOC investigation techniques, including IOC analysis, malware classification, and MITRE ATT\&CK mapping
Splunk 2 TryHackMe Writeup (Part 2) — BOTS v2 SOC Investigation (300 & 400 Series)
Practical Log Analysis from the Boss of the SOC (BOTS v2) Dataset
Splunk 2 TryHackMe Writeup (Part 1) — BOTS v2 SOC Investigation (100 & 200 Series)
Practical Log Analysis from the Boss of the SOC (BOTS v2) Dataset
Investigating Malicious Activity with Sysmon and Splunk — TryHackMe New Hire Old Artifacts Writeup
A practical SOC-style investigation walkthrough using Windows telemetry to identify attacker activity and defense evasion techniques.
Invite Only: A Threat Intelligence Investigation and Malware Analysis writeup
A practical SOC analyst investigation of malicious hashes, phishing techniques, and malware delivery chains from the Invite Only TryHackMe room
soc-lab
Building a Tier 1 SOC Dashboard in Splunk
Designing an Operational Monitoring Dashboard for Authentication, Endpoint, Network, and Threat Hunting Visibility
Investigating Lateral Movement and Authentication Activity in Active Directory Using Splunk
Correlating failed logons, Kerberos authentication events, SMB access, and blocked lateral movement attempts in a hardened Active Directory environment
Investigating Suspicious PowerShell Activity with Splunk
Simulating common PowerShell abuse techniques and investigating endpoint telemetry in Splunk
6 Real Problems I Solved While Building My SOC Homelab
Root Cause Analysis, Fixes and Lessons Learned During My SOC Homelab Deployment
Building a SOC Homelab from Scratch: Active Directory, pfSense, Sysmon and Splunk
Designing an Enterprise-Style Security Monitoring Environment for Blue Team Skill Development
I Completed 100 Cybersecurity Labs. Why Build a SOC Homelab Too?
Lessons learned building a SOC homelab with Splunk, Active Directory, Sysmon, and pfSense
spl
How I Built a Splunk Homelab for Splunk Certified Core User (SPLK-1001) — Installation, SPL Queries & Dashboard Practice
A step-by-step hands-on lab to practice Windows log ingestion, SPL commands, reporting and dashboard creation using Splunk Enterprise
splunk
Building a Tier 1 SOC Dashboard in Splunk
Designing an Operational Monitoring Dashboard for Authentication, Endpoint, Network, and Threat Hunting Visibility
Investigating Lateral Movement and Authentication Activity in Active Directory Using Splunk
Correlating failed logons, Kerberos authentication events, SMB access, and blocked lateral movement attempts in a hardened Active Directory environment
Investigating Suspicious PowerShell Activity with Splunk
Simulating common PowerShell abuse techniques and investigating endpoint telemetry in Splunk
SOC Incident Report: Investigation of a Volt Typhoon-Inspired Intrusion
A Complete Write-Up Demonstrating Real SOC Investigation Methodology
Building a SOC Homelab from Scratch: Active Directory, pfSense, Sysmon and Splunk
Designing an Enterprise-Style Security Monitoring Environment for Blue Team Skill Development
I Completed 100 Cybersecurity Labs. Why Build a SOC Homelab Too?
Lessons learned building a SOC homelab with Splunk, Active Directory, Sysmon, and pfSense
SOC Alert: Conti Ransomware Investigation
Simulating Real-World SOC Triage, Threat Hunting, and Incident Reporting Through a Conti Ransomware Investigation
Unraveling a Ransomware Attack Chain: TryHackMe First Shift CTF — Task 8: Promotion Night
Hands-on Splunk investigation covering ransomware deployment, persistence mechanisms, lateral movement, and AWS data exfiltration
Investigating a Multi-Stage Attack: TryHackMe First Shift CTF — Task 6: Zero Tolerance
A SOC Threat Intelligence Investigation into Brute Force, File Upload Exploitation, and Web Shell Persistence
Splunk 2 TryHackMe Writeup (Part 2) — BOTS v2 SOC Investigation (300 & 400 Series)
Practical Log Analysis from the Boss of the SOC (BOTS v2) Dataset
Splunk 2 TryHackMe Writeup (Part 1) — BOTS v2 SOC Investigation (100 & 200 Series)
Practical Log Analysis from the Boss of the SOC (BOTS v2) Dataset
Investigating Malicious Activity with Sysmon and Splunk — TryHackMe New Hire Old Artifacts Writeup
A practical SOC-style investigation walkthrough using Windows telemetry to identify attacker activity and defense evasion techniques.
How I Built a Splunk Homelab for Splunk Certified Core User (SPLK-1001) — Installation, SPL Queries & Dashboard Practice
A step-by-step hands-on lab to practice Windows log ingestion, SPL commands, reporting and dashboard creation using Splunk Enterprise
Leveraging Splunk SIEM to Detect DoS Attacks
TryHackMe Detecting Web DDoS Room, Task 5 Writeup
Splunk Incident Response: Reconstructing an Attack Using Perimeter Logs
TryHackMe — Network Security Essentials (Task 7 Practical Exercise)
Cloud-based Threat Detection with Splunk
Solving Rotten Cloud Investigation — Blue Team Labs Online (Halloween 2025 Special Event)
Investigating and Decrypting PowerShell Web Requests with Splunk and CyberChef
A detailed writeup of TryHackMe’s “Investigating with Splunk” final question
sql
Apply Filters to SQL Queries: A Cybersecurity Use Case
Practical experience with the Google Cybersecurity Certificate
sysmon
Sysmon Investigation Walkthrough, Using Event Viewer and PowerShell
TryHackMe Sysmon Task 10 - Practical Investigations Explained (With PowerShell)
threat-detection
Wireshark Traffic Analysis: DNS and ICMP Traffic Tunneling & FTP Cleartext Protocol Analysis
ICMP and DNS exfiltration techniques and malicious cleartext FTP behavior
threat-hunting
SOC Incident Report: Investigation of a Volt Typhoon-Inspired Intrusion
A Complete Write-Up Demonstrating Real SOC Investigation Methodology
SOC Alert: Conti Ransomware Investigation
Simulating Real-World SOC Triage, Threat Hunting, and Incident Reporting Through a Conti Ransomware Investigation
Unraveling a Ransomware Attack Chain: TryHackMe First Shift CTF — Task 8: Promotion Night
Hands-on Splunk investigation covering ransomware deployment, persistence mechanisms, lateral movement, and AWS data exfiltration
Investigating a Multi-Stage Attack: TryHackMe First Shift CTF — Task 6: Zero Tolerance
A SOC Threat Intelligence Investigation into Brute Force, File Upload Exploitation, and Web Shell Persistence
Inside a Web Shell Attack: TryHackMe First Shift CTF — Task 5: Portal Drop
A SOC Threat Intelligence Investigation into Brute Force, File Upload Exploitation, and Web Shell Persistence
Investigating Malicious Activity with Sysmon and Splunk — TryHackMe New Hire Old Artifacts Writeup
A practical SOC-style investigation walkthrough using Windows telemetry to identify attacker activity and defense evasion techniques.
Searching, Filtering, and Correlation: Threat Hunting with Brim
Using Brim capabilities to identify malicious activities
My Experience with the Blue Team Level 1 (BTL1) Certification
A Broad and Professional Blue-Team Skillset
Apply Filters to SQL Queries: A Cybersecurity Use Case
Practical experience with the Google Cybersecurity Certificate
threat-intelligence
Inside a Phishing Attack: TryHackMe First Shift CTF — Task 4: Phishing Books
A SOC phishing analysis; email header forensics, obfuscated payload decoding, and adversary attribution
A SOC Threat Intelligence Investigation. TryHackMe First Shift CTF — Task 3: Probably Just Fine
A practical walkthrough of SOC investigation techniques, including IOC analysis, malware classification, and MITRE ATT\&CK mapping
Invite Only: A Threat Intelligence Investigation and Malware Analysis writeup
A practical SOC analyst investigation of malicious hashes, phishing techniques, and malware delivery chains from the Invite Only TryHackMe room
USBferry, Tropic Trooper, and ATT&CK: A Practical CTI Exercise
Identifying Tactics, Techniques and Procedures of an APT
tryhackme
Unraveling a Ransomware Attack Chain: TryHackMe First Shift CTF — Task 8: Promotion Night
Hands-on Splunk investigation covering ransomware deployment, persistence mechanisms, lateral movement, and AWS data exfiltration
Investigating a Multi-Stage Attack: TryHackMe First Shift CTF — Task 6: Zero Tolerance
A SOC Threat Intelligence Investigation into Brute Force, File Upload Exploitation, and Web Shell Persistence
Inside a Web Shell Attack: TryHackMe First Shift CTF — Task 5: Portal Drop
A SOC Threat Intelligence Investigation into Brute Force, File Upload Exploitation, and Web Shell Persistence
Inside a Phishing Attack: TryHackMe First Shift CTF — Task 4: Phishing Books
A SOC phishing analysis; email header forensics, obfuscated payload decoding, and adversary attribution
A SOC Threat Intelligence Investigation. TryHackMe First Shift CTF — Task 3: Probably Just Fine
A practical walkthrough of SOC investigation techniques, including IOC analysis, malware classification, and MITRE ATT\&CK mapping
Splunk 2 TryHackMe Writeup (Part 2) — BOTS v2 SOC Investigation (300 & 400 Series)
Practical Log Analysis from the Boss of the SOC (BOTS v2) Dataset
Splunk 2 TryHackMe Writeup (Part 1) — BOTS v2 SOC Investigation (100 & 200 Series)
Practical Log Analysis from the Boss of the SOC (BOTS v2) Dataset
Investigating Malicious Activity with Sysmon and Splunk — TryHackMe New Hire Old Artifacts Writeup
A practical SOC-style investigation walkthrough using Windows telemetry to identify attacker activity and defense evasion techniques.
Invite Only: A Threat Intelligence Investigation and Malware Analysis writeup
A practical SOC analyst investigation of malicious hashes, phishing techniques, and malware delivery chains from the Invite Only TryHackMe room
Wireshark Traffic Analysis: A Comprehensive Guide
A Complete Guide to Solving TryHackMe’s Wireshark Traffic Analysis Room - A Step-by-Step Walkthrough of All Tasks and Insights
Regular Expressions
A TryHackMe Regex Practical Exercise Writeup
Elastic Stack (ELK) for SOC Log Investigations
Essential ELK techniques for investigating and querying logs
Wireshark Traffic Analysis: Cleartext Credentials & Firewall Rules
Identifying cleartext credentials inside packet captures and generating actionable firewall rules
TryHackMe ShadowTrace Walkthrough: Malware Analysis and IOC Extraction
Complete writeup with binary analysis, string decoding, and DFIR techniques
How I Passed TryHackMe’s Security Analyst Level 1 (SAL1): A Practical Study Guide
A breakdown of the SAL1 exam, its SOC scenarios, tools, and how to prepare effectively using TryHackMe
Detecting Web Shells in WordPress Through Apache Log Analysis
A TryHackMe writeup from the “Detecting Web Shells” room — Task 6 Investigation
Wireshark Traffic Analysis: Encrypted Protocol Analysis: Decrypting HTTPS
Unlocking Encrypted Traffic - From TLS Handshake to Decrypted HTTP/2 Data
Sysmon Investigation Walkthrough, Using Event Viewer and PowerShell
TryHackMe Sysmon Task 10 - Practical Investigations Explained (With PowerShell)
Wireshark Traffic Analysis: HTTP Cleartext Protocol Analysis
Anomalous user agents, subtle anomalies in packet data and specific attack patterns
Leveraging Splunk SIEM to Detect DoS Attacks
TryHackMe Detecting Web DDoS Room, Task 5 Writeup
Searching, Filtering, and Correlation: Threat Hunting with Brim
Using Brim capabilities to identify malicious activities
Network Forensics with NetworkMiner
Investigating PCAP files and email metadata
The new TryHackMe SOC Level 1 Path
Now getting ready for the job got even better
Mastering Snort: Stopping Real-Time Attacks
Learn how to detect and block brute-force and reverse shell attacks using Snort IDS/IPS
Mastering Snort Rule Creation: A Step-by-Step Guide for Network Analysts
Fine-tune Snort rules for effective packet analysis
Snort Challenge: The Basics Writeup
A hands-on walkthrough covering Snort IDS rule creation, traffic analysis, signature-based detection and troubleshooting
Investigating and Decrypting PowerShell Web Requests with Splunk and CyberChef
A detailed writeup of TryHackMe’s “Investigating with Splunk” final question
ufw
Linux Workstation Hardening: Enhancing Security with UFW
Master UFW and Kernel Hardening to Fortify Your Linux Workstation Against Threats
virustotal
Invite Only: A Threat Intelligence Investigation and Malware Analysis writeup
A practical SOC analyst investigation of malicious hashes, phishing techniques, and malware delivery chains from the Invite Only TryHackMe room
volatility
Investigating a Phishing Attack with Volatility and Olevba | TryHackMe Boogeyman 2
A hands-on DFIR walkthrough covering phishing analysis, malicious macros, memory forensics, C2 investigation, and persistence detection.
web-security
Detecting Web Shells in WordPress Through Apache Log Analysis
A TryHackMe writeup from the “Detecting Web Shells” room — Task 6 Investigation
Leveraging Splunk SIEM to Detect DoS Attacks
TryHackMe Detecting Web DDoS Room, Task 5 Writeup
windows-forensics
Windows Forensics: How I Traced Suspicious Activity Using Registry Hives
Using Eric Zimmerman’s Registry Explorer to locate key forensic artifacts
wireshark
Exposing a Network-Based Attack: TryHackMe First Shift CTF — Task 7: The Crown Jewel
Network Traffic Analysis and Forensics to Identify C2 Channels, ARP Spoofing, and Data Exfiltration Techniques
Wireshark Traffic Analysis: A Comprehensive Guide
A Complete Guide to Solving TryHackMe’s Wireshark Traffic Analysis Room - A Step-by-Step Walkthrough of All Tasks and Insights
Wireshark Traffic Analysis: Cleartext Credentials & Firewall Rules
Identifying cleartext credentials inside packet captures and generating actionable firewall rules
Wireshark Traffic Analysis: Encrypted Protocol Analysis: Decrypting HTTPS
Unlocking Encrypted Traffic - From TLS Handshake to Decrypted HTTP/2 Data
Wireshark Traffic Analysis: HTTP Cleartext Protocol Analysis
Anomalous user agents, subtle anomalies in packet data and specific attack patterns
Wireshark Traffic Analysis: DNS and ICMP Traffic Tunneling & FTP Cleartext Protocol Analysis
ICMP and DNS exfiltration techniques and malicious cleartext FTP behavior
Wireshark Traffic Analysis: Identifying Hosts: DHCP, NetBIOS and Kerberos
Practical examples of how to use Wireshark to answer specific questions about network activity
Wireshark Traffic Analysis: ARP Poisoning & Man In The Middle
Analyzing network traffic to identify ARP requests, HTTP packets, and sniffed login credentials
Wireshark Traffic Analysis: Nmap Scans
Investigating a .pcap file to analyze a suspected Nmap scan
xdr
Inside a Web Shell Attack: TryHackMe First Shift CTF — Task 5: Portal Drop
A SOC Threat Intelligence Investigation into Brute Force, File Upload Exploitation, and Web Shell Persistence