How to Write Priority Intelligence Requirements for a Bank SOC
Tie threat intelligence to payment, fraud and resilience risk with clear PIRs, tag indicators by PIR in Sentinel and prove which feeds actually earn their keep.
13 Nov 202610 min read
Home / Blog
The blog
Walkthroughs, detection notes and quick references. Filter by topic or search for a technique, tool or event ID.
All
Alert Triage
Detection Engineering
Incident Response
Threat Intelligence
Threat Hunting
SIEM and Tools
Career and Certs
Cheat Sheets
Threat News
20 posts found
How to Investigate Rogue Remote Access Tools in a Client Incident
Scope unauthorised AnyDesk, ScreenConnect and TeamViewer use across a client estate: find every install, read the session logs, build a timeline and contain it safely.
11 Nov 20269 min read
How to Turn a Joint Cyber Advisory into Hunts and Detections
A repeatable workflow for public sector SOCs to turn NCSC co-sealed advisories into ATT&CK mapped hunts, tested detections and clear evidence for the CAF.
10 Nov 20268 min read
How to Detect AiTM Session Cookie Theft in Entra ID Sign In Logs
Spot adversary in the middle phishing in Entra ID by tracking session IDs, OfficeHome sign ins and token risk events, then contain it before a payment fraud lands.
9 Nov 20269 min read
Linux SSH Log Cheat Sheet for Beginner SOC Analysts
Where Linux keeps SSH logs, what each common log line means and the simple grep and journalctl commands that tell you who logged in, from where and how.
9 Nov 20267 min read
How to Build a Home SOC Lab with Free Tools
A beginner friendly plan for a home SOC lab using Windows evaluation builds, Sysmon, a free SIEM and Atomic Red Team, plus how to turn it into interview evidence.
7 Nov 20267 min read
How to Enrich a Suspicious Domain Without Alerting the Attacker
A practical workflow for investigating an unknown domain with internal logs, RDAP, passive DNS and certificate data, then turning the results into a clear verdict.
6 Nov 20267 min read
Windows Logon Events Cheat Sheet: Event IDs, Types and Failure Codes
A shift-ready reference for Windows logon event IDs, logon types and failure codes, with KQL, SPL and PowerShell to show who logged on, from where and how.
5 Nov 20268 min read
How to Hunt for C2 Beaconing in Proxy and EDR Logs
Find regular callback traffic in proxy and EDR logs with interval analysis in KQL and SPL, then separate real command and control from noisy legitimate software.
5 Nov 20269 min read