Triage a Brute Force Alert in 5 Steps (Event ID 4625)
A repeatable beginner workflow for the most common SOC alert: lots of failed Windows logons. Read the alert, enrich, scope, decide and document.
4 Nov 20262 min read
Home / Blog
The blog
Walkthroughs, detection notes and quick references. Filter by topic or search for a technique, tool or event ID.
All
Alert Triage
Detection Engineering
Incident Response
Threat Intelligence
Threat Hunting
SIEM and Tools
Career and Certs
Cheat Sheets
Threat News
20 posts found
SOC Analyst Interview Prep: Technical Questions for Beginners
The networking, Windows log and alert triage questions that entry level SOC interviews often include, with simple ways to answer them clearly and what to study first.
4 Nov 20268 min read
How to Investigate a Malicious Inbox Rule in Microsoft 365
A practical playbook for investigating a suspicious Microsoft 365 inbox rule: read the rule, scope the account, check what mail was exposed and contain it cleanly.
3 Nov 20269 min read
How to Detect LSASS Memory Access with Sysmon Event ID 10
Build a tuned LSASS access detection from Sysmon Event ID 10, with Splunk, Sentinel and Sigma versions, plus triage steps and the hardening that reduces your risk.
2 Nov 202612 min read
How to Triage an Encoded PowerShell Alert
A step by step way to decode an encoded PowerShell command, check its parent process and related activity, and decide whether to close or escalate.
1 Nov 20268 min read
How to Hunt for Kerberoasting After the 2026 RC4 Changes
RC4 is now off by default on domain controllers, so old Kerberoasting rules go quiet. Hunt AES ticket bursts, leftover RC4 accounts and decoy SPNs instead.
29 Oct 202610 min read
How to Use Microsoft Sentinel Watchlists to Cut False Positives
Use Sentinel watchlists to suppress known scanners, flag VIP accounts and keep exclusions out of your rule logic, with ready KQL for each pattern.
27 Oct 20268 min read
Log Levels Explained: What INFO, WARN and ERROR Mean in Logs
A beginner guide to log severity levels in syslog, Python, Log4j and Windows, why they differ between products, and why quiet INFO events can still matter.
23 Oct 20267 min read
How to Detect Backup and Recovery Tampering Before Ransomware Hits
Build detections for shadow copy deletion, backup catalog wipes and disabled Windows recovery, tune them per client and contain fast when they fire.
28 Sep 202610 min read