How to Build a Home SOC Lab with Free Tools
A beginner friendly plan for a home SOC lab using Windows evaluation builds, Sysmon, a free SIEM and Atomic Red Team, plus how to turn it into interview evidence.
7 Nov 20267 min read
All
Alert Triage
Detection Engineering
Incident Response
Threat Intelligence
Threat Hunting
SIEM and Tools
Career and Certs
Cheat Sheets
Threat News
5 posts found
Windows Logon Events Cheat Sheet: Event IDs, Types and Failure Codes
A shift-ready reference for Windows logon event IDs, logon types and failure codes, with KQL, SPL and PowerShell to show who logged on, from where and how.
5 Nov 20268 min read
How to Investigate a Malicious Inbox Rule in Microsoft 365
A practical playbook for investigating a suspicious Microsoft 365 inbox rule: read the rule, scope the account, check what mail was exposed and contain it cleanly.
3 Nov 20269 min read
How to Detect LSASS Memory Access with Sysmon Event ID 10
Build a tuned LSASS access detection from Sysmon Event ID 10, with Splunk, Sentinel and Sigma versions, plus triage steps and the hardening that reduces your risk.
2 Nov 202612 min read
How to Triage an Encoded PowerShell Alert
A step by step way to decode an encoded PowerShell command, check its parent process and related activity, and decide whether to close or escalate.
1 Nov 20268 min read