How to Turn a Joint Cyber Advisory into Hunts and Detections
A repeatable workflow for public sector SOCs to turn NCSC co-sealed advisories into ATT&CK mapped hunts, tested detections and clear evidence for the CAF.
10 Nov 20268 min read
All
Alert Triage
Detection Engineering
Incident Response
Threat Intelligence
Threat Hunting
SIEM and Tools
Career and Certs
Cheat Sheets
Threat News
7 posts found
Linux SSH Log Cheat Sheet for Beginner SOC Analysts
Where Linux keeps SSH logs, what each common log line means and the simple grep and journalctl commands that tell you who logged in, from where and how.
9 Nov 20267 min read
How to Build a Home SOC Lab with Free Tools
A beginner friendly plan for a home SOC lab using Windows evaluation builds, Sysmon, a free SIEM and Atomic Red Team, plus how to turn it into interview evidence.
7 Nov 20267 min read
SOC Analyst Interview Prep: Technical Questions for Beginners
The networking, Windows log and alert triage questions that entry level SOC interviews often include, with simple ways to answer them clearly and what to study first.
4 Nov 20268 min read
How to Investigate a Malicious Inbox Rule in Microsoft 365
A practical playbook for investigating a suspicious Microsoft 365 inbox rule: read the rule, scope the account, check what mail was exposed and contain it cleanly.
3 Nov 20269 min read
How to Detect LSASS Memory Access with Sysmon Event ID 10
Build a tuned LSASS access detection from Sysmon Event ID 10, with Splunk, Sentinel and Sigma versions, plus triage steps and the hardening that reduces your risk.
2 Nov 202612 min read
How to Triage a Suspicious OAuth App Consent Alert in Entra ID
Work out what a user consented to, whether the app has touched any data and how to remove it safely, with KQL for Entra audit, sign in and Graph activity logs.
14 Jul 202610 min read