Notes & write-ups
Thinking out loud about what I broke, what I learned, and what I'd do differently.
- Rebuilding a SOC Homelab I rebuilt my old Homelab to a more complete version. Detection & ResponseNetworking
- CRON jobbing with alerts that won't fire Cron logged every check-in to syslog automatically, and Wazuh ingested every line of it, but nothing in the default ruleset ever turned a plain CRON entry into an alert. Suricata caught it from a raw-IP curl heuristic instead. Offensive SecurityDetection & Response
- Dethroning Samba, the file share king, with a CVE from 2017 Getting CVE-2017-7494 running took longer than the exploit itself, an old Python 2 build tool, a link-order bug, a coin-flip Metasploit crash. Once it landed, Suricata proved root access straight off the wire while Wazuh logged nothing at all. Offensive SecurityDetection & Response
- It can't see it? A SYN scan against the Homelab produced zero alerts twice, for two completely unrelated infrastructure bugs, before the network layer finally caught it clean. Offensive SecurityDetection & Response
- Cerbus Part two of Splunk's BOTSv1 dataset. Bob Smith plugged a parking-lot USB drive into his desktop, and I spent Scenario 2 tracing what happened next: a macro, a VBScript nobody could just read, two dead ends counting encrypted files, and a ransomware payload hiding inside a jpeg. Detection & Response
- Batman?! Splunk's BOTSv1 dataset handed me 33 million events and asked who defaced Wayne Enterprises' website. I chased Po1s0n1vy through Joomla logs, got the defacement mechanism wrong twice, and found proof of a stolen admin login hiding in a session cookie instead of the login event itself. Detection & Response
- Writing my own detection rule Wazuh's built-in rules flagged my /etc/passwd path traversal as a generic level-6 web attack. Writing a custom rule to make it scream instead taught me the difference between running a SIEM and doing detection engineering. Detection & Response
- Attempt, 200. I just want to fix it already. Throwing SQLi, XSS, and path traversal at DVWA and watching every single one collapse into the same Wazuh alert, and what that taught me about what a log-based SIEM can and can't actually see. Offensive SecurityDetection & Response
- FIM! Setting up File Integrity Monitoring in Wazuh and learning how something small is actually big. It's knowing what normal looks like well enough to notice when it stops being normal. Detection & Response
- Wazuh's Brute-Force Alerts Running hydra against my own SSH login taught me that Wazuh doesn't have one brute-force rule, it has two, and which one fires depends on whether the username you're guessing actually exists. Offensive SecurityDetection & Response
- I wiped my laptop to build a SOC in my bedroom Every SOC analyst job post wants hands-on SIEM experience. I didn't have a SIEM, so I wiped an old laptop and built one with Wazuh in Docker, including the vm.max_map_count setting that cost me half an hour. Detection & Response
- Turning my auth-log reader into a tiny SIEM A standard library Python tool that parses an auth.log once and runs four detection rules over it. The bug that nearly made it blind, and what happened when I finally pointed it at a real 2000-line log off the internet. Tooling & AutomationDetection & Response
- My first Hack The Box machine: breaking into Oopsie A complete beginner's walk through the Oopsie box, explained the way I wish it had been explained to me, including the netcat mistake that stalled me for an hour. Offensive Security
- Reading auth logs by hand before reaching for a tool A small Python script that counts failed SSH logins per IP, and what it taught me about log triage. Tooling & AutomationDetection & Response
- Writing a subnet scanner to see how host discovery works A standard library Python tool that pings a subnet for live hosts and checks common ports, and what it showed me about the network stack. NetworkingTooling & Automation
- My first socket program: a LAN chat room A console chat app in Python with a server and multiple clients, and the networking basics I picked up building it. Networking