https://ashtonang.com/ Cybersecurity investigations, projects, and lessons learned by Ashton Ang. en https://ashtonang.com/blog/network-vs-host-detection/ https://ashtonang.com/blog/network-vs-host-detection/ I rebuilt my old Homelab to a more complete version. Wed, 29 Jul 2026 09:00:00 GMT Detection & Response Networking https://ashtonang.com/blog/attack-c2-beacon/ https://ashtonang.com/blog/attack-c2-beacon/ Cron logged every check-in to syslog automatically, and Wazuh ingested every line of it, but nothing in the default ruleset ever turned a plain CRON entry into an alert. Suricata caught it from a raw-IP curl heuristic instead. Tue, 28 Jul 2026 17:00:00 GMT Offensive Security Detection & Response https://ashtonang.com/blog/attack-samba-cve-exploit/ https://ashtonang.com/blog/attack-samba-cve-exploit/ Getting CVE-2017-7494 running took longer than the exploit itself, an old Python 2 build tool, a link-order bug, a coin-flip Metasploit crash. Once it landed, Suricata proved root access straight off the wire while Wazuh logged nothing at all. Tue, 28 Jul 2026 13:00:00 GMT Offensive Security Detection & Response https://ashtonang.com/blog/attack-nmap-scan/ https://ashtonang.com/blog/attack-nmap-scan/ A SYN scan against the Homelab produced zero alerts twice, for two completely unrelated infrastructure bugs, before the network layer finally caught it clean. Tue, 28 Jul 2026 09:00:00 GMT Offensive Security Detection & Response https://ashtonang.com/blog/cerbus/ https://ashtonang.com/blog/cerbus/ Part two of Splunk's BOTSv1 dataset. Bob Smith plugged a parking-lot USB drive into his desktop, and I spent Scenario 2 tracing what happened next: a macro, a VBScript nobody could just read, two dead ends counting encrypted files, and a ransomware payload hiding inside a jpeg. Sun, 26 Jul 2026 15:00:00 GMT Detection & Response https://ashtonang.com/blog/batman/ https://ashtonang.com/blog/batman/ Splunk's BOTSv1 dataset handed me 33 million events and asked who defaced Wayne Enterprises' website. I chased Po1s0n1vy through Joomla logs, got the defacement mechanism wrong twice, and found proof of a stolen admin login hiding in a session cookie instead of the login event itself. Tue, 21 Jul 2026 14:00:00 GMT Detection & Response https://ashtonang.com/blog/custom-detection-rule/ https://ashtonang.com/blog/custom-detection-rule/ Wazuh's built-in rules flagged my /etc/passwd path traversal as a generic level-6 web attack. Writing a custom rule to make it scream instead taught me the difference between running a SIEM and doing detection engineering. Wed, 15 Jul 2026 15:00:00 GMT Detection & Response https://ashtonang.com/blog/web-attack-detection/ https://ashtonang.com/blog/web-attack-detection/ Throwing SQLi, XSS, and path traversal at DVWA and watching every single one collapse into the same Wazuh alert, and what that taught me about what a log-based SIEM can and can't actually see. Wed, 15 Jul 2026 13:00:00 GMT Offensive Security Detection & Response https://ashtonang.com/blog/file-integrity-monitoring/ https://ashtonang.com/blog/file-integrity-monitoring/ Setting up File Integrity Monitoring in Wazuh and learning how something small is actually big. It's knowing what normal looks like well enough to notice when it stops being normal. Wed, 15 Jul 2026 12:00:00 GMT Detection & Response https://ashtonang.com/blog/ssh-bruteforce/ https://ashtonang.com/blog/ssh-bruteforce/ Running hydra against my own SSH login taught me that Wazuh doesn't have one brute-force rule, it has two, and which one fires depends on whether the username you're guessing actually exists. Wed, 15 Jul 2026 08:00:00 GMT Offensive Security Detection & Response https://ashtonang.com/blog/soc-lab-setup/ https://ashtonang.com/blog/soc-lab-setup/ Every SOC analyst job post wants hands-on SIEM experience. I didn't have a SIEM, so I wiped an old laptop and built one with Wazuh in Docker, including the vm.max_map_count setting that cost me half an hour. Tue, 14 Jul 2026 09:00:00 GMT Detection & Response https://ashtonang.com/blog/mini-siem/ https://ashtonang.com/blog/mini-siem/ A standard library Python tool that parses an auth.log once and runs four detection rules over it. The bug that nearly made it blind, and what happened when I finally pointed it at a real 2000-line log off the internet. Sun, 12 Jul 2026 00:00:00 GMT Tooling & Automation Detection & Response https://ashtonang.com/blog/oopsie-hackthebox/ https://ashtonang.com/blog/oopsie-hackthebox/ A complete beginner's walk through the Oopsie box, explained the way I wish it had been explained to me, including the netcat mistake that stalled me for an hour. Sun, 14 Jun 2026 00:00:00 GMT Offensive Security https://ashtonang.com/blog/ssh-failed-login-analyzer/ https://ashtonang.com/blog/ssh-failed-login-analyzer/ A small Python script that counts failed SSH logins per IP, and what it taught me about log triage. Wed, 10 Jun 2026 00:00:00 GMT Tooling & Automation Detection & Response https://ashtonang.com/blog/subnet-scanner/ https://ashtonang.com/blog/subnet-scanner/ A standard library Python tool that pings a subnet for live hosts and checks common ports, and what it showed me about the network stack. Thu, 28 May 2026 00:00:00 GMT Networking Tooling & Automation https://ashtonang.com/blog/lan-chat-room/ https://ashtonang.com/blog/lan-chat-room/ A console chat app in Python with a server and multiple clients, and the networking basics I picked up building it. Tue, 12 May 2026 00:00:00 GMT Networking