Okunnuwa Joshua . G

Cybersecurity Analyst | Security+ & ISC2 CC Certified | Active Directory | ELK SIEM | Blue Team | Threat Detection | Incident Response | Lifelong Learner.

[Okunnuwa Joshua . G @247shield]

The joy of the Lord is my strength ❤️

[Okunnuwa Joshua . G @247shield]

@WilliamInCyber Every night and day… we keep pushing putting in the work, hoping it pays off one day.

[Hallelujah Challenge @HC_XFamily]

The lord has done it in finally, Tweet it into Existence 🤲🏼

[Okunnuwa Joshua . G @247shield]

@WilliamInCyber I wrote a 63-page book when I was preparing for my ISC 2 and Comptia + at first, I felt like I was crazy but in reality, it did help me.

[Okunnuwa Joshua . G @247shield]

@Wakaholic_nurse They should send this lady out of that premises.

It's disrespectful to call him Tony.

What happened to “Good Morning Sir” “Good morning chairman” or “Good Morning Mr Tony”

[Okunnuwa Joshua . G @247shield]

@ruffydfire This almost made me cry. It further showed the level of respect, unity, and family bonds among the Adelekes. To go far in life you need a family like the Adelekes. The love and support they have shown to each other is just so massive.

[Okunnuwa Joshua . G @247shield]

🏠 Home Lab Series — Phase 2: Mapping the Attack Surface with BloodHound

Phase 1 was about getting credentials 🔑

Phase 2 is about figuring out what those credentials can actually reach.

My objective:

➡️ Run SharpHound

➡️ Load the data into BloodHound

➡️ Find a realistic path toward Domain Admin

➡️ Explain the finding in plain English

Then came the interesting part.

🔍 The finding:

BloodHound showed that a Domain Admin had an active session on a server accessible to a low-privileged domain user.

That creates a potential credential-exposure risk if an attacker gains access to that server, depending on the system's configuration and credential protections.

The lesson?

BloodHound isn't just about drawing pretty graphs.

It's about answering:

"If an attacker gets this account, where can they go next?"

Most privilege escalation isn't always a flashy exploit.

Sometimes it's simply:

Weak permissions + privileged sessions + poor AD hygiene.

Next up in Phase 3:

⚔️ Lateral Movement & Escalation

#CyberSecurity #ActiveDirectory #BloodHound #HomeLab #BlueTeam #RedTeam

[Okunnuwa Joshua . G @247shield]

Here are some lists of event IDs:

Account management events:

4720 = Born 👶 → account created

4722 = Activated 🟢 → account enabled

4724 = Password 🔑 → password reset

4725 = Disabled 🔴 → account disabled

4726 = Deleted 🗑️ → account deleted

4738 = Changed ✏️ → account modified

Logon events:

2 → Local (Keyboard logon)

3 → Network logon

10 → Remote/RDP interactive logon

11 → Cached Credentials logon

4624 → Successful Logon

4625 → Failed Logon

4648 → Explicit Credentials Logon

[Okunnuwa Joshua . G @247shield]

As I navigate and keep building my practical knowledge through my SOC homelab environment.

I realize the importance of knowing event IDs at a glance.

A Cybersecurity SOC analyst needs to be very familiar with event IDs and what they actually mean when they see them.

[Mel Gibson @MelGi1bson]

Jesus Christ went through pain for us.
The nails didn't hold Him on the cross. Love did.❤️
Jesus Christ did not die for abomination. He died to save us from it.🙏

[William · SOC Analyst (Tier 1) @WilliamInCyber]

You and I may not have professional cybersecurity experience yet.

But our home labs can become interview practice.

I gave my cousin 10 questions. He randomly calls me on video, and I have to answer while looking directly at him. No notes.

[Okunnuwa Joshua . G @247shield]

Phase 2 of my AD-ELK SIEM lab starts soon...

Phase 1 was about getting credentials.

Get in 🔑

LLMNR → Password Spraying → Kerberoasting → AS-REP Roasting

Phase 2 is about figuring out what those credentials can actually do.

Map the terrain 🗺️

SharpHound → BloodHound → Attack paths → Privilege relationships → Lateral movement

[Okunnuwa Joshua . G @247shield]

@WilliamInCyber It can't be later 😆

I've just rounded up phase 1 of my ELK-SIEM detection and response lab.

Where I simulated:
LLMNR poisoning
Password Spraying attack
Kerberoasting
AS-REP roasting

Moving to my next phase …

[Okunnuwa Joshua . G @247shield]

5️⃣ Re-enabled RC4 on the lab account to reproduce the classic Kerberoasting scenario
6️⃣ Cracked the ticket offline with John the Ripper

The result:

Summer2026! → ❌ Not cracked
Password1! → ✅ Cracked instantly

Same attacker. Same tools. Same access.

[Okunnuwa Joshua . G @247shield]

🔐 Home Lab Series — Phase 1, Technique 3: Kerberoasting

Continuing my AD attack/defense home lab (Sysmon + Winlogbeat + ELK).

Kerberoasting is one of the AD techniques I wanted to understand properly because a valid domain login can be enough to request a service ticket.

[Okunnuwa Joshua . G @247shield]

What I did:

1️⃣ Created svc_sql with an SPN
2️⃣ Confirmed Event 4769 logging
3️⃣ Requested the ticket using Impacket's https://t.co/pT3bkkRn3F with a low-privileged domain account
4️⃣ Hit KDC_ERR_ETYPE_NOSUPP and discovered my environment was using AES-only encryption

[Mel Gibson @MelGibson_1th]

Thank you, Lord Jesus, for willingly carrying the crushing weight of the cross and taking my place on that hill. 😭💔

[Okunnuwa Joshua . G @247shield]

@Quamclips Abi Brymo don dey crase small small?

[Okunnuwa Joshua . G @247shield]

@WilliamInCyber Thank you so much 🙏. I'm never going to give up.

[Okunnuwa Joshua . G @247shield]

Cybersecurity isn’t easy.

It demands hard work, dedication, and constant learning.

I’m embracing the process, staying curious, and putting in the work.

My goal isn’t just to be in the field.

I want to be one of the best. 🔐💻