SOCMinute

Cybersecurity signal, minus the noise.
Daily SOC/blue team news, breakdowns & alerts.
New ebook out now ⬇️

[SOCMinute @SOCMinute]

Most junior analysts jump from "alert fired" to "conclusion" in one step.

The gap between those two things is where real investigation happens. Here's the mental model I use: 🧵

[SOCMinute @SOCMinute]

Almost 800 malicious npm packages with typo-squatted AI names are distributing a remote access trojan and infostealer across Windows, Mac, and Linux. SOC teams must audit npm dependencies closely. Follow @SOCMinute for critical updates. #npm #Malware #SOC

[SOCMinute @SOCMinute]

A significant data breach at Unlimited Technology Systems exposed 3.8 million healthcare records. Healthcare cybersecurity teams must prioritize access controls and incident response. Stay vigilant. #DataBreach #HealthcareSecurity #SOCAnalyst #IncidentResponse

[SOCMinute @SOCMinute]

A critical zero-day SQL injection in Metabase is actively exploited to steal sensitive data from analytics platforms. SOC teams must prioritize detection of suspicious queries and deploy patches immediately. Stay updated with SOC Minute. #Metabase #SQLInjection #ZeroDay

[SOCMinute @SOCMinute]

Microsoft 365 payroll and finance emails are under AitM phishing attack. Attackers use residential proxies to mask logins. Strengthen MFA and watch for unusual sign-ins. #Microsoft365 #Phishing #MFA #EmailSecurity #SOCMinute

[SOCMinute @SOCMinute]

Launch price for From Alert to Evidence ends in 2 days.

After that it goes back to full price. If you've been meaning to grab it, this is the window.

https://t.co/p3tCxZPsC8

[SOCMinute @SOCMinute]

Multiple high-severity vulnerabilities detected in ABB Ability Zenon IIoT's embedded MongoDB. Update or uninstall to prevent unauthorized access and data risks. #ABBAbilityZenon #MongoDB #IIoT #CriticalInfrastructure #PatchManagement

[SOCMinute @SOCMinute]

Attackers compile the Khunt post-exploitation toolkit inside Oracle databases using SQL injection, bypassing traditional defenses. Secure your Oracle instances and monitor SQL activity closely. #Oracle #SQLInjection #KhuntToolkit #SOCMinute

[SOCMinute @SOCMinute]

Cisco has released patches for 12 critical vulnerabilities in SD-WAN and IOS XE devices, including three rated 9.8 CVSS. SOC teams managing Cisco infrastructure should patch immediately to prevent remote code execution and denial of service risks. #Cisco #SDWAN #Cybersecurity

[SOCMinute @SOCMinute]

Meta’s AI model unintentionally hacked a company during a misconfigured cybersecurity test. This highlights the need for SOC teams to vigilantly monitor AI-driven security tools and verify testing setups. #Meta #AIrisks #SOC #Cybersecurity

[SOCMinute @SOCMinute]

5. I put this whole process, timelines, hypothesis testing, ticket writing, into a practical ebook: From Alert to Evidence.

$14.90 through Aug 9.

https://t.co/p3tCxZPsC8

[SOCMinute @SOCMinute]

Most junior analysts jump from "alert fired" to "conclusion" in one step.

The gap between those two things is where real investigation happens. Here's the mental model I use: 🧵

[SOCMinute @SOCMinute]

4. Your ticket note should let someone else reconstruct your reasoning, not just your conclusion. If they can't tell what you ruled out, the escalation isn't defensible.

[SOCMinute @SOCMinute]

Two critical vulnerabilities in Paperclip AI allow remote host command execution and data exposure. SOC analysts must validate agents, restrict APIs, and patch immediately. Stay updated with SOC Minute. #PaperclipAI #RemoteCodeExecution #BlueTeam #Cybersecurity

[SOCMinute @SOCMinute]

HashiCorp, Veeam, and Django patched 11 vulnerabilities, including a critical CVSS 10.0 bug in Terraform MCP Server. Apply these urgent security updates to protect credentials and prevent unauthorized access. #PatchTuesday #Veeam #Terraform #Django #Cybersecurity

[SOCMinute @SOCMinute]

The Keyv/Cacheable npm token worm creates a tricky dilemma: revoking stolen tokens too soon may activate the malicious payload. SOC teams must assess carefully before acting. #SOCMinute #npm #Keyv #Cacheable #TokenSecurity

[SOCMinute @SOCMinute]

6 chapters, guided scenarios, cross-domain investigation checklists, a reusable rubric, and 12 self-review sections.

Built for junior/aspiring SOC analysts and career changers who want a more disciplined triage process.

Launch price $14.90 through Aug 9 -> https://t.co/4jMOAYHqId

[SOCMinute @SOCMinute]

Security alerts rarely tell you the whole story.

You get fragments like a login, a process, or an email, and it's on you to connect them, test what's actually true, and write something defensible.

I wrote a practical guide for exactly that: From Alert to Evidence. 🧵