Nedheesh | Cyber Defense

Independent Researcher & Consultant | Cybersecurity, SOC, Blue Teaming | Daily posts on cybersecurity, how systems work and how to learn cybersecurity

[Nedheesh | Cyber Defense @cyberReps]

A SIEM right out-of-the-box knows nothing.

It's just a fancy log collector until a cybersecurity professional teaches it what malicious activity looks like.

I learnt this the hard way building my first detection from scratch

Full walkthrough👇
https://t.co/DHo82WpDsV

[Nedheesh | Cyber Defense @cyberReps]

DAILY CYBER REP 4 (beginner)

User clicks email link.

Soon after, their machine starts beaconing to 185.220.101.45 every 60s.

What do you investigate FIRST?

A) Browser history
B) Email sender domain
C) Destination IP reputation
D) Login history

[Nedheesh | Cyber Defense @cyberReps]

@TheCyberPatron_ A false positive means SIEM raised an alert on a benign activity.

A false negative means the system didn't recognize a malicious activity.

A false negative carries significantly more impact than a a false positive.

[Nedheesh | Cyber Defense @cyberReps]

@UK_Daniel_Card Love the 21% that went "what's an LLM?"

[Nedheesh | Cyber Defense @cyberReps]

Finished a new room on TryHackMe today. I'm feeling pumped

[Nedheesh | Cyber Defense @cyberReps]

@gleeda If a detection rule I wrote resulted in THAT many FPs, I might cry.

[Nedheesh | Cyber Defense @cyberReps]

@UK_Daniel_Card fancy shmancy and fun. Right up my alley

[Nedheesh | Cyber Defense @cyberReps]

@whoischizu @Ahmed___khaan I setup two VMs in VirtualBox. Ubuntu VM for Splunk. Windows VM as my victim machine. Logs flowed from windows to Ubuntu.

Then I simulated attacks using something called Atomic Red Team. Allows you to simulate ATT&CK TTPs with just a command.

[Nedheesh | Cyber Defense @cyberReps]

@cyber_with_tega Is any of the documentation public?

I really struggle with documenting, and understanding what to document, when to document.

If I pause to document it feels like I lose momentum and flow

[Nedheesh | Cyber Defense @cyberReps]

@TheCyberPatron_ A false positive means SIEM raised an alert on a benign activity.

A false negative means the system didn't recognize a malicious activity.

A false negative carries significantly more impact than a a false positive.

[Nedheesh | Cyber Defense @cyberReps]

@TheCyberPatron_

[Cyber_Racheal @CyberRacheal]

Which protocol is responsible for translating human-readable website names (like https://t.co/F9s7YDeg1k) into numerical IP addresses?

A. DHCP

B. HTTP

C. DNS

D. SMTP

[Nedheesh | Cyber Defense @cyberReps]

@CyberRacheal DNS (Domain Name Service) translates domain names to respective IP addresses.

I recently wrote a small writeup about how this protocol is used by attackers to exfiltrate data.

https://t.co/wMs9lEUzuM

[Nedheesh | Cyber Defense @cyberReps]

@sec_hub93028 My instinct tells me the answer should be Server side Authorization and validation

[Nedheesh | Cyber Defense @cyberReps]

@Ahmed___khaan Yes, on both actually.

Tryhackme - I'm currently doing SOC level 2 learning path

LetsDefend - I use it mainly to practice alert investigation. The one thing I don't do yet is go deeper into each alert.

I tend to just follow the playbooks provided.

[Nedheesh | Cyber Defense @cyberReps]

@adrianhetman @HalbornSecurity Congratulations! What's been the best part of your journey so far?

[Nedheesh | Cyber Defense @cyberReps]

Just published a complete report on this.

check it out: https://t.co/wMs9lEUzuM

[Nedheesh | Cyber Defense @cyberReps]

@sec_hub93028 Algo doing it's job

[Nedheesh | Cyber Defense @cyberReps]

@gabbytech01 How do you decide what to pursue next?

From the plethora of tools and technologies available out there, how do you decide which system to focus your attention on when looking for a new topic to learn?