priest

cybersecurity specialist @ Tipsfame |Soc analyst|vulnerability management | Hands on breakdowns of real attacks and defenses, tested on my own setup.

[priest @cyberpriest_]

The hardest part of SOC work isn’t catching the incident, it’s knowing which alert deserves your full attention first when twenty are screaming at once. Nobody teaches you that in a course

[priest @cyberpriest_]

IOCs tell you an attacker was here. Behavior tells you one is here right now. So why are we still hunting known bad IPs and file hashes?

[priest @cyberpriest_]

IOCs tell you an attacker was here. Behavior tells you one is here right now. So why are we still hunting known bad IPs and file hashes?

[priest @cyberpriest_]

New SOC, zero budget, 200 endpoints. What SIEM are you deploying day one?

[priest @cyberpriest_]

No lies told😂😹

[priest @cyberpriest_]

No lies told😂😹

[priest @cyberpriest_]

Raw Sysmon =a firehouse of noise
Sysmon + SwiftOnSecurity config = curated telemetry with rule context in every event.This Event ID 13? The RuleName field already tells me what triggered it before I even read the details. Stop running Sysmon bare. The config is free on GitHub.

[priest @cyberpriest_]

Config by @SwiftOnSecurity : https://t.co/pxhU4PwJVq

Install: sysmon.exe -accepteula -i sysmonconfig-export.xml

[priest @cyberpriest_]

Raw Sysmon =a firehouse of noise
Sysmon + SwiftOnSecurity config = curated telemetry with rule context in every event.This Event ID 13? The RuleName field already tells me what triggered it before I even read the details. Stop running Sysmon bare. The config is free on GitHub.

[priest @cyberpriest_]

Two years ago I googled “what does a soc analyst actually do.”Today I’m the one testing the tools before I post about them.Progress doesn’t feel like progress while it’s
happening. It only shows up when you look back far enough🤷

[priest @cyberpriest_]

Two years ago I googled “what does a soc analyst actually do.”Today I’m the one testing the tools before I post about them.Progress doesn’t feel like progress while it’s
happening. It only shows up when you look back far enough🤷

[priest @cyberpriest_]

Sysmon logs your whole endpoint except one thing, itself getting killed. One privileged command unloads the driver and your visibility goes dark, silently. That’s your real blind spot. Not something a course teaches. Something you learn from priest

[priest @cyberpriest_]

Sysmon logs your whole endpoint except one thing, itself getting killed. One privileged command unloads the driver and your visibility goes dark, silently. That’s your real blind spot. Not something a course teaches. Something you learn from priest

[priest @cyberpriest_]

As a SOC analyst, one of the most common breach attempts I see doesn’t touch a single vulnerability.

It’s just a job interview.

Here’s how it actually plays out 🧵

[priest @cyberpriest_]

@Ahmed___khaan This command simply scans all tcp ports on the network with double the speed due to -T4- while also checking for the version and OS

[priest @cyberpriest_]

More of these coming, real breach patterns from the SOC floor, not textbook theory.

#CyberSecurity #InfoSec #SOC

[priest @cyberpriest_]

As a SOC analyst, one of the most common breach attempts I see doesn’t touch a single vulnerability.

It’s just a job interview.

Here’s how it actually plays out 🧵

[priest @cyberpriest_]

If a meeting link changes last minute, verify it through a second channel before you click. Every time.

Has your team run into this one? Curious how others are training people to catch it.