peter_hz

SOC Analyst | Cybersecurity | Sharing insights on threat detection, incident response & SIEM | #BlueTeam

[peter_hz @Hanzo_q]

I would like to watch the behind the scene of this segment.

[koreanoli @koreanoli]

WTF are these chinese action choreographers smokin 🥵💥

[peter_hz @Hanzo_q]

I ended up finding a typosquatted fake SharePoInt.exe, hiding in Temp, calling out to a C2 sever, launched through legit Windows DCOM service.

Full investigation writeup here:
https://t.co/an8DwPIGRM

[peter_hz @Hanzo_q]

Spent my evening hunting a 'suspicious connection via port 5678 alert '
flagged on a host named WIN-105. My job was to figure out whether this was something to worry about or just noise.
.

[peter_hz @Hanzo_q]

Those who are interested in DFIR should check SANS, they are offering a scholarship for New graduate certificate

[peter_hz @Hanzo_q]

Investigated a SIEM alert flagged for an unusual TLD (.me)

Went through WHOIS → DNS → SPF/DMARC/DKIM → VirusTotal → SIEM pivot

A suspicious TLD without failed auth or a payload
is just noise. Context is everything in alert triage.

more
https://t.co/FrATXAbPnj

#SOC

[International Cyber Digest @IntCyberDigest]

‼️🚨 This is alarming: Researchers found a one-click data exfiltration vulnerability in M365 Copilot. A single click on a trusted microsoft[.]com link let attackers pull emails, MFA codes, meeting notes, and SharePoint/OneDrive files, no permissions or second click required.

Microsoft has patched it as CVE-2026-42824, rated critical.

[peter_hz @Hanzo_q]

Tuff time ahead, this the moment when businesses increase the cost of imported goods to cover the margin. Others with deep pockets taking advantage of this by importing in bulk at a cheaper price before the raise.

[Moe @moneyacademyKE]

Imported goods from China are set to become more expensive in Kenya from 15 June.

This comes after China-related shipping costs were increased, adding about Sh12,000 for a 20ft container and Sh118,000 for a 40ft container.

[peter_hz @Hanzo_q]

@AtworiYa He is a pure reflection of the current society. I mean kila msee hapa nje Ako na price yake, now it's a matter of kama utafika bei.

[peter_hz @Hanzo_q]

Placing yourself higher in the value chain reduces competition as the barrier for entry is higher

[Poonam Soni @CodeByPoonam]

JUST IN: Google is paying SpaceX nearly $1 billion a month for GPUs.

Anthropic is paying $1.25 billion a month.

Elon Musk is renting to both his biggest rivals. and Jensen Huang is supplying the chips to everyone.

here’s the full picture:
→ Google signed a $920M/month deal with SpaceX for 110,000 NVIDIA GPUs. runs through June 2029. nearly $30 billion total.

→ Anthropic signed a $1.25B/month deal with SpaceX last month for all compute at Colossus 1.

→ both deals run on NVIDIA chips — the same ones Jensen Huang sells to everyone.

so the scoreboard right now:
Google pays Musk. Anthropic pays Musk. Musk competes with both through xAI. Jensen supplies the chips to all of them.

[peter_hz @Hanzo_q]

@Web3_Jarin Hello

[John Doe @StanleyMasinde_]

Everyday you learn a new thing just try and make sure the thing(s) you learn help bring the best out of you.

[peter_hz @Hanzo_q]

A single SIEM alert. One audit log. A fully executed intrusion — running undetected for 3 hours.
SSH brute force → malicious scripts → typosquatted domain → cryptominer.
Shell history can be deleted. Audit logs cannot.
Full case study
https://t.co/ZIsYXPVL2B
#ThreatHunting

[Kodak @its_pabloh1]

Everyday I study for 2 hours,this has been helpful to me as a student and whenever I skip a day I add 2hours to the next day. Tomorrow I'm supposed to study for 2months.

[peter_hz @Hanzo_q]

@comomtl @pinkcliper Just remember the last person in the network node can trace you. It all a matter of interest and resources. Anonymity is an illusion

[peter_hz @Hanzo_q]

@papakwesi_jr Mko na story za jaba huku...The guy suffered from stomach cancer that was as a result of these supplements gym bros usually take.

[peter_hz @Hanzo_q]

Indicators to hunt for:

• Unusually large POST requests
• Traffic to rare/low reputation domains
• Frequent small requests (beaconing)
• Multiple uploads forming a large transfer

Even normal protocols can hide malicious activity.

[peter_hz @Hanzo_q]

Day 60 of learning SOC

Today I explored detecting data exfiltration over HTTP. Attackers hide stolen data in POST requests, query strings, headers, or chunked uploads. Hunting large POST requests and unusual domains in logs can reveal suspicious uploads to external servers.

[peter_hz @Hanzo_q]

Common HTTP exfiltration techniques:

• Large POST uploads to attacker servers
• Encoded data in GET requests
• Data hidden in HTTP headers
• Chunked/multipart uploads
• HTTPS tunneling to hide payloads

[peter_hz @Hanzo_q]

https://t.co/4CBRltuY5a

[peter_hz @Hanzo_q]

DAY 59 of SOC Learning
Investigated a WordPress webshell. Logs revealed a brute-forced login, shadyshell.php upload, and commands like whoami, uname -a. https://t.co/VsbkIFCZOI confirmed privilege escalation attempt. Logs tell the story—if you know how to read them.

#SOC