it-learn.io

This account posts about: Cybersecurity | Networking | Zero Trust
Tips, Demos & Insights | 💻 |

[it-learn.io @it_learn_io]

$240K. No degree. The SOC analyst is dead.

The SOC industry quietly restructured itself in 18 months. One role pulled away with software-engineer comp: the Detection Engineer.

3-4× the pay. No on-call at well-run shops. Zero required certs.

New TechUpdates ↓

[it-learn.io @it_learn_io]

Link to the episode here --> https://t.co/veL0zrrjs0

[it-learn.io @it_learn_io]

$240K. No degree. The SOC analyst is dead.

The SOC industry quietly restructured itself in 18 months. One role pulled away with software-engineer comp: the Detection Engineer.

3-4× the pay. No on-call at well-run shops. Zero required certs.

New TechUpdates ↓

[it-learn.io @it_learn_io]

Hunting checklist:

✅ Autoruns (Sysinternals) — the single best tool
✅ Compare against known-good baseline
✅ Check all 5 locations above
✅ Review recently created accounts
✅ Check for Golden/Silver Tickets

Deploy Sysmon with a good config (SwiftOnSecurity's). You'll see every...

[it-learn.io @it_learn_io]

Attacker persistence on Windows — every technique and how to find it.

Red team plants these. Blue team hunts them.

🧵 👇

[it-learn.io @it_learn_io]

5. DLL Hijacking

Attacker drops a malicious DLL where a legitimate program searches.

Detect:
Process Monitor → filter for NAME NOT FOUND + .dll
Sigcheck -u C:\Windows\System32\*.dll (unsigned DLLs)

Harder to find. Requires baseline comparison.

[it-learn.io @it_learn_io]

🔴 This Python code handles user authentication. Find the bug:

import hashlib

def check_password(input_pw, stored_hash):
input_hash = hashlib.md5(input_pw.encode()).hexdigest()
if input_hash == stored_hash:
return True
return False

Two critical issues. Na...

[it-learn.io @it_learn_io]

Log4Shell (CVE-2021-44228) explained with actual payloads.

The most impactful vulnerability of the decade.

🧵 👇

[it-learn.io @it_learn_io]

🗳️ You find an unknown SUID binary on a production server.

Your first move?

[it-learn.io @it_learn_io]

Cisco IOS commands for a quick security audit:

show running-config | include password
show ip interface brief
show access-lists
show logging
show users
show privilege

Run these on every switch/router during your next audit.

🔖 Bookmark this.

[it-learn.io @it_learn_io]

Detection:

1. Monitor for unexpected mount syscalls
2. Alert on container processes accessing /dev/sda*
3. Audit docker.sock access
4. Check: docker inspect <id> | grep -i privileged
5. Deploy Falco for runtime container security

Assume containers will be compromised. Design...

[it-learn.io @it_learn_io]

Container escape techniques — and how to prevent every single one.

If you run Docker in production, this thread is mandatory reading.

🧵 👇

[it-learn.io @it_learn_io]

Escape #4: Writable hostPath

In Kubernetes:
volumes:
- hostPath:
path: /

Container writes to host filesystem directly.

Prevention:
- PodSecurityPolicy / PodSecurity admission
- Block hostPath mounts
- Use ReadOnlyRootFilesystem: true

[it-learn.io @it_learn_io]

🔴 Spot the misconfiguration:

server {
listen 80;
server_name https://t.co/AP9sekrYe3;

location / {
proxy_pass http://backend:3000;
add_header Access-Control-Allow-Origin *;
}
}

Two issues. Can you find both? 👇