SOCMinute

Cybersecurity signal, minus the noise.
Daily SOC/blue team news, breakdowns & alerts.
New ebook out now ⬇️

[SOCMinute @SOCMinute]

Most junior analysts jump from "alert fired" to "conclusion" in one step.

The gap between those two things is where real investigation happens. Here's the mental model I use: 🧵

[SOCMinute @SOCMinute]

6. I walk through this exact process with guided scenarios and checklists in From Alert to Evidence. Launch price $14.90 through Aug 9. https://t.co/p3tCxZPsC8

[SOCMinute @SOCMinute]

Most investigations don't fail because analysts lack data.

They fail because the data lives in five different tools with five different clocks, and nobody lines it up. Here's how to build a timeline that actually holds up: 🧵

[SOCMinute @SOCMinute]

5.The timeline is what makes an escalation defensible. If a senior analyst or IR lead can't see how you got from event A to conclusion B, the investigation isn't finished — it's just a guess with good formatting.

[SOCMinute @SOCMinute]

CISA has added CVE-2026-8037, a critical Progress LoadMaster command injection vulnerability, to its KEV catalog. This flaw is actively exploited—patch immediately to reduce risk. #CISA #ProgressLoadMaster #VulnerabilityManagement #BOD2604

[SOCMinute @SOCMinute]

North Carolina Ports Authority confirms a cyberattack affecting Wilmington, Morehead City, and Charlotte Inland Port operations. This incident highlights vulnerabilities in key supply chain infrastructure and the need for strong detection and response measures. #SOCMinute #Cyber…

[SOCMinute @SOCMinute]

UNC6671 is targeting employees' personal phones with vishing attacks to steal SaaS credentials. SOC teams must adapt detection and training for this evolving social engineering tactic. #Vishing #SOCMinute #PersonalDeviceSecurity #SaaSCredentials

[SOCMinute @SOCMinute]

Almost 800 malicious npm packages with typo-squatted AI names are distributing a remote access trojan and infostealer across Windows, Mac, and Linux. SOC teams must audit npm dependencies closely. Follow @SOCMinute for critical updates. #npm #Malware #SOC

[SOCMinute @SOCMinute]

A significant data breach at Unlimited Technology Systems exposed 3.8 million healthcare records. Healthcare cybersecurity teams must prioritize access controls and incident response. Stay vigilant. #DataBreach #HealthcareSecurity #SOCAnalyst #IncidentResponse

[SOCMinute @SOCMinute]

A critical zero-day SQL injection in Metabase is actively exploited to steal sensitive data from analytics platforms. SOC teams must prioritize detection of suspicious queries and deploy patches immediately. Stay updated with SOC Minute. #Metabase #SQLInjection #ZeroDay

[SOCMinute @SOCMinute]

Microsoft 365 payroll and finance emails are under AitM phishing attack. Attackers use residential proxies to mask logins. Strengthen MFA and watch for unusual sign-ins. #Microsoft365 #Phishing #MFA #EmailSecurity #SOCMinute

[SOCMinute @SOCMinute]

Launch price for From Alert to Evidence ends in 2 days.

After that it goes back to full price. If you've been meaning to grab it, this is the window.

https://t.co/p3tCxZPsC8

[SOCMinute @SOCMinute]

Multiple high-severity vulnerabilities detected in ABB Ability Zenon IIoT's embedded MongoDB. Update or uninstall to prevent unauthorized access and data risks. #ABBAbilityZenon #MongoDB #IIoT #CriticalInfrastructure #PatchManagement

[SOCMinute @SOCMinute]

Attackers compile the Khunt post-exploitation toolkit inside Oracle databases using SQL injection, bypassing traditional defenses. Secure your Oracle instances and monitor SQL activity closely. #Oracle #SQLInjection #KhuntToolkit #SOCMinute

[SOCMinute @SOCMinute]

Cisco has released patches for 12 critical vulnerabilities in SD-WAN and IOS XE devices, including three rated 9.8 CVSS. SOC teams managing Cisco infrastructure should patch immediately to prevent remote code execution and denial of service risks. #Cisco #SDWAN #Cybersecurity

[SOCMinute @SOCMinute]

Meta’s AI model unintentionally hacked a company during a misconfigured cybersecurity test. This highlights the need for SOC teams to vigilantly monitor AI-driven security tools and verify testing setups. #Meta #AIrisks #SOC #Cybersecurity

[SOCMinute @SOCMinute]

5. I put this whole process, timelines, hypothesis testing, ticket writing, into a practical ebook: From Alert to Evidence.

$14.90 through Aug 9.

https://t.co/p3tCxZPsC8

[SOCMinute @SOCMinute]

Most junior analysts jump from "alert fired" to "conclusion" in one step.

The gap between those two things is where real investigation happens. Here's the mental model I use: 🧵

[SOCMinute @SOCMinute]

4. Your ticket note should let someone else reconstruct your reasoning, not just your conclusion. If they can't tell what you ruled out, the escalation isn't defensible.