Bharath Narayanasamy

DFIR: Core Windows Processes

Reference: TryHackMe Room "Core Windows Processes" Core Windows Processes Understanding how the Windows operating system functions as a defender is vital. Task Manager doesn't show a Parent-Child process view. That is where other utilities, such as Process…

Bharath Narayanasamy memory, Volatility, dfir

wazuh

Remotely Upgrading Wazuh Agents – CLI Method

To upgrade agents using the command line, use the agent_upgrade tool as follows: List all the agents with outdated software: /var/ossec/bin/agent_upgrade -l/var/ossec/bin/agent_upgrade -l [root@wazuh-server wazuh-user]# /var/ossec/bin/agent_upgrade -lID Name Version 001 zyberpatrol-pdc Wazuh v4.7.1 Upgrade the agent with…

Bharath Narayanasamy SIEM, wazuh

BIG-IP LTM

L4 – L7 Load Balancing

Load Balancers Despite the name, a Load Balancer does not only balance the load: some of its core functionalities are: Load Balancing: of course, it has a way to determine which server will handle a specific…

Bharath Narayanasamy LTM

BIG-IP LTM

BIG-IP LTM: Deployment Models

Deployment Methods One-armed Deployment Two-armed Deployment nPath or Direct Server Response (DSR) Deployment One-Arm Deployment In one-arm deployment, the load balancer is not physically in line of the traffic, which means that the load balancer’s ingress…

Bharath Narayanasamy LTM

BIG-IP LTM

BIG-IP LTM: Load Balancing Methods

Bharath Narayanasamy F, BIG-IP, LTM

Threat Intelligence

Threat Intelligence for SOC

Threat Intelligence is the analysis of data and information using tools and techniques to generate meaningful patterns to mitigate against potential risks associated with existing or emerging threats targeting organisations, industries, sectors or governments. There are…

Bharath Narayanasamy Threat Intel, threat_detection

Threat Hunting Threat Detection and Incident Response

Threat Detection: Detecting a Webserver Attack

LAB Setup Let's use the DIWA ( Deliberately Insecure Web Application) vulnerable created by Tim Steufmehl , to setup the victim machine. Prepare a Linux machiine with Docker installed. Follow the these instructions to install Docker on…

Bharath Narayanasamy SIEM, Elastic

Threat Intelligence

Detection Engineering vs Threat Hunting

DETECTION ENGINEERING: REINFORCING THE KNOWN Threat detection is the process of identifying threats in an organization that is actively trying to attack the endpoints, networks, devices and systems. Unlike threat hunting, a threat detection is a…

Bharath Narayanasamy threat_detection, detection_engineering

PROTECT

Linux System Hardening

Create a GRUB password grub2-mkpasswd-pbkdf2 PBKDF2 stands for Password-Based Key Derivation Function 2. It is important to note that adding a password for GRUB is not available for systems deployed using cloud service providers (such as our Linux…

Bharath Narayanasamy

SOC Analyst Threat Detection and Incident Response Intrusion Detection and Response

DFIR: Linux File System Analysis

Bharath Narayanasamy dfir, linux, incident response, detection