Threat Detection and Incident Response

DFIR SOC Analyst Threat Detection and Incident Response

Wireshark Threat Hunting – From Packets to Indicators [HTTP: DEEP-DIVE]

HTTP/HTTP2 Deep-Dive — Wireshark DFIR // HTTP / HTTP2 — Deep-Dive Filter Reference Granular Wireshark display filters for HTTP/1.1 and HTTP/2 — request methods, path & file access, credential extraction, brute force detection, SQL injection, XSS,…

Bharath Narayanasamy wireshark

SOC Analyst Threat Detection and Incident Response Traffic Analysis

Wireshark Threat Hunting – From Packets to Indicators [SMB: DEEP-DIVE]

SMB & Windows Auth Deep-Dive — Wireshark DFIR // SMB & Windows Auth — Deep-Dive Filter Reference Granular Wireshark display filters for SMB2 file & share access (paths, users, operations, error codes), NTLM authentication flow, Kerberos…

Bharath Narayanasamy

DFIR SOC Analyst Threat Detection and Incident Response

Wireshark Threat Hunting – From Packets to Indicators

Wireshark DFIR Cheat Sheet // Wireshark DFIR Cheat Sheet Display filters, detection techniques, traffic analysis workflows, and TShark CLI commands for Digital Forensics & Incident Response. Filters are mapped to MITRE ATT&CK where applicable. Wireshark 4.x…

Bharath Narayanasamy wireshark

Threat Hunting SOC Analyst Threat Detection and Incident Response

Threat Detection Engineering

Threat Detection Engineering (TDE) involves designing, implementing, and refining security measures to identify and respond to threats. Here are some key topics and domains covered under TDE: Threat Intelligence: Gathering, analyzing, and applying information about current…

Bharath Narayanasamy THreat, TDE

SOC Analyst Threat Detection and Incident Response

MISP (Malware Information Sharing Platform)

MISP

Bharath Narayanasamy MISP

Threat Detection and Incident Response

Incident Report Template

Elements of an incident report Source: Hack The Box Incident Report Template

Bharath Narayanasamy IR, Incident_Response

DETECT SOC Analyst Threat Detection and Incident Response

Windows Event Logs

Understanding Windows Event Logs Each entry in the Windows Event Log is an "Event" and contains the following primary components: Log Name: The name of the event log (e.g., Application, System, Security, etc.). Source: The software…

Bharath Narayanasamy eventlogs, eventid

Threat Detection and Incident Response DETECT Traffic Analysis

Wireshark 101 | Packet Operations

Wireshark: Packet Operations Statistics | Summary This menu provides multiple statistics options ready to investigate to help users see the big picture in terms of the scope of the traffic, available protocols, endpoints and conversations, and…

Bharath Narayanasamy wireshark

SOC Analyst Threat Detection and Incident Response DETECT

ELASTIC SIEM: Kibana Query Language (KQL)

Different Syntax Languages Kibana supports two types of syntax languages for querying in Kibana: KQL (Kibana Query Language) and Lucene Query Syntax. Kibana Query Language (KQL) is a user-friendly query language developed by Elastic specifically for Kibana. It provides autocomplete suggestions…

Bharath Narayanasamy wazuh, kibana, KQL

Threat Hunting Threat Detection and Incident Response

Threat Detection: Detecting a Webserver Attack

LAB Setup Let's use the DIWA ( Deliberately Insecure Web Application) vulnerable created by Tim Steufmehl , to setup the victim machine. Prepare a Linux machiine with Docker installed. Follow the these instructions to install Docker on…

Bharath Narayanasamy SIEM, Elastic