Cybersecurity playbook for SOC

by

Views: 15Developing a comprehensive cybersecurity playbook for a Security Operations Center (SOC) requires a systematic approach to address various aspects of cybersecurity operations. Below is a suggested structure for a SOC playbook: 1. Introduction and Scope    – Provide an overview of the playbook’s purpose, target audience, and scope.    – Clearly define the responsibilities … Read more

Linux Privilege Escalation Techniques

by

Views: 20Linux privilege escalation techniques involve methods that allow a user to gain higher privileges or escalate their existing privileges to gain unauthorized access or perform actions they wouldn’t typically be allowed to do. It’s important to note that discussing these techniques can be considered unethical and potentially illegal if used for malicious purposes. However, … Read more

Splunk Threat Hunting – Windows Events

by

Views: 41When performing threat hunting using Splunk on Windows systems, there are several important queries you can use to identify potential threats and security incidents. Here are some examples: This query looks for event code 4688, which indicates process creation events. It filters out known Splunk-related processes to focus on potentially suspicious activities. This query … Read more

Windows Event IDs to monitor/investigation

by

Views: 17SOC (Security Operations Center) teams typically monitor various Windows event IDs to detect and respond to security incidents. While the specific event IDs may vary depending on the organization’s security policies and requirements, here are some commonly monitored Windows event IDs: It’s important to note that the specific event IDs to monitor may vary … Read more

Cisco ISE licensing

by

Views: 9 Cisco ISE licenses Source: Cisco Evaluation Cisco ISE, upon installation, grants a 90-day Evaluation license that supports 100 endpoints and enables all Cisco ISE features. You can set up a limited deployment in Evaluation mode and explore all the capabilities and features within Cisco ISE.

Linux Privilege Escalation

by

Views: 12Privilege escalation is all about: Collect – Enumeration, more enumeration and some more enumeration. Process – Sort through data, analyse and prioritisation. Search – Know what to search for and where to find the exploit code. Adapt – Customize the exploit, so it fits. Not every exploit work for every system “out of the … Read more