NetwerkLABS

Investigate SQLi attacks using Splunk

Sure! Here are a few Splunk queries that can help detect web application attacks: Detecting SQL Injection Attacks: index=<your_index> sourcetype=<your_sourcetype> | search (request_uri=*' OR referer=*) AND (|inputlookup sql_injection_keywords.csv) Detecting Cross-Site…

Bharath Narayanasamy

SOC Analyst

Cybersecurity playbook for SOC

Developing a comprehensive cybersecurity playbook for a Security Operations Center (SOC) requires a systematic approach to address various aspects of cybersecurity operations. Below is a suggested structure for a SOC…

Bharath Narayanasamy

Privilege Escalation

Linux Privilege Escalation Techniques

Linux privilege escalation techniques involve methods that allow a user to gain higher privileges or escalate their existing privileges to gain unauthorized access or perform actions they wouldn't typically be…

Bharath Narayanasamy

Threat Hunting Threat Detection and Incident Response

Splunk Threat Hunting – Windows Events

When performing threat hunting using Splunk on Windows systems, there are several important queries you can use to identify potential threats and security incidents. Here are some examples: Detecting Suspicious…

Bharath Narayanasamy

Threat Detection and Incident Response

Windows Event IDs to monitor/investigation

SOC (Security Operations Center) teams typically monitor various Windows event IDs to detect and respond to security incidents. While the specific event IDs may vary depending on the organization's security…

Bharath Narayanasamy

Privilege Escalation

Privilege Escalation – WINDOWS

Post Exploit Enumeration # Basics systeminfo hostname systeminfo | findstr /B /C:"OS Name" /C:"OS Version" # Who am I? whoami echo %username% # What users/localgroups are on the machine? net…

Bharath Narayanasamy

Enumeration

CrackMapExec Cheat Sheet

Bharath Narayanasamy

Cisco ISE

Cisco ISE licensing

Cisco ISE licenses Source: Cisco Evaluation Cisco ISE, upon installation, grants a 90-day Evaluation license that supports 100 endpoints and enables all Cisco ISE features. You can set up a…

Bharath Narayanasamy

Practical LABS VulnLAB

VulnHUB PwnBox-init: Walkthrough

Lab setup Enumeration Nmap scan └─$ nmap -sC -sV -p- -A -T5 172.16.1.116 -oN pwnbox.txt Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-01 16:21 CEST Nmap scan report for 172.16.1.116…

Bharath Narayanasamy

Privilege Escalation

Linux Privilege Escalation: The PATH Environment Variable (PATH Abuse)

LAB setup Attack Box: KALI Linux or ParrotOS Victim machine: VulnHUB VM: OS-Bytesec Initial Access Read this article to learn how to gain initial access to the victim machine. SSH…

Bharath Narayanasamy