An amplification attack makes someone else's server do the shouting. DoS → One source floods the target DDoS → Many sources at once 1. Amplified: Small request, huge reply • Reflected: Spoofed source, victim gets replies The attacker whispers. The victim hears the roar.

Normal people count sheep. Cybersecurity people count the skills they still need to learn. Somehow, “just one more lab” becomes 2:47 AM.

What if an attacker could forge their own access tickets? A Golden Ticket attack uses a compromised KRBTGT account key to forge Kerberos tickets in Active Directory. For SOC analysts, unusual ticket activity and privilege use deserve investigation.

99% was the most stressful number in 2004. Remember burning your favorite songs with Nero? You'd stare at that progress bar, praying the CD wouldn't fail. One error and it was all over. No Spotify. Just blank CDs, patience, and memories. Who remembers this era?

A Windows account can change without a new login. 5 Event IDs that reveal account activity: 4720 → Account created 4722 → Account enabled 4724 → Password reset attempted 4725 → Account disabled 4726 → Account deleted These events help reconstruct changes to user access.

Linux troubleshooting starts with identifying what's actually broken. Package installation failing? Check dpkg and APT. DNS problems? Inspect resolution before clearing caches. Network issues? Check service status before restarting anything. Diagnose first. Repair second.

A scheduled task exists on Windows. Did it actually run? TaskName → Which task Trigger → When it should run Action → What it should execute Event ID 200 → Action started Event ID 201 → Action completed Task creation isn't proof of execution. Check Task Scheduler history.

Port 22 doesn't automatically mean SSH is running. Ports identify where services commonly communicate, but they don't prove what's actually listening. For security investigations, combine port numbers with process details, connection logs and protocol evidence.

Can’t click the phishing link if you never open the inbox. Security team sees awareness. I see 4,000 unread emails.

Paid tools or free alternatives? Vulnerability scanners cover different areas: networks, hosts, dependencies, containers, Kubernetes and web apps. The important distinction isn't price. It's what the tool can detect and whether you can validate its findings.

A new Windows service appears. Is it running? Event ID 7045 → Service installed ServiceName → Service identity ImagePath → Executable path StartType → Startup configuration Installation doesn't prove execution. Check service status and start events before concluding.

A file hash matches known malware. Case closed? Not yet. Hashes identify exact file content, but changing even one byte changes the hash. Attackers can modify files to evade hash-based detection. Investigate file behavior, process history, and origin too.

A critical file changed overnight. Was it an administrator, a software update, or an attacker? For a small business, an unnoticed change to a sensitive configuration file could create serious security risk. But detecting the change is only the beginning.

William | SOC & Detection Engineering@williamincyber.bsky.social · yesterday

A brute-force alert tells you someone tried to get in. It doesn't tell you whether they succeeded. Imagine a small business receiving repeated failed RDP login alerts. Is it an attack, a misconfigured service, or someone entering the wrong password? The alert alone can't decide.

A suspicious connection appears in your logs. What actually happened on the network? Wireshark lets analysts inspect captured packets and examine protocols, DNS queries and connection behavior. SOC lesson: A packet capture can reveal details that an alert alone cannot.

One leaked password. Multiple accounts at risk. That's the danger of Credential Stuffing. Attackers test stolen username and password combinations across different websites. The weakness isn't always the website's security. Sometimes, it's password reuse.

Some Active Directory accounts can expose password material without requiring authentication. AS-REP Roasting targets accounts with Kerberos preauthentication disabled. SOC analysts should monitor unusual AS requests and audit accounts with this setting.

A successful Windows login doesn't always mean someone sat at the keyboard. 5 logon types worth recognizing: 2 → Interactive 3 → Network 4 → Batch 5 → Service 10 → Remote Desktop The logon type reveals how access occurred, not whether it was authorized.

A security weakness is known, but the business decides not to fix it. Is that automatically negligence? Not necessarily. Risk acceptance is a deliberate decision to retain a risk. GRC lesson: Document the rationale, obtain authorized approval and review the decision regularly.

Your phone number can become an attacker's way into your accounts. SIM swapping happens when someone tricks a mobile provider into transferring your number to another SIM. Protect yourself: Set a SIM transfer PIN. Use authenticator apps instead of SMS codes where possible.

An admin account is a valuable target for attackers. Privileged Access allows users to manage sensitive systems and settings. SOC tip: Investigate unusual admin logins, permission changes, and unexpected privileged actions. More access means greater potential damage.

A brute-force alert tells you someone tried to get in. It doesn't tell you whether they succeeded. Imagine a small business receiving repeated failed RDP login alerts. Is it an attack, a misconfigured service, or someone entering the wrong password? The alert alone can't decide.

William | SOC & Detection Engineering@williamincyber.bsky.social · 2d ago

Your security dashboard can look healthy while important logs are missing. Imagine monitoring 30 endpoints. Alerts are flowing. Everything looks normal. But one critical Windows server stopped sending security events yesterday. Would you notice?

Attackers don't always need to steal passwords directly. Kerberoasting targets Active Directory service accounts by requesting Kerberos service tickets and attempting to crack them offline. For SOC analysts, unusual service ticket requests deserve investigation.

A process tree can expose suspicious execution. 5 relationships worth investigating: Word → PowerShell Excel → cmd.exe Browser → Script interpreter Service → Unknown executable PDF reader → PowerShell Unusual parent-child relationships deserve investigation, not assumptions.

Your account recovery options can become a security weakness. Even strong passwords won't help if attackers control your recovery email or phone number. Protect them: Enable MFA. Review recovery details. Remove outdated methods. Secure the way back into your account.

Same domain. Different directory locations. Different potential policy scopes. 𝗗𝗔𝗬 𝟬𝟱/𝟵𝟬 | 𝗔𝗖𝗧𝗜𝗩𝗘 𝗗𝗜𝗥𝗘𝗖𝗧𝗢𝗥𝗬 𝗙𝗢𝗥𝗘𝗦𝗧𝗦, 𝗗𝗢𝗠𝗔𝗜𝗡𝗦 𝗔𝗡𝗗 𝗢𝗨𝘀 I investigated where my existing user and workstation objects actually lived.

William | SOC & Detection Engineering@williamincyber.bsky.social · 6d ago

One domain check failed with error 1355. Was Active Directory broken, or was I missing context? 𝗗𝗔𝗬 𝟬𝟰/𝟵𝟬 | 𝗗𝗡𝗦 𝗔𝗡𝗗 𝗗𝗢𝗠𝗔𝗜𝗡 𝗙𝗨𝗡𝗖𝗧𝗜𝗢𝗡𝗔𝗟𝗜𝗧𝗬 I moved the investigation to my Windows 11 workstation to find out.

One Windows event can teach more investigation reasoning than ten tools on a CV. Event ID 4720 means a user account was created. That's the headline. The real investigation begins when you examine the fields underneath.

The signature name is the least useful part of a Suricata alert. flow_id → Ties the alert to its traffic src_ip → Who started it dest_port → Which service was hit action → Allowed or blocked The name says what matched. The rest says what happened.

Windows repair commands are useful, but knowing when to use them matters more. SFC checks system files. DISM repairs Windows components. CHKDSK checks disk errors. IPCONFIG clears DNS cache. Troubleshoot first. Understand the problem before applying a fix.

Your security dashboard can look healthy while important logs are missing. Imagine monitoring 30 endpoints. Alerts are flowing. Everything looks normal. But one critical Windows server stopped sending security events yesterday. Would you notice?

William | SOC & Detection Engineering@williamincyber.bsky.social · 3d ago

The attacker didn't need to delete the logs. Nobody was looking at them. Imagine a small business with 30 employees. Credentials get stolen. Unauthorized access goes unnoticed for days. The logs might exist, but nobody is connecting the dots.

A DNS query can reveal more than a domain name. 5 DNS record types worth knowing: A → IPv4 address AAAA → IPv6 address MX → Mail servers TXT → Text and verification data CNAME → Domain alias DNS records reveal how a domain is configured and where services point.