>_ the cyber track
Cyber Track Blog
Write-ups, attack paths and defensive notes on Active Directory, Linux, Windows and web security.
Featured articles
-
Linux Log Analysis for Defenders: auth.log, journalctl, and auditd
The Linux security model, where Linux logs live, and how auditd turns a server into a system you can investigate. Module 5 of The Complete Blue Team Course.
-
What Is a SIEM? Log Management and Security Monitoring Explained
What a SIEM actually does, how to write queries that matter, and how to manage log…
-
MITRE ATT&CK for Defenders: Mapping Detections to Techniques
How blue teams use MITRE ATT&CK to describe attacker behavior, track detection coverage, and build detections…
-
Threat Intelligence for Defenders: Turning Intel into Detections
What threat intelligence is for, the strategic, operational and tactical levels, and how defenders turn intel…
Browse all articles
-
Active Directory ACLs and Attack Paths: How Small Permissions Become Domain Admin
SIDs, DACLs, ACEs and the dangerous rights (GenericAll, WriteDACL, WriteOwner, AddMember, ForceChangePassword) that form BloodHound-style attack paths, plus how to audit and…
-
Group Policy Security: SYSVOL, GPO Permissions, and the cpassword Legacy
How Group Policy and SYSVOL work, why GPO edit permissions are a domain-wide code-execution risk, the GPP cpassword exposure, and how to…
-
Active Directory Delegation: Unconstrained, Constrained, and RBCD Risks
Kerberos delegation explained: unconstrained vs constrained vs resource-based delegation, TrustedForDelegation, how each is abused, and PowerShell commands to audit and harden delegation.
-
Active Directory Certificate Services (AD CS): Auditing Templates Before They Become Domain Admin
Why AD CS is a major attack surface: enterprise CAs, certificate templates, enrollment permissions and ESC-style misconfigurations, plus how to inventory, audit,…
-
SMB Signing and NTLM Relay: Closing the Quiet Path to Lateral Movement
How SMB authentication works, why SMB signing stops NTLM relay, and how to audit signing requirements across the fleet with PowerShell, then…
-
LDAP and LDAP Signing in Active Directory: Channel Binding, Relay, and Hardening
How Active Directory uses LDAP and LDAPS, why unsigned binds and missing channel binding enable relay attacks, and how to audit domain…
-
NTLM Authentication: Pass-the-Hash, Relay, and Why Enterprises Are Retiring It
Understand the NTLM challenge-response protocol, NTLMv1 vs NTLMv2, Pass-the-Hash and NTLM relay, where NTLM still lives in the enterprise, and how to…
-
Kerberos in Active Directory: How It Works, How It Is Abused, and How to Defend It
A deep dive into Kerberos authentication in Active Directory: AS-REQ/AS-REP, TGT/TGS, SPNs, delegation, Kerberoasting and AS-REP roasting, plus detection, auditing and hardening.
-
TryHackMe vs Hack The Box: Which Should You Learn On First?
TryHackMe (THM) and Hack The Box (HTB) are the two giants of hands-on cybersecurity training. Beginners constantly ask which to start with,…