>_ the cyber track
Cyber Track Blog
Write-ups, attack paths and defensive notes on Active Directory, Linux, Windows and web security.
Featured articles
-
Linux Log Analysis for Defenders: auth.log, journalctl, and auditd
The Linux security model, where Linux logs live, and how auditd turns a server into a system you can investigate. Module 5 of The Complete Blue Team Course.
-
What Is a SIEM? Log Management and Security Monitoring Explained
What a SIEM actually does, how to write queries that matter, and how to manage log…
-
MITRE ATT&CK for Defenders: Mapping Detections to Techniques
How blue teams use MITRE ATT&CK to describe attacker behavior, track detection coverage, and build detections…
-
Threat Intelligence for Defenders: Turning Intel into Detections
What threat intelligence is for, the strategic, operational and tactical levels, and how defenders turn intel…
Browse all articles
-
Malware Analysis Basics for Defenders: Static vs Dynamic Analysis
Static vs dynamic malware analysis, how to set up a safe environment, and what defenders actually need from analysis. Module 14 of…
-
Cloud Security Monitoring: Shared Responsibility and Logging in AWS, Azure and GCP
The shared responsibility model, identity as the new perimeter, and the key logs in AWS, Azure and GCP. Module 15 of The…
-
Active Directory Defense: Detecting Kerberoasting, Pass-the-Hash and DCSync
Why identity attacks dominate real breaches, the three core Active Directory attack patterns, and practical hardening steps. Module 16 of The Complete…
-
SOAR and Security Automation: What to Automate and What Not To
What SOAR is actually for, how to start small with automation, and why humans stay in the loop. Module 17 of The…
-
Writing Detections with Sigma and YARA: A Beginner’s Guide
Sigma for log-based detection, YARA for files and memory, and why you must test before deploying. Module 18 of The Complete Blue…
-
SOC Metrics and Reporting: MTTD, MTTR and Communicating Risk to Leadership
Metrics that matter, how to communicate with leadership, and how to write honest post-incident reports. Module 19 of The Complete Blue Team…
-
How to Build a Blue Team Home Lab: Wazuh, Sysmon and Atomic Red Team
Why a home lab matters, a minimal useful setup, and how to practice detection realistically. Module 20 of The Complete Blue Team…
-
Blue Team Career Paths and Certifications: Security+, CySA+, BTL1 and GCIH
Common entry points, the certifications worth considering, and how to build visible proof of skill. Module 21 of The Complete Blue Team…
-
The Defender’s Mindset: Putting Blue Team Security Together
How every blue team skill connects to one core loop, why defense is a practice and not a destination, and where to…