>_ the cyber track
Cyber Track Blog
Write-ups, attack paths and defensive notes on Active Directory, Linux, Windows and web security.
Featured articles
-
Linux Log Analysis for Defenders: auth.log, journalctl, and auditd
The Linux security model, where Linux logs live, and how auditd turns a server into a system you can investigate. Module 5 of The Complete Blue Team Course.
-
What Is a SIEM? Log Management and Security Monitoring Explained
What a SIEM actually does, how to write queries that matter, and how to manage log…
-
MITRE ATT&CK for Defenders: Mapping Detections to Techniques
How blue teams use MITRE ATT&CK to describe attacker behavior, track detection coverage, and build detections…
-
Threat Intelligence for Defenders: Turning Intel into Detections
What threat intelligence is for, the strategic, operational and tactical levels, and how defenders turn intel…
Browse all articles
-
Windows Security Event IDs Every Defender Should Know
Windows security event IDs are the vocabulary of every Windows investigation. When an alert says “4625 spike” or a colleague asks whether…
-
MITRE ATT&CK for Defenders: How to Use the Matrix
MITRE ATT&CK is the shared vocabulary of security teams. Every vendor report, detection rule and red team debrief uses it, yet many…
-
Phishing Email Analysis: Headers, URLs, Attachments
Phishing is still the most common way attackers get a first foothold, so phishing email analysis is a core skill for every…
-
Wireshark for Blue Teams: Spot Suspicious Traffic
Wireshark is the microscope of network defence. Logs tell you that something happened. A packet capture shows you exactly what was said…
-
Sysmon Configuration: Build a Config That Actually Detects
Sysmon is the single most valuable free upgrade you can give a Windows machine. Out of the box, Windows tells you very…
-
Sysmon Event IDs Explained: The Ones That Matter
Sysmon writes dozens of event types, and a beginner who opens the log sees a wall of numbers. The trick is to…
-
Splunk SPL for Security: 5 Queries Every SOC Analyst Needs
Splunk is one of the most common SIEM tools in real SOCs, and its search language, SPL, is a skill that shows…
-
HTB DutyBound Writeup — Hack The Box Season 12
Introduction This HTB DutyBound writeup walks through a medium Linux machine from Hack The Box Season 12, where several seemingly unrelated security…
-
HTB Autopilot Writeup — Insane Windows AD Machine (Season 12)
DifficultyInsaneOSWindows / ADSeasonHTB Season 12Authorthecybertrack.com // attack chain Grommunio→Seafile SSRF→Redis Poison→grofiles RCE→PHP-FPM→Postfix root→Chisel pivot→NTLM relay→firepwd→XOR runas→Domain Admin HTB Autopilot writeup walks through…