>_ the cyber track
Cyber Track Blog
Write-ups, attack paths and defensive notes on Active Directory, Linux, Windows and web security.
Featured articles
-
Linux Log Analysis for Defenders: auth.log, journalctl, and auditd
The Linux security model, where Linux logs live, and how auditd turns a server into a system you can investigate. Module 5 of The Complete Blue Team Course.
-
What Is a SIEM? Log Management and Security Monitoring Explained
What a SIEM actually does, how to write queries that matter, and how to manage log…
-
MITRE ATT&CK for Defenders: Mapping Detections to Techniques
How blue teams use MITRE ATT&CK to describe attacker behavior, track detection coverage, and build detections…
-
Threat Intelligence for Defenders: Turning Intel into Detections
What threat intelligence is for, the strategic, operational and tactical levels, and how defenders turn intel…
Browse all articles
-
SQLmap Tutorial: Detecting and Validating SQL Injection in Authorized Tests
SQLmap is an open-source command-line tool that automates the detection and exploitation of SQL injection flaws. In a penetration test, its real…
-
Touch — HTB Walkthrough: From a Leaky API to a Kiosk Foothold
Touch is a beginner-friendly Windows box on Hack The Box that’s less about brute-forcing your way in and more about paying attention.…
-
Linux Namespaces Deep Dive: PID, Mount, Network, User, IPC, and UTS Isolation
1. Introduction Linux Namespaces Deep Dive: PID, Mount, Network, User, IPC, and UTS Isolation is an advanced Linux security topic because namespaces…
-
Linux cgroups v2 Security: Resource Control, Delegation, and Container Abuse
1. Introduction Linux cgroups v2 Security: Resource Control, Delegation, and Container Abuse is an advanced Linux security topic because cgroups control resource…
-
eBPF Security on Linux: Observability, Detection, and Kernel Attack Surface
1. Introduction eBPF Security on Linux: Observability, Detection, and Kernel Attack Surface is an advanced Linux security topic because eBPF runs verified…
-
Linux seccomp: Restricting System Calls for Service and Container Hardening
1. Introduction Linux seccomp: Restricting System Calls for Service and Container Hardening is an advanced Linux security topic because seccomp limits which…
-
Advanced Linux Capabilities: Bounding, Ambient, Inheritable, and Effective Sets
1. Introduction Advanced Linux Capabilities: Bounding, Ambient, Inheritable, and Effective Sets is an advanced Linux security topic because capability sets split traditional…
-
Linux Kernel Modules: Security Risks, Rootkits, Signing, and Module Hardening
1. Introduction Linux Kernel Modules: Security Risks, Rootkits, Signing, and Module Hardening is an advanced Linux security topic because kernel modules execute…
-
Advanced Linux Persistence: systemd, ld.so.preload, Shell Profiles, and Startup Hooks
1. Introduction Advanced Linux Persistence: systemd, ld.so.preload, Shell Profiles, and Startup Hooks is an advanced Linux security topic because Linux persistence can…