>_ the cyber track
Cyber Track Blog
Write-ups, attack paths and defensive notes on Active Directory, Linux, Windows and web security.
Featured articles
-
Linux Log Analysis for Defenders: auth.log, journalctl, and auditd
The Linux security model, where Linux logs live, and how auditd turns a server into a system you can investigate. Module 5 of The Complete Blue Team Course.
-
What Is a SIEM? Log Management and Security Monitoring Explained
What a SIEM actually does, how to write queries that matter, and how to manage log…
-
MITRE ATT&CK for Defenders: Mapping Detections to Techniques
How blue teams use MITRE ATT&CK to describe attacker behavior, track detection coverage, and build detections…
-
Threat Intelligence for Defenders: Turning Intel into Detections
What threat intelligence is for, the strategic, operational and tactical levels, and how defenders turn intel…
Browse all articles
-
Linux Boot Security: GRUB, Secure Boot, initramfs, Kernel Parameters, and Recovery Risks
1. Introduction Linux Boot Security: GRUB, Secure Boot, initramfs, Kernel Parameters, and Recovery Risks is an advanced Linux security topic because the…
-
Linux Storage Security: LVM, Device Mapper, Snapshots, RAID, and Data Exposure
1. Introduction Linux Storage Security: LVM, Device Mapper, Snapshots, RAID, and Data Exposure is an advanced Linux security topic because LVM, device…
-
Linux Core Dumps and Process Memory: Security Risks, Debugging, and Hardening
1. Introduction Linux Core Dumps and Process Memory: Security Risks, Debugging, and Hardening is an advanced Linux security topic because core dumps…
-
SUID and SGID Binaries: Linux Privilege Boundaries and Audit Techniques
1. Introduction SUID and SGID are legacy but still important Unix permission mechanisms. They allow a program to execute with the effective…
-
Sudo Security on Linux: Policies, Misconfigurations, and Least Privilege
1. Introduction sudo is designed to let administrators delegate specific privileged actions without giving every operator unrestricted root access. In well-managed environments…
-
Linux Capabilities: Replacing Full Root Privilege with Fine-Grained Access
1. Introduction Linux capabilities split the traditional all-powerful root privilege into smaller units such as binding to low ports, changing file ownership,…
-
Cron Jobs and systemd Timers: Secure Linux Task Scheduling
1. Introduction Scheduled tasks keep Linux systems running: backups, cleanup, certificate renewal, reporting, log rotation, and application maintenance often happen automatically. Because…
-
SSH Hardening on Linux: Keys, Configuration, and Brute-Force Resistance
1. Introduction SSH hardening on Linux comes down to a few high-impact controls: use key-based authentication, disable direct root login and password…
-
PAM Security on Linux: Authentication Stacks, Password Policy, and MFA
1. Introduction Pluggable Authentication Modules, or PAM, sit behind many Linux login paths. SSH, sudo, console login, su, screen lockers, and other…