>_ the cyber track
Cyber Track Blog
Write-ups, attack paths and defensive notes on Active Directory, Linux, Windows and web security.
Featured articles
-
Linux Log Analysis for Defenders: auth.log, journalctl, and auditd
The Linux security model, where Linux logs live, and how auditd turns a server into a system you can investigate. Module 5 of The Complete Blue Team Course.
-
What Is a SIEM? Log Management and Security Monitoring Explained
What a SIEM actually does, how to write queries that matter, and how to manage log…
-
MITRE ATT&CK for Defenders: Mapping Detections to Techniques
How blue teams use MITRE ATT&CK to describe attacker behavior, track detection coverage, and build detections…
-
Threat Intelligence for Defenders: Turning Intel into Detections
What threat intelligence is for, the strategic, operational and tactical levels, and how defenders turn intel…
Browse all articles
-
systemd Service Hardening: Sandboxing Linux Daemons with Native Controls
1. Introduction systemd does more than start and stop services. It includes a large set of sandboxing controls that can reduce what…
-
Linux Logging with journald and rsyslog: Detection, Retention, and Incident Visibility
1. Introduction Logs are the memory of a Linux system. Authentication attempts, service failures, kernel messages, scheduled jobs, sudo usage, and application…
-
Linux Firewalls with nftables: Host-Based Network Security and Audit Strategy
1. Introduction A Linux host firewall limits which network traffic can reach local services and what traffic local processes can send. Even…
-
Linux DNS Resolution Security: resolv.conf, systemd-resolved, and Name Resolution Risks
1. Introduction DNS affects almost every networked Linux workload. Applications use it to locate APIs, package repositories, identity systems, databases, and remote…
-
Linux Process Security: /proc, Signals, Ptrace, and Runtime Investigation
1. Introduction Processes are where code actually runs, so runtime inspection is central to Linux security. The /proc filesystem exposes process metadata,…
-
Linux Mount Security: fstab, nosuid, nodev, noexec, and Filesystem Boundaries
1. Introduction Mount options define more than where a filesystem appears. They can determine whether executables run, whether device files are honored,…
-
auditd on Linux: Building Useful Audit Rules for Security Monitoring
1. Introduction auditd provides kernel-level security auditing for Linux systems. Unlike ordinary application logs, the audit subsystem can record selected system calls,…
-
Linux Kernel Hardening with sysctl: Reducing Network and Process Attack Surface
1. Introduction sysctl exposes runtime kernel parameters that influence networking, memory behavior, process visibility, and many security controls. Baseline hardening guides often…
-
Linux Containers: Namespaces, cgroups, and the Security Boundary
1. Introduction Linux containers rely on kernel isolation primitives rather than a separate guest kernel. Namespaces isolate resources such as processes, mounts,…