How to Detect AiTM Session Cookie Theft in Entra ID Sign In Logs
Spot adversary in the middle phishing in Entra ID by tracking session IDs, OfficeHome sign ins and token risk events, then contain it before a payment fraud lands.
9 Nov 20269 min read
Blue team notes, built in the open
Learn the SOC one alert at a time.
Practical walkthroughs on alert triage, detection engineering, incident response and threat hunting. Written step by step, with queries you can copy and labs you can repeat.
- 11posts
- 8topics
- 3levels
Live
Today in security
- 2h ago
- 2h ago
- 2h ago
- 2h ago
- 2h ago
-
3h ago
Dark Reading PwC's CISO on AI, Robots & What's Next for Security
-
4h ago
BleepingComputer Binance denies data breach after alleged ShinyHunters claims
Latest
Fresh from the blog
Linux SSH Log Cheat Sheet for Beginner SOC Analysts
Where Linux keeps SSH logs, what each common log line means and the simple grep and journalctl commands that tell you who logged in, from where and how.
9 Nov 20267 min read
How to Build a Home SOC Lab with Free Tools
A beginner friendly plan for a home SOC lab using Windows evaluation builds, Sysmon, a free SIEM and Atomic Red Team, plus how to turn it into interview evidence.
7 Nov 20267 min read
How to Enrich a Suspicious Domain Without Alerting the Attacker
A practical workflow for investigating an unknown domain with internal logs, RDAP, passive DNS and certificate data, then turning the results into a clear verdict.
6 Nov 20267 min read
Windows Logon Events Cheat Sheet: Event IDs, Types and Failure Codes
A shift-ready reference for Windows logon event IDs, logon types and failure codes, with KQL, SPL and PowerShell to show who logged on, from where and how.
5 Nov 20268 min read
How to Hunt for C2 Beaconing in Proxy and EDR Logs
Find regular callback traffic in proxy and EDR logs with interval analysis in KQL and SPL, then separate real command and control from noisy legitimate software.
5 Nov 20269 min read
Topics
Pick a track
Alert Triage
Read an alert, gather context, decide: escalate, close or tune.
2 posts
Detection Engineering
Sigma, KQL and SPL rules, tuning noise and testing coverage.
2 posts
Incident Response
Containment, evidence handling and clear incident write-ups.
1 post
Threat Intelligence
IOCs, TTPs and turning reports into detections.
1 post
Threat Hunting
Hypothesis-led hunts mapped to MITRE ATT&CK.
1 post
SIEM and Tools
Splunk, Sentinel, Elastic, EDR and SOAR in practice.
1 post
Career and Certs
Breaking into the SOC, interviews and study plans.
1 post
Cheat Sheets
Event IDs, query syntax and quick reference cards.
2 posts
Learning path
New to the SOC? Start here
-
01
SOC fundamentals
Tiers, shifts, the alert lifecycle and the tools you will touch on day one.
Open track → -
02
Alert triage
A repeatable workflow for reading alerts, enriching indicators and reaching a verdict.
Open track → -
03
Detection engineering
Write, test and tune rules so the SOC sees the right things with less noise.
Open track → -
04
Incident response
Contain, investigate and report, using a structure that holds up under pressure.
Open track →
Daily SOC tips on X
Short threads on detections, event IDs, triage tricks and new posts as they go live.