← Blog // TAG

Blue Team

17 articles

Blue Team The Windows Event IDs every SOC should watch You don't need to watch 400 event types: you need the right ones. The Windows Event IDs that tell the story of an attac… Read → Blue Team From a CVE to a detection: from the advisory to a rule that catches the attack A CVE advisory tells you what breaks, not how to detect it. The method to go from an advisory to a detection: service a… Read → Blue Team Your first YARA rule: describe malware and hunt it YARA is the "grep" of malware analysis: rules that describe a family by its strings and bytes. The anatomy of a rule (m… Read → Forense The extension lies: identify files by their magic bytes Renaming an .exe to .jpg does not make it an image. A file's first bytes —its signature or "magic bytes"— reveal its re… Read → Blue Team A secret in git isn't deleted, it's rotated (and why) You commit an API key by mistake, delete it in the next commit and relax. Don't: it stays in history. Why it happens, w… Read → Blue Team From a log to a detection that works in any SIEM A KQL detection only works for Sentinel. With Sigma you write it once in YAML and convert it to KQL, SPL, Elastic or Wa… Read → CVSS CVSS v3.1 vs v4.0: what changes and how to score it right CVSS v4.0 is not a tweak of v3.1: it changes the impact model (vulnerable vs subsequent systems), splits complexity fro… Read → OSINT Passive recon: your domain's public footprint (and how to shrink it) Before touching a target, an attacker reads it from public sources without sending a single packet: DNS, Certificate Tr… Read → Blue Team Cron persistence: how attackers use it and how to hunt it Cron is legit, everywhere and quiet: which makes it a nest for persistence. Where attackers hide, the patterns that giv… Read → Blue Team CSP in practice: a Content-Security-Policy that stops XSS without breaking your site Most CSPs are useless (with unsafe-inline) or break the site. How to build a strict nonce-based CSP, the directives tha… Read → Blue Team SOC triage: the first 15 minutes of an alert A method to avoid drowning in alerts: validate, enrich, scope and decide. The steps and tools to go from "an alert fire… Read → Blue Team Hardening SSH: a practical checklist against brute force and unauthorized access SSH default config is a magnet for brute force. Keys instead of passwords, no root, 2FA, modern ciphers and monitoring,… Read → Blue Team Which CVE to patch first: prioritize with EPSS, KEV and context CVSS alone is not enough to prioritize patching. How to combine EPSS (exploit probability), CISA's KEV list and your re… Read → Blue Team How to analyze a phishing email (.eml) step by step A triage guide for a suspicious email without opening links or attachments: headers, SPF/DKIM/DMARC authentication, sen… Read → Blue Team SPF, DKIM and DMARC in practice: stop your domain from being spoofed A practical guide to setting up email authentication (SPF, DKIM and DMARC) in the right order, with the common mistakes… Read → Blue Team Hardening Microsoft 365 against phishing: the controls that actually matter Practical setup of Defender for Office 365, Conditional Access and email authentication (SPF/DKIM/DMARC), in the order … Read → Blue Team Detecting DNS Tunneling with KQL in Microsoft Sentinel Three KQL signals (long, varied subdomains, volume and record types) to hunt DNS exfiltration and C2, and how to turn t… Read →