# Favogab:

> Building & Securing the Web


## Posts

- [Python SOC Login Analyzer: From CS50P Beginner to Building a Security Investigation Tool](https://favogab.com/cybermap/python-soc-login-analyzer-cs50p/): Python SOC Login Analyzer case study: from CS50P fundamentals to 62 login events, detection rules, 37 passing tests, reports, and debugging.
- [AWS Cloud Security Part 2: Securing AWS with IAM, Amazon S3, CloudTrail & CloudWatch](https://favogab.com/cybermap/aws-cloud-security-with-iam-s3-cloudtrail/): 2nd Practical AWS Cloud Security Lab covering IAM Security, S3 Bucket, CloudTrail Investigation, and CloudWatch through a SOC analyst workflow.
- [AWS Cloud Security Case Study: How I Built a Secure AWS Environment](https://favogab.com/cybermap/aws-cloud-security-ec2-soc-case-study/): AWS Cloud Security case study covering EC2, VPC, Security Groups, SSH, networking, troubleshooting, as a Practical SOC Analyst.
- [Splunk Threat Hunting: Uncovering a Full APT Campaign Through Log Analysis](https://favogab.com/cybermap/splunk-threat-hunting-apt-campaign/): Splunk Threat Hunting case study covering SOC Investigation, Log Analysis, malware analysis, persistence, C2 tracking, and threat intelligence.
- [MISP Threat Intelligence: Investigating an APT28 Campaign](https://favogab.com/cybermap/misp-threat-intelligence-apt28/): Learn how MISP threat intelligence helped investigate an APT28 campaign, enrich IOCs, identify malware, and support SOC analysis workflows.
- [Understanding Vulnerability Management with Nessus and OpenVAS](https://favogab.com/cybermap/vulnerability-management-with-nessus/): Vulnerability management using Nessus and OpenVAS. Discover CVEs, prioritize risk, validate findings, and improve security posture.
- [Investigating a Web Shell with YARA, Loki, and Threat Intelligence](https://favogab.com/cybermap/investigating-web-shell-yara-loki/): How I used YARA, Loki, and threat intelligence to uncover a hidden web shell, exposed missed detections, and improved malware hunting workflows.
- [Active Directory Hardening: Familiar CompTIA Security+ Knowledge](https://favogab.com/cybermap/active-directory-comptia-security/): Active Directory Hardening transformed CompTIA Security+ concepts into practical security controls and improved vulnerability management.
- [Wazuh and Sysmon: Understanding the Telemetry Behind EDR Alerts](https://favogab.com/cybermap/wazuh-and-sysmon-edr-threat-hunting/): Wazuh and Sysmon work together for endpoint security monitoring, threat hunting, and incident response through real SOC investigations.
- [Threat Hunting with Osquery: Asking the Endpoint the Right Questions](https://favogab.com/cybermap/osquery-endpoint-threat-hunting/): Threat Hunting with Osquery through real endpoint investigations, process analysis, persistence hunting, and evidence gathering like a SOC analyst.
- [Windows Endpoint with Sysmon: Uncovering USB Malware, Persistence, and C2 Activity](https://favogab.com/cybermap/windows-endpoint-using-sysmon/): Windows Endpoint Investigation using Sysmon to detect malware, persistence, C2 activity, and attacker behavior through SOC-style threat hunting.
- [Ice Room Analysis: Icecast Exploitation, Credential Theft & Detection](https://favogab.com/cybermap/ice-room-icecast-credential-theft/): Ice Room Analysis covering Icecast Exploitation, privilege escalation, Credential Theft, Mimikatz activity and SOC detection opportunities.
- [Blue Room Analysis: SMB Enumeration, MS17-010 & Detection](https://favogab.com/cybermap/blue-room-analysis-smb-ms17-010-detection/): Blue Room Analysis covering SMB Enumeration, MS17-010 discovery, privilege escalation, and detection from a SOC analyst's perspective.
- [TShark Malware Investigation: Hunting Phishing & Malicious Downloads](https://favogab.com/cybermap/tshark-malware-investigation-for-soc-workflow/): TShark Malware Investigation through phishing, DNS, HTTP, IOC, and malware traffic analysis in a real SOC analyst workflow.
- [C2 Carnage: Investigating Malicious Network Traffic with Wireshark](https://favogab.com/cybermap/c2-carnage-wireshark-traffic-analysis/): C2 Carnage challenge using Wireshark to investigate malicious network traffic, identify Cobalt Strike C2 servers, and analyze malware activity.
- [Zeek Traffic Analysis & Threat Hunting | DNS Tunneling, Phishing, Log4Shell Detection](https://favogab.com/cybermap/zeek-traffic-analysis-through-log/): Zeek traffic analysis covering DNS tunneling detection, phishing investigation, Log4Shell exploitation attempts, Zeek signatures, Zeek scripts, and threat hunting through PCAP and log analysis.
- [Threat Hunting with Brim: Investigating Malware C2, Coin Mining, and Compromised Hosts](https://favogab.com/cybermap/threat-hunting-on-a-compromised-hosts/): Threat Hunting with Brim, Zeek, and Suricata for DNS and PCAP analysis while investigating suspicious network traffic and compromised hosts.
- [Snort Rules: Powerful IDS/IPS Traffic Detection and Threat Blocking](https://favogab.com/cybermap/snort-rules-traffic-detection-huntlab/): Snort Rules Writing: Lab walkthrough covering IDS/IPS alert triage, reverse shell threat detection, brute-force blocking, and custom Snort rules.
- [Warzone2 SOC Investigation: Confirming a True Positive Malware Download Using Brim and VirusTotal](https://favogab.com/cybermap/warzone2-malware-traffic-analysis/): Warzone 2: Investigation using Brim and VirusTotal to validate IDS alerts, analyze PCAP traffic & escalate a confirmed true positive incident
- [Warzone 1: Investigating MirrorBlast Malware C2 Traffic as a Tier 1 | Brim, Wireshark & NetworkMiner](https://favogab.com/cybermap/warzone-malware-investigation-alert-triage/): Warzone 1: Mastering Malware Investigation through real IDS/IPS alert triage using Brim, Wireshark, and NetworkMiner to trace Malware C2 activity.
- [AI Security Through a SOC Analyst Lens: Defend & leverage AI](https://favogab.com/cybermap/ai-security-for-soc-analysts/): From a SOC analyst perspective, covering prompt injection, LLM risks, data leakage, and how defenders can monitor and secure AI systems.
- [SOC Level 1 Journey: Blue Team & SIEM with Lessons, Mistakes & Wins](https://favogab.com/cybermap/soc-level-1-journey-blue-team-siem-in-30-days/): 30 days THM SOC Level 1 journey into Blue Team operations, SIEM log analysis, phishing detection, and real-world cyber defense scenarios.
- [Analyzing Network Attacks with Wireshark & Snort: From Visibility to Detection](https://favogab.com/cybermap/analyzing-network-attacks-with-snort/): Learn how to detect real-world network attacks using Wireshark and Snort, including Log4Shell, HTTP analysis, and custom IDS rule creation.
- [Packets Don’t Lie: How I Learned to SOC Up With Network Traffic Like an Analyst](https://favogab.com/cybermap/network-traffic-proves-packets-dont-lie/): Hands-on Lab on how to detect ARP scans, DNS tunneling, and data exfiltration using Wireshark with real examples.
- [Dissecting a Real Phishing Kit (SwiftSpend Case Study)](https://favogab.com/cybermap/dissecting-a-real-phishing-kit-case-study/): My Step-by-step analysis of a phishing attack, from email delivery to credential theft and network-level evidence.
- [Building a SOC Detection Lab with Sysmon and Microsoft Sentinel](https://favogab.com/cybermap/building-a-detection-lab-with-sysmon-ms-sentinel/): Documentation and implementation of a personal SOC detection lab using Windows telemetry and cloud-native SIEM monitoring.
- [Security Risk: A Legacy Real Case Study on Retiring WordPress Sites.](https://favogab.com/cybermap/legacy-websites-are-a-security-risk/): Security Risk — A real-world case study of how an old WordPress site became a risk after migration — & how proper decommissioning solved it
- [From Spam to Breach: Real WordPress Security Incident & Credential Compromise Case Study](https://favogab.com/cybermap/wordpress-security-incident-case-study/): The WordPress Security Incident that started as spam & led to the discovery of a full site compromise: Incident response in a real-world scenario.
- [Learning SOC the Hard Way: Practical Security Analysis & Detection](https://favogab.com/cybermap/soc-101-hands-on-detection-analysis/): SOC 101 from the trenches — phishing analysis, network forensics, Snort rules, endpoint compromise, SIEM logs, YARA detection, and privacy.
- [How I Started Treating WordPress Websites Like a SOC Analyst  — Routine for 2026](https://favogab.com/cybermap/soc-mindset-wordpress-security-2026/): No one can unsee it. I’m applying a SOC mindset to WordPress—here’s a 2026 routine to improve monitoring, resilience, and incident response.
- [The Human Firewall reduces risks and creates a security-first culture](https://favogab.com/cybermap/the-human-firewall-begins-at-orientation/): Security training on day one builds a stronger human firewall, reduces risks, and creates a security-first culture across your organization.
- [How I Troubleshot Multiple WordPress Sites After the 6.9 Update](https://favogab.com/cybermap/how-to-troubleshoot-wordpress-sites-fast/): After updating to WordPress 6.9, the footer broke on multiple sites. Here’s how I troubleshooted it, restored, and improved my update process.

## Pages

- [From Spam to Breach: Real WordPress Security Incident & Credential Compromise Case Study](https://favogab.com/incident-response/wordpress-security-incident-case/): The WordPress Security Incident that started as spam & led to the discovery of a full site compromise: Incident response in a real-world scenario.
- [Home](https://favogab.com/): Security Analyst transitioning from Web to Cybersecurity with hands-on experience in WordPress incident response, SIEM labs, and threat analysis.
- [Cybermap: From Labs to Live Incidents](https://favogab.com/cybermap/): A structured map of my progression from controlled labs to real-world incident analysis, focused on detection, investigation, and response.
- [contact](https://favogab.com/contact/): Questions, collaborations, or new ideas? Send a message and let’s explore what’s possible together.

## Optional

- [Agent (MCP protocol)](websites-agents.hostinger.com/favogab.com/mcp)

[comment]: # (Generated by Hostinger Tools Plugin)