Tag: IOC Analysis

Tag: IOC Analysis

All from controlled labs to real-world incident analysis, focused on detection, investigation, and response.

TShark Malware Investigation: Hunting Phishing & Malicious Downloads

TShark Malware Investigation through phishing, DNS, HTTP, IOC, and malware traffic analysis in a real SOC analyst workflow.

View >>

C2 Carnage: Investigating Malicious Network Traffic with Wireshark

C2 Carnage challenge using Wireshark to investigate malicious network traffic, identify Cobalt Strike C2 servers, and analyze malware activity.

View >>

Zeek Traffic Analysis & Threat Hunting | DNS Tunneling, Phishing, Log4Shell Detection

Zeek traffic analysis covering DNS tunneling detection, phishing investigation, Log4Shell exploitation attempts, Zeek signatures, Zeek scripts, and threat hunting through PCAP and log analysis.

View >>

Threat Hunting with Brim: Investigating Malware C2, Coin Mining, and Compromised Hosts

Threat Hunting with Brim, Zeek, and Suricata for DNS and PCAP analysis while investigating suspicious network traffic and compromised hosts.

View >>

Warzone2 SOC Investigation: Confirming a True Positive Malware Download Using Brim and VirusTotal

Warzone 2: Investigation using Brim and VirusTotal to validate IDS alerts, analyze PCAP traffic & escalate a confirmed true positive incident

View >>

Warzone 1: Investigating MirrorBlast Malware C2 Traffic as a Tier 1 | Brim, Wireshark & NetworkMiner

Warzone 1: Mastering Malware Investigation through real IDS/IPS alert triage using Brim, Wireshark, and NetworkMiner to trace Malware C2 activity.

View >>

Dissecting a Real Phishing Kit (SwiftSpend Case Study)

My Step-by-step analysis of a phishing attack, from email delivery to credential theft and network-level evidence.

View >>

From Spam to Breach: Real WordPress Security Incident & Credential Compromise Case Study

The WordPress Security Incident that started as spam & led to the discovery of a full site compromise: Incident response in a real-world scenario.

View >>