sudo-savvy:~$
A customer recently came to us confused about an alert another provider had already closed. They run a split-SOC arrangement, and that provider’s EDR had fired on “a process loaded a driver with known vulnerabilities.” It was triaged, marked a true positive, and resolved. No phone call, no context, no “here is what this means…
$ cat full-postIt’s been a while since I did any HTB challenges, so I thought I’d ease back in with Connected, an easy rated Linux box. It falls in two stages: an unauthenticated SQL-injection-to-RCE exploit against FreePBX to get a foothold, followed by a writable file in relation to a incron job that can be exploited to…
$ cat full-postIf you work in a SOC, it’s all too familiar at this point – a compromised endpoint alert comes into the alert queue, but the initial access vector isn’t immediately clear. As the analyst works backwards through the logs and timeline, a ClickFix attack begins to emerge. What initially looks like a user simply trying…
$ cat full-postOver the last few months the SOC I work in has seen a huge increase in device code phishing compromises. It’s gone from something we’d read about occasionally to something we handle numerous times weekly, and the pattern is consistent enough that I thought it would be good to document in my blog. So here’s…
$ cat full-post>SudoTrace is a free, self-hosted, AI-assisted analyst workbench that shows you what really happened on a compromised endpoint — faster than MDE alone. Update 25/06/2026 — >SudoTrace now includes a Business Email Compromise Checker. Details at the bottom. If you work in a SOC and use Microsoft Defender for Endpoint, you already know the problem.…
$ cat full-postI recently passed my SC-200 exam and I wanted to share the resources I used to pass this exam. To keep it tl;dr, I recommend these three essential resources that are (in my opinion) key to passing the SC-200 exam: Udemy “SC-200 Microsoft Security Operations Analyst Course & SIMs” by John Christopher Microsoft Learn SC-200…
$ cat full-postEver wanted to practice pentesting a virtual Active Directory environment but thought it would be a massive hassle to set up? That’s where the tool GOAD (Game Of Active Directory) comes into play. As per the github: The purpose of this tool is to give pentesters a vulnerable Active directory environment ready to use to…
$ cat full-postMy cloud-hosted VPS serves as a personal VPN server that also routes traffic through a Pi-hole to block ads and trackers—because, honestly, that’s the only way the internet is useable these days. It’s been running for a couple of years with little to no maintenance, and recently, I decided it was time to put my…
$ cat full-postTraditional phishing and malware delivery attacks typically follow a predictable pattern: “Hey user, open this Word document. It contains important information you need to see.” The user opens the document. “Hey user, enable macros to view the contents of this important document.” The user clicks “Enable Content.” A hidden macro runs a PowerShell script in…
$ cat full-postMoving laterally within a compromised network, pivoting from one target network onto a secondary target network, or even a third, can be confusing for those who are not accustomed to the technique and find that there are a million pivoting tools out there that look to do the same exact thing. There are certainly other…
$ cat full-post