sudo-savvy:~$
A customer recently came to us confused about an alert another provider had already closed. They run a split-SOC arrangement, and that provider’s EDR had fired on “a process loaded a driver with known vulnerabilities.” It was triaged, marked a true positive, and resolved. No escalation, no context, no “here is what this means for…
$ cat full-postIf you work in a SOC, it’s all too familiar at this point – a compromised endpoint alert comes into the alert queue, but the initial access vector isn’t immediately clear. As the analyst works backwards through the logs and timeline, a ClickFix attack begins to emerge. What initially looks like a user simply trying…
$ cat full-postOver the last few months the SOC I work in has seen a huge increase in device code phishing compromises. It’s gone from something we’d read about occasionally to something we handle numerous times weekly, and the pattern is consistent enough that I thought it would be good to document in my blog. So here’s…
$ cat full-post>SudoTrace is a free, self-hosted, AI-assisted analyst workbench that pulls a device’s process ancestry and the core MDE tables into a single view, so the pivots you would otherwise run by hand, one query at a time, are already done when you sit down to look. Update 25/06/2026: >SudoTrace now includes a Business Email Compromise…
$ cat full-postI recently passed my SC-200 exam and I wanted to share the resources I used to pass this exam. To keep it tl;dr, I recommend these three essential resources that are (in my opinion) key to passing the SC-200 exam: Udemy “SC-200 Microsoft Security Operations Analyst Course & SIMs” by John Christopher Microsoft Learn SC-200…
$ cat full-postMy cloud-hosted VPS serves as a personal VPN server that also routes traffic through a Pi-hole to block ads and trackers, because honestly that’s the only way the internet is useable these days. It’s been running for a couple of years with little to no maintenance, and recently, I decided it was time to put…
$ cat full-postI was recently sent this video by a friend who wanted to know if this was “legit”: The video advertises a trading bot that automates trades between crypto USDT and USDC, taking advantage of small price differences to generate guaranteed profit. Sounds too good to be true right? Let’s examine this so-called trading bot using…
$ cat full-postI have been working as a SOC analyst for several years, primarily working in banking Cyber Security Operation Centers. However after taking a career break, I wanted to refresh and upgrade my skills before re-entering the job market. Given the high costs of traditional cybersecurity certifications (I’m looking at you OffSec and SANS!!), I sought…
$ cat full-post