PinnedHow I managed to get 92% on the GIAC GREM CyberLive exam!“It may seem difficult at first, but everything is difficult at first.” — Miyamoto Musashi Content That’s a lot of badges! Intro Learning Preparation Additional Resources Indexing Exam & CyberLive That’s a lot of badges!Malware Analysis9 min readMalware Analysis9 min read
PinnedDetecting and Responding to Spring4Shell with SplunkIt’s that time of the week again when you are just about ready to sit back with a nice glass of Longmorn 16 & long no more. But then, some ding-dong leaks a PoC exploit for an app framework you’ve never heard of on GitHub & ruins your entire weekend…Spring4shell3 min readSpring4shell3 min read
Feb 26, 2022HermeticWiper — Hermetica Digital Ltd. your friendly neighbourhood wiper Part 1TL;DR: Blue teamers can detect this by looking for Sysmon new file creation event for a file ending with ‘.sys’ in System32. You can also catch this with Windows event logs for registry value modification — event ID 4657 for SYSTEM\CurrentControlSet\Control\CrashControl. Cyberwarfare is here, and like it or not, it…Hermeticwiper4 min readHermeticwiper4 min read
Feb 6, 2022Automating Intelligence-Driven Threat Hunting without a SOARI’ve always been a proponent of XREFing organizational context with cyber threat intelligence to produce actionable insights, i.e., matching indicators in logs produced by various entities in an organization with observables obtained from a Threat Intelligence Platform. The process most organization follows involves both TTP-based as well as indicator-based Threat…Threat Hunting2 min readThreat Hunting2 min read
Oct 23, 2020How to prepare for the eCIR examSo, if you are here, you are either planning to purchase the IHRP course or just about ready to attempt the exam. Before my exam, I had searched for IHRP course reviews, and this review helped me out a lot. If you’ve bought the course or if you’re planning to…Incident Response5 min readIncident Response5 min read
