A collection of research, tutorials, and insights into technical security.
Learn how to detect malicious command execution and privilege escalation on Linux using Auditd and Wazuh SIEM with custom audit keys, XML correlation rules, and MITRE ATT&CK mapping.
Read article arrow_forwardA comprehensive hands-on lab guide to detecting SSH brute-force attacks using Wazuh SIEM, custom correlation rules, attack simulation with Hydra, and dashboard alert analysis.
Read article arrow_forwardA hands-on step-by-step guide to building a Network Intrusion Detection System (NIDS) by integrating Suricata IDS with Wazuh SIEM to detect stealth Nmap scans and analyze alerts.
Read article arrow_forwardA comprehensive hands-on guide to configuring real-time File Integrity Monitoring (FIM) using Wazuh SIEM, custom detection rules, attack simulation, and dashboard alert analysis.
Read article arrow_forwardA complete guide to integrating Wazuh SIEM File Integrity Monitoring (FIM) with VirusTotal API to automate malware detection and enrich endpoint security alerts.
Read article arrow_forwardA practical step-by-step guide to building a full Active Directory lab from scratch, covering AD DS, Domain Controllers, DNS, OUs, Users, Group Policy enforcement on Windows 10, and IIS Web Server.
Read article arrow_forwardA complete step-by-step guide to building a SIEM home lab by installing Splunk Enterprise on Ubuntu Server, configuring Sysmon on Windows, and forwarding Event Logs for threat hunting.
Read article arrow_forward