Threat Hunting with Sysmon Walkthrough — LetsDefend
Gathering endpoint telemetry with Sysmon (System Monitor), analyzing process execution (Event ID 1), detecting evasion anomalies, and the LetsDefend Threat Hunting walkthrough.
Write-ups
Threat Hunting with Deception Writeup - LetsDefend
In the world of cybersecurity, threat hunting requires developing proactive approaches to detect attackers and stop their activities. While traditional security measures offer passive methods to stop attackers, deception-based threat hunting takes th...
Threat Hunting with Email Security Writeup - LetsDefend
A hands-on LetsDefend threat hunting writeup analyzing email-borne attack vectors, phishing infrastructure, BEC indicators, and mailbox telemetry triage.
Threat Hunting with EDR Writeup - LetsDefend
Threat hunting is a fundamental practice in modern cybersecurity strategies. It involves actively searching for potential security incidents and indicators of compromise (IOCs) that can evade traditional security measures. In this process, endpoint d...
Threat Hunting with DNS Writeup - LetsDefend
Domain Name System (DNS) is one of the fundamental building blocks of the internet. DNS translates domain names (e.g., www.example.com) into IP addresses when users want to access a specific website on the internet. This translation allows users to e...
Threat Hunting with IPS/IDS Writeup - LetsDefend
Threat hunting is a proactive cybersecurity strategy. Rather than focusing solely on known threats, security teams hunt for advanced and stealthy attacks that have yet to be detected. Intrusion prevention system (IPS) and intrusion detection system (...
Threat Hunting with WAF Writeup - LetsDefend
A Web Application Firewall (WAF) is a security layer used to protect web applications. Unlike traditional firewalls, WAFs specifically target threats aimed at web applications. These threats include SQL injections, XSS (Cross-Site Scripting) attacks,...
Threat Hunting with CTI Writeup - LetsDefend
A hands-on LetsDefend threat hunting writeup analyzing Cyber Threat Intelligence (CTI) feeds, IoC correlation, threat actor attribution, and proactive hunting hypotheses.
Threat Hunting with SIEM Writeup - LetsDefend
A hands-on LetsDefend threat hunting writeup exploring SIEM correlation engines, log pipeline triage, hypothesis-driven hunting, and event investigation.
Threat Hunting with Firewalls Writeup - LetsDefend
Firewall logs are a critical source of data for monitoring network traffic and analyzing security incidents. During threat hunting, firewall logs are used to detect potential threats, identify anomalies, and respond to security incidents quickly and ...
PyGoat OWASP Top 10 (2021): Hands-On Walkthrough & Write-Up
A comprehensive walk-through of the OWASP Top 10 (2021) web vulnerabilities in the PyGoat laboratory, covering exploitation flows and secure code remediation.