Cybersecurity Mommy Add us as a preferred source on Google

Thousands of log entries and one question: where is the suspicious activity? Shell scripting helps security analysts turn raw Linux logs into useful investigation results within seconds. In this lesson, we use Bash pipelines to search logs with "grep", extract fields with "awk", rank repeated values with "sort" and "uniq -c", inspect compressed archives with "zgrep" and investigate systemd events with "journalctl". You will see how a short pipeline can identify the most frequent failed login sou

PowerShell can show you what is running, what is communicating, which services are active, what scheduled tasks exist and what recently executed on a Windows system. That same level of access also makes it one of the most commonly abused tools in Windows attacks. In this lesson, we look at both sides. You will see how analysts use "Get-Process", "Get-Service", "Get-ScheduledTask", "Get-NetTCPConnection" and "Get-WinEvent" to investigate a suspicious host and connect active network sessions with

Manually comparing thousands of firewall events with a threat intelligence feed sounds like a great way to lose an entire afternoon. So, in this demonstration, we let Python do the repetitive part. The scanner loads suspicious IP addresses from a JSON threat feed, reads a simulated firewall log line by line, uses "re.findall()" to extract candidate addresses and validates them with "ipaddress.ip_address()". The validated addresses are then compared with a Python set containing the known indicato

Python can turn hours of repetitive SOC work into a workflow that runs in seconds. In this lesson, we explore Python for security automation and connect everything we have already learned about regex, JSON, CSV files, log analysis, APIs and threat intelligence. You will learn how "re.search()", "re.findall()" and "re.compile()" can extract indicators from security logs, how "json.load()" and "json.loads()" parse structured data and how "csv.DictReader()" helps analysts process firewall exports.

Windows Event Logs are one of the most important sources of evidence during a security investigation. They can help you understand who authenticated to a system, which processes executed, whether a new account was created, whether someone installed a service or scheduled task and whether an attacker attempted to remove evidence. In this lesson, we explore how Windows stores events in the EVTX format and how analysts can investigate them through Event Viewer, PowerShell and Python. You will learn

A process is named "svchost.exe", so it must be legitimate. Right? The name is only the beginning of the investigation. Where is the executable located? Who signed it? Which process launched it? What command line did it use? Why is it communicating with an external IP address? Attackers can imitate trusted filenames, manipulate process relationships, or inject code into legitimate applications. At the same time, unusual behavior is not automatically malicious. Analysts must correlate the path, p

A workstation suddenly reaches 95 percent CPU. Disk activity spikes, memory usage keeps growing, and outbound traffic appears at an unusual time. Is it malware, ransomware, cryptomining, data exfiltration, or simply a legitimate workload behaving exactly as designed? Resource consumption tells you that something changed. It does not tell you why. In this presentation, we investigate CPU, memory, disk, and network anomalies from a SOC analyst perspective. We connect resource usage to processes, f

Every process, logon, file change, scheduled task, service, DNS query, and network connection can leave evidence behind. The difficult part is understanding which evidence matters and how it connects to everything that happened before and after the alert. Why did Word launch PowerShell? Which process opened the network connection? Was the new scheduled task legitimate administration or persistence? Is the unusual login malicious, or did an old service account simply fail again? This presentation

A password protected archive appears inside a temporary Linux directory. Seconds later, Netcat creates an outbound connection to an unusual destination. The archive is transferred and immediately deleted. Is that proof of data exfiltration? Not automatically. In this presentation, we investigate the complete sequence using file system activity, process telemetry, active network connections, Wireshark traffic, user behavior, and business context. You will see how separate events that may appear h

Explaining how stressful cybersecurity is suddenly sounds a little less dramatic when the other person is a sick Victorian child who lost three siblings and started working in a factory at age seven. Meanwhile, I had three incidents, twelve suspicious PowerShell executions and a user who clicked the link anyway. Different century. Different problems. Follow for more cybersecurity content, technical knowledge and occasional SOC suffering. TikTok: @cybersecuritymommy Instagram: @mistyice93.exe You