Resources
BHIS Blog
Current cybersecurity commentary and technical guidance.
coursenavigation
Course Navigation Welcome Start Here! Getting Support Log Analysis Basics Windows Event Logs Sysmon Logs Authentication Logs Tools to Learn Log Analysis Lab Security Tools & Foundational Platforms…
zeek
Zeek — SOC Analyst Playbook (Cheat-sheet + Expanded) Zeek (formerly Bro) is an event-driven network security engine that passively monitors traffic, parses protocols, extracts metadata and generates…
wireshark
Wireshark Wireshark is a powerful open-source network protocol analyzer used for capturing and analyzing packets in real time. It is an essential tool for any SOC Analyst to inspect suspicious network…
WinEventViewer
Windows Event Viewer Windows VM The file for the lab is under: Windows Event Viewer is a built-in administrative tool that allows users to view and analyze logs of system, security, and application…
Volatility
Volatility Documentation Volatility is the world's most widely used framework for extracting digital artifacts from volatile memory (RAM) samples. The extraction techniques are performed completely…
tcpdump
tcpdump tcpdump is a powerful command-line packet analyzer that allows you to capture and inspect live traffic on a network. It is commonly used for quick triage, scripting, and environments where a…
suricata
Suricata Suricata is a powerful open-source Network Security Monitoring (NSM), Intrusion Detection System (IDS), and Intrusion Prevention System (IPS) engine. Developed by the Open Information…
snort
Snort Snort is an open-source Network Intrusion Detection System (NIDS) and Intrusion Prevention System (IPS) developed by Cisco. It inspects network traffic in real-time and uses a powerful…
scapy documentation part2
Scapy - part 2 For part 1, check out scapy_documentation_part1.md For lab, check out scapy_lab.md For lab solution, check out scapy_lab_solution.md Common Modules, Classes & Functions (API Reference)…
scapy documentation part1
Scapy - part 1 For part 2, check out scapy_documentation_part2.md For lab, check out scapy_lab.md For lab solution, check out scapy_lab_solution.md Introduction & Setup 1) What is Scapy? Scapy is a…
PEStudio
PEstudio for Linux Overview PEstudio is a static analysis tool used to examine Windows executables for potential indicators of compromise without running the file. While PEstudio is natively a Windows…
IDA Free
Overview IDA Pro (Interactive DisAssembler) is a powerful disassembler and debugger used in malware analysis, reverse engineering, and vulnerability research It converts binary executables into…