Resources
BHIS Blog
Current cybersecurity commentary and technical guidance.
External Password Spray
External Password Spray An external password spray is a login attack where attackers try a small set of common passwords against many accounts from outside the organization. Instead of guessing many…
Credential Stuffing
Credential Stuffing Credential stuffing is an attack where someone takes stolen username and password pairs (usually leaked in data breaches) and tries them across many websites and services. The…
Compromised Web Server
Compromised Web Server When an attacker gains unauthorized access to a web server, it is deemed compromised . This typically occurs as a result of a vulnerability in the server software, the website,…
Bring Your Own Exploited Device
Bring Your Own (Exploited) Device A compromised device is a personal laptop, phone, or tablet that an attacker has already infected before it connects to a company network. In organizations that allow…
UEBA Analytics
User And Entity Behavious(UEBA) Analytics Most security tools work by matching known bad things - a signature, a rule, a hash. UEBA works differently. It watches how people and systems normally…
Server Analysis
Server Analysis A server is considered compromised when someone gains access or control without authorization. This doesn’t always mean the attacker fully owns the machine - sometimes they only have a…
Security Informations And Event Management Log Analysis
Security Informations And Event Management(SIEM) Log Analysis Security Information and Event Management ( SIEM ) is the process of collecting and analyzing logs from many systems in one place so…
Permissions Audit
Permissions Audit Every system has users, and every user has permissions. A permissions audit is how defenders figure out who can access what - and whether that access makes any sense. The goal is…
Network Threat Hunting
Network Threat Hunting Network threat hunting is the practice of actively searching network traffic for signs of malicious behavior instead of waiting for alerts to fire. It focuses on finding…
Memory Analysis
Memory Analysis When a system gets compromised, attackers leave traces. Not always on disk - sometimes only in memory. Memory analysis (also called memory forensics) is the process of pulling a…
wazuh
Wazuh Cloud SIEM & XDR Ubuntu & Windows VM Lab Objective The objective of this lab is to deploy Wazuh Agents to a cloud-hosted SIEM environment, configure File Integrity Monitoring (FIM), simulate…
hayabusa
Hayabusa Ubuntu VM The objective of this lab is to use Hayabusa to analyze Sysmon logs and detect suspicious activity related to process creation, network connections, and authentication events. If…