Resources
BHIS Blog
Current cybersecurity commentary and technical guidance.
Compromised Web Server
Compromised Web Server When an attacker gains unauthorized access to a web server, it is deemed compromised . This typically occurs as a result of a vulnerability in the server software, the website,…
Bring Your Own Exploited Device
Bring Your Own (Exploited) Device A compromised device is a personal laptop, phone, or tablet that an attacker has already infected before it connects to a company network. In organizations that allow…
UEBA Analytics
User And Entity Behavious(UEBA) Analytics Most security tools work by matching known bad things - a signature, a rule, a hash. UEBA works differently. It watches how people and systems normally…
Server Analysis
Server Analysis A server is considered compromised when someone gains access or control without authorization. This doesn’t always mean the attacker fully owns the machine - sometimes they only have a…
Security Informations And Event Management Log Analysis
Security Informations And Event Management(SIEM) Log Analysis Security Information and Event Management ( SIEM ) is the process of collecting and analyzing logs from many systems in one place so…
Permissions Audit
Permissions Audit Every system has users, and every user has permissions. A permissions audit is how defenders figure out who can access what - and whether that access makes any sense. The goal is…
Network Threat Hunting
Network Threat Hunting Network threat hunting is the practice of actively searching network traffic for signs of malicious behavior instead of waiting for alerts to fire. It focuses on finding…
Memory Analysis
Memory Analysis When a system gets compromised, attackers leave traces. Not always on disk - sometimes only in memory. Memory analysis (also called memory forensics) is the process of pulling a…
wazuh
Wazuh Cloud SIEM & XDR Ubuntu & Windows VM Lab Objective The objective of this lab is to deploy Wazuh Agents to a cloud-hosted SIEM environment, configure File Integrity Monitoring (FIM), simulate…
hayabusa
Hayabusa Ubuntu VM The objective of this lab is to use Hayabusa to analyze Sysmon logs and detect suspicious activity related to process creation, network connections, and authentication events. If…
Elastic Doc Cloud
Elasticsearch is a distributed search and analytics engine, scalable data store, and vector database built on Apache Lucene. It’s optimized for speed and relevance on production-scale workloads. Use…
elastic security
Please go though the documentation and setup for the Cloud Version Elastic Security GOAL Set up and use Elastic SIEM on your system Learn how to ingest logs and visualize them Learn how to use SIEM…