Resources
BHIS Blog
Current cybersecurity commentary and technical guidance.
beelzebubLab
Beelzebub Ubuntu VM Beelzebub is an advanced honeypot framework designed to provide a highly secure environment for detecting and analyzing cyber attacks. It offers a low code approach for easy…
azureLab
Azure Any VM Setup First things first, create an account here: https://azure.microsoft.com/en-us/pricing/free-services And get your sample logs from here:…
webSecurity
Web Security Overview Web applications are one of the biggest attack surfaces in any organization For SOC analysts, understanding web security means knowing how attacks look in logs, alerts, and…
webLabPart2
SQL Injection Lab Windows VM If you didn't do the 1st Part , go back We have 4 routes : - Vulnerable login - Secure login - View the lab's access logs - Reset DB Going into Microsoft Edge you can…
webLabPart1
SQL Injection Lab Windows VM The objective for this lab is to Understand how SQL Injection works See how it appears in logs See the mitigation ( how a SOC analyst should react ) See the difference…
browser malware lab
Browser Malware Lab — Cookie Stealer + Extension Forensics This document does not contain source code files. You will download the lab folder (ZIP) that includes all scripts and files. Below you will…
browser malware
Browser Malware 1. Overview Browser malware is any malicious code or configuration that abuses a web browser or its ecosystem (extensions, plugins, saved credentials, profiles, web applications, or…
zeek lab
Zeek Lab - Investigating a malicious pcap Objectives Run Zeek over this pcap and inspect Zeek logs. Extract DNS, HTTP and TLS indicators with . Identify suspicious HTTP POSTs and TLS SNI values.…
network logs
Understanding Network Logs What is a Network Log? Network logs are structured records of events and traffic observed by network devices and monitoring tools such as firewalls, routers, IDS/IPS, and…
ids lab
IDS Lab - Using Snort & Suricata Lab Goals Learn how to: Use Snort and Suricata Create and test custom detection rules Simulate attacks (ping, Nmap, Nikto, curl, etc.) Monitor and analyze alerts 1.…
socScripting
Scripting for SOC Tasks Intro Scripting is a vital skill for SOC analysts to automate routine tasks, analyze data, and respond to incidents efficiently. This chapter covers the fundamentals of Python…
scripting for soc
Scripting for SOC Tasks Automate repetitive tasks analyze logs and events 1. Basic Python Scripting Key Concepts Parsing Simple Logs (CSV & JSON) CSV (Comma-Separated Values) logs: Common for exported…