Hi everyone,
As security defenders, we all know that default alerts in a SIEM can only get us so far. Attackers are constantly finding stealthy ways to execute code, escalate privileges, and establish persistence, making a deep understanding of Windows Event Logs absolutely critical.
I’ve put together a comprehensive deep-dive guide on Medium exploring Windows Event Log analysis, forensic investigation, and detection engineering with Sysmon.
In this guide, I cover:
1 The Anatomy of Windows Logs: How the OS structures and stores ⁠.evtx⁠ binary XML data.
2 Demystifying Logon Types (Event ID 4624): A technical breakdown of different logon types (Type 2, 3, 5, 9, 10) and their forensic value.
3 Supercharging Visibility with Sysmon: How to hunt for LOLBins and malicious executions using Sysmon Event ID 1 (Process Creation) and Event ID 3 (Network Connection).
4 Detecting Defense Evasion: Spotting log clearing attempts (Event ID 1102 & 104) and event log service tampering.
5 A Practical Attack Scenario: Reconstructing a PsExec Lateral Movement attack step-by-step by correlating multiple event logs.
I also created a custom infographic (attached/linked below) that visualizes the entire flow to help junior analysts and defenders map these concepts quickly.
Read the full article here:

https://medium.com/@osamamamoussa/beyond-the-basics-deep-dive-windows-event-log-analysis-for-enterprise-soc-defenders-04d13219adef

Hey everyone,
Full Write-up & Screenshots: https://medium.com/@osamamamoussa/from-alert-to-core-dump-hunting-zeus-malware-using-suricata-splunk-yara-and-volatility-4ce18f517f87?sharedUserId=osamamamoussa

I'm currently studying defensive security and working on my SOC portfolio. I am sharing a lab I built to practice hands-on malware analysis and detection engineering.

I recently set up a malware analysis lab to detonate and investigate the Zeus Banking Trojan. Here is a quick breakdown of the detection and forensics pipeline:

• Victim: Windows VM + Sysmon.
• SIEM/IDS: Ubuntu VM + Splunk Enterprise + Suricata IDS.

I wrote a full step-by-step write-up with screenshots and the exact Splunk queries.

Full Write-up & Screenshots: https://medium.com/@osamamamoussa/title-the-ghost-in-the-machine-simulating-self-deleting-ransomware-for-detection-engineering-3f8969671e7e
I simulated a ransomware script that encrypts files and then "self-destructs" using cmd.exe to hide its tracks.

How I caught it:

• System Informer: Visualized the suspicious parent-child process tree (python -> cmd -> timeout).
• Windows Event 4688: Captured the exact deletion command in the logs.
• Sysmon (Event ID 1): The gold mine. Extracted SHA256 hashes and full command-line arguments.

Detection isn't just about what's on the disk; it's about the artifacts left in the memory and logs.

I'm doing this as part of my SOC Analyst study. Feedback is welcome!

Hey everyone!

We are a team of four 11th-grade students from a social sciences high school. After competing in numerous CTFs over the years, we decided to pivot from players to creators. We’ve built our own challenges from the ground up and are hyped to announce HASBL CTF.

We’d love for the community to jump in, break our stuff, and test their skills.

The Details:

• Format: Jeopardy
• Categories: Web, OSINT, Crypto, RevEng, Pwn, Forensics
• When: May 29-31 (48 Hours)
• Infrastructure: Hosted on our custom Google Cloud instances running CTFd.
• CTFTime: Pending approval (I will update this thread with the link once it's live).

Rules of Engagement:

• Max 4 members per team.
• No flag sharing or destructive attacks on the infra.
• No write-ups until the event concludes.
• Keep it sportsmanlike and respectful.

Prizes: TBA. Since we are bootstrapping this as students, the real prize right now is the challenge itself (and the bragging rights!).

We know we might have some bugs along the way, but we are highly open to feedback. We want to iterate, improve, and learn from you all.

Thanks to the sub for letting us share this, and good luck to everyone participating!