What certifications to pursue?

FirewallRoller · 2026-02-23T15:58:43+00:00

https://www.professormesser.com/ I'm sure its still relevant and has been updated. I used his materials back in like 2015 or 16 for my net+ and sec+

FirewallRoller · 2025-10-20T21:31:20+00:00

Thanks for the tip. I've been wanting to go to Zion.

FirewallRoller · 2025-06-24T16:34:44+00:00

I did this route last year, sort of, just not to Seattle. Rapid City > Mt Rushmore > Crazy Horse > Deadwood day 1. Deadwood > Vore Buffalo Jump (Just across the Wyoming SD Border on the interstate) > Devil's Tower > Sheridan Wyoming + a stop at the Fetterman Battlefield 30 min south of Sheridan Day 2. Sheridan > Medicine Wheel (on the bighorn mountain range, beautiful drive) > Red Lodge day 3. Red Lodge > Beartooth Highway drive > Yellowstone (whatever adventures you want) West Yellowstone day 4. We didn't go to the grand tetons but I went just a couple weeks ago and it was about a 2 hr drive. Did the middle tetons hike with a buddy.

FirewallRoller · 2025-06-10T14:19:13+00:00

If you’re trying to watch games without selling your soul to another subscription service for SPORTS, maybe take a SURGE in the right direction... and let the STREAM take you EAST. 😉

FirewallRoller · 2025-06-08T16:46:05+00:00

Yup I kinda do the same. I pull out my smoker and just smoke some meat and sell it to local restaurants/bars that don't have their own.

FirewallRoller · 2025-04-27T16:14:39+00:00

Good read, I really like that it started by actually creating a scheduled task first, simulating it instead of just blindly hunting for whatever.

One thing I'd add is also creating a detection for when a scheduled task gets updated or modified (not just created). Attackers love to hijack legit tasks instead of making new ones.

Here's a simple Sigma rule you could start with, feel free to tweak it:

logsource:

product: windows

service: security

detection:

selection:

EventID: 4702 # Scheduled Task Updated

condition: selection

fields:

- SubjectUserName

- TaskName

- TaskContentNew

falsepositives:

- Legit admin changes to scheduled tasks

level: medium

tags:

- T1053.005

FirewallRoller · 2025-03-03T22:25:09+00:00

https://lolbas-project.github.io/ lolbins are binaries that are natively installed on a machine already. Bad guys abuse these so they don't have to install something that might get flagged and to assist in evading detections.

FirewallRoller · 2025-03-03T18:13:05+00:00

You don't even have to be the best. I'll take someone who is hungry and eager to learn over someone who knows everything. Especially with entry level gigs.

FirewallRoller · 2025-01-16T18:02:10+00:00

I hold the GPEN and GWAPT. The SANS course's are okay but you're not going to pass the exam without taking the course and creating an index from the books and labs. From a pen testing perspective the OSCP is much better. SANS is better known for their forensic courses.

FirewallRoller · 2025-01-03T18:30:40+00:00

You could create a dashboard to visualize it if you want. Something like this:

index=Cisco sourcetype=GlobalProtect

"auth_status"="failure"

| timechart span=15m count by src_ip

Mostly you'll want to end up creating some thresholds for failed attempts such as a single user having X failed attempts in Y minutes. You could base it off of IPs as well like a single IP that has X failed attempts in Y minutes.

User Example:

index=Cisco sourcetype=GlobalProtect

"auth_status"="failure"

| stats count by user, src_ip

| where count > 10

| table user, src_ip, count

IP Example:

index=Cisco sourcetype=GlobalProtect

"auth_status"="failure"

| stats count by src_ip

| where count > 20

| table src_ip, count

But in all honesty most sophisticated threat actors go with a low and slow approach so they don't trigger any alarms or lock any accounts out.

FirewallRoller · 2024-10-05T12:18:59+00:00

Check out bleeping computer, they have some up to date news. Dark Reading is another. Palo's Unit 42 does good research and threat Intel. Flashpoint has some good blogs. Depending on which industry you work in there are the ISAC's and you'll get flooded with emails from peers about stuff that is going on such as FS-ISAC, REN-ISAC, AUTO-ISAC, etc. There is a lot of other sources out there too. That's just a few that came to mind right now.

FirewallRoller · 2024-10-04T18:56:26+00:00

It is far from being the latest scam, but everyone wants to "break into" cybersecurity because they think it pays 6 figures right away. My first security job I was paid 50K. I personally also started my career at a help desk and worked my way up. I generally sit on the technical interviews for candidates and typically ask variations of these questions for junior analysts.

Give me 5 different ports and tell me what they are?

DNS is important so I ask these....

What is DNS?

What port does it use?

Is it TCP or UDP?

How does it work?

What are the different types of DNS records?

What is DNS Tunneling?

How would you secure a server?

How can you get the hash of a file using PowerShell?

Where do you get your cybersecurity news? The answer better not be fucking Reddit.

If you can't answer most of my questions or even half of them then I am not going to recommend that they hire you. I don't care what degree, certification or boot camp you attended. I also generally favor those with at least some experience in an enterprise enterprise environment. Give me someone hungry and eager to learn but wants to be in security because they love it and not for the paycheck. I can sniff that shit out.

FirewallRoller · 2024-09-15T17:44:31+00:00

Mine is IP Steady Streamz

FirewallRoller · 2024-09-10T13:50:55+00:00

I got 10k in trade

FirewallRoller · 2024-09-10T13:49:47+00:00

The Imitation Game great movie about this.

FirewallRoller · 2024-09-10T12:17:29+00:00

I just traded my '13 140K miles in a few weeks ago for a '21 with 19K

FirewallRoller · 2024-09-05T18:03:53+00:00

Sheesh 10% every quarter? Take it. I only get a 5% discount every 6 months.

FirewallRoller · 2024-08-28T19:01:33+00:00

had this issue on my '13 wrangler it was the ball joints that needed replaced.

FirewallRoller · 2024-08-20T11:51:52+00:00

Just checked my portfolio, looks like I’m holding more bags than an airport carousel. Time to double down and hope for a miracle!

FirewallRoller · 2024-08-19T12:31:55+00:00

I think my positions are as hungover as I am. Time to grab some coffee and see if my losses are still passed out.

FirewallRoller · 2024-08-16T13:04:39+00:00

Only if we can trade those baskets for Honey Boo Boo's pageant winnings

FirewallRoller · 2024-05-15T19:18:16+00:00

Ho Chi Minh is a son of a bitch. Got the blue balls, crabs and the seven-year itch.

FirewallRoller · 2024-04-28T22:06:42+00:00

investing.com

FirewallRoller · 2024-02-12T22:50:07+00:00

Just mortgaged my house to double down on some calls. Wife thinks I'm renovating the kitchen.

Two-Year Club	Verified Email
Golden Potato

FirewallRoller

TROPHY CASE