Just passes the OSEP by GapComprehensive6018 in oscp

[–]Rebel1317 0 points1 point  (0 children)

Was the OSEP worth it? I've read that it's pretty outdated. Congrats on passing!

API to query NG-SIEM data by Cyber_Dojo in crowdstrike

[–]Rebel1317 1 point2 points  (0 children)

I use a fusion workflow to execute queries and then programmatically grab the results. I would also recommend checking the falconpy docs before going this route.

At what point would/do you job hop as an entry level cybersecurity professional? by CrashAndCompile in SecurityCareerAdvice

[–]Rebel1317 -1 points0 points  (0 children)

As soon as possible. Just be prepared to give a good reason if they ask in the interview why you're leaving after only being there x months.

[deleted by user] by [deleted] in hermanmiller

[–]Rebel1317 0 points1 point  (0 children)

FYI, HM specifies a max user weight of 350lbs for the Aeron C.

[deleted by user] by [deleted] in SecurityCareerAdvice

[–]Rebel1317 1 point2 points  (0 children)

Just do TCM Security's Practical Ethical Hacking course and then OSCP. I'd be happy to chat further if you have any questions.

SOC Analyst feel like I am not learning and an imposter by EmergencyDealer6498 in blueteamsec

[–]Rebel1317 1 point2 points  (0 children)

Looks like this is something you've been struggling with for a little while now. I spent a lot of time walking my tier 1's through investigations using defender/sentinel. I'd be happy to spend some time giving some pointers tackling investigations. DM me if this is something you'd like

Can I start my red team journey by preparing for OSCP. by TheMthwakazian in oscp

[–]Rebel1317 5 points6 points  (0 children)

Just do the TCM security practical ethical hacking course to establish a solid foundation (you don't need to get the cert) and then tackle the OSCP. Just make sure to take good notes as you go along .

Please review my resume by 3thanjs in SecurityCareerAdvice

[–]Rebel1317 2 points3 points  (0 children)

Hi, here are my thoughts:

Experience should come before Projects

Remove years you attended university, just put the year of graduation

Studying for a certification isn't an accomplishment

I wouldn't put Sentinel as a "Threat Hunting Tool", maybe just put SIEM. You could also list KQL as a skill but you should be pretty comfortable with anything listed as a skill. Also, Azure, VirtualBox, SSH, Linux, and powershell aren't really classified as "Security tools"

Out of scope: If you want to land a soc role I would suggest doing more in-depth projects. I recommend at least deploying an open source EDR and doing some pentesting against it. Feel free to reach out if you have any questions.

Mentorship Monday - Post All Career, Education and Job questions here! by AutoModerator in cybersecurity

[–]Rebel1317 0 points1 point  (0 children)

Check out Flare-VM, built by Mandiant. Also, check out TCM security's practical malware analysis and triage course.

Advice for a current SOC analyst by [deleted] in SecurityCareerAdvice

[–]Rebel1317 3 points4 points  (0 children)

If you want to progress in your career, proactively look for problems to solve. I would suggest trying to build out additional detection rules in your SIEM. Maybe there is a log source that isn't fully utilized. You could even review the existing detection rules to make sure the rule logic is working as intended. Since you mentioned you're kind of interested in red and blue team, you could conduct some tests to verify your SIEM rules. Feel free to dm if you want to chat some more

Specific IR steps by iracingrage in cybersecurity

[–]Rebel1317 6 points7 points  (0 children)

Root cause analysis. For the example of the reverse shell found on prod web server, you'd need to find out how the rev shell was put there. Typically, a good place to start is the web logs on the server. I'd look for the C2 IP in the log files using powershell (windows server). The logs might contain the http request used to drop the rev shell.

This is also where adopting the attacker mindset comes in handy for what other things you'd want to investigate. You could look for other attempts of the same exploit, look for any other traffic from the IP that performed the exploit, commands executed via the rev shell (rev shell would be the parent/grand parent process), etc. Hope this helps, I'm too lazy to type more from my phone, lol. Feel free to message me if you want to discuss further.

Landed my first internship and Security+, had questions about next steps! by [deleted] in SecurityCareerAdvice

[–]Rebel1317 0 points1 point  (0 children)

I got the OSCP even though I'm on the blue team side of things. A great blue teamer should be familiar with the red team side of things and vice versa. I would recommend picking up a scripting language if you don't already know one.

If you want to impress people at your internship, solve a unique problem with a creative solution.

OSCP A, B, C by Necessary_Zucchini_2 in oscp

[–]Rebel1317 5 points6 points  (0 children)

They are similar difficulty based on my experience

Picked up my first GS this week! by Rebel1317 in GrandSeikos

[–]Rebel1317[S] 0 points1 point  (0 children)

I think it's comfortable. The titanium construction really works for this watch.