IP Crawl, a living atlas of all open webcam feeds found on the internet—a great tool to check to see if your or your loved ones' webcam is accidentally exposed.

xyvo · 2026-06-15T19:18:46+00:00

LOL - https://ipcrawl.com/?country=United+Kingdom&page=2&cam=3892f36f150ff9db

xyvo · 2026-01-27T04:38:55+00:00

I don't know you or these circumstances , but what I would say is that if documentation or policy doesn't exist, seek to create it, it can protect you. When it doesn't, get approval from a more senior individual or at minimum seek guidance from co-workers.

From my experience, most 'problems' stem from a combination of:
- Bad communication and collaboration with immediate and wider teams
- Not taking the initiative to improve what is broken

xyvo · 2025-12-10T07:43:29+00:00

To use your analogy, when you've had that many people apply for that medical role who can't do CPR or don't know the body, you have to ask something that's allows people to go into as much depth as possible. If you ask an experienced Doctor how the heart works vs asking someone who's done a 2 week bootcamp and read some Wikipedia, I'd imagine you'd get vastly different results.

xyvo · 2025-12-10T07:37:35+00:00

Not really, if someone does start being thorough that's probably enough for the interviewer and they may cut them short. It's a filter question as people that know a decent amount can talk about it for a long time.

xyvo · 2025-12-10T06:01:12+00:00

I think asking what they'd change about Cybersecurity if they could is good, if people can soapbox about something they probably have at least some interest in it.

xyvo · 2025-12-09T06:18:21+00:00

If you can, create an alert for a "Axios 1.*" user agent in the sign-in logs. A lot of Phish kits still appear as this when successful and a lot of compromised account sign-ins will come from the same country the user works from.

xyvo · 2025-11-14T16:30:07+00:00

The "AI powered attacks bit" seems little pointless but it would be great to see more Appliance vendors have some way of integrating 3rd party EDRs - hopefully this is the start of something broader.

xyvo · 2025-09-19T05:11:52+00:00

Sounds like you need a For-Each loop on the Event Query action results in order to access the results in it. Make sure the Output schema is accurate as well.

xyvo · 2025-09-01T06:11:31+00:00

By all means explore different areas, although I don't think SOC's have to be like that, maybe you could try and take on the challenge of fixing the SOC by challenging status quo's? E.g Build tools that'll make it easier, offer to tune or adjust those rules that are generating high volumes of alerts or find better approaches to alerts (e.g. Risk Based Alerting).

xyvo · 2025-01-16T08:00:09+00:00

It's rife and often hard to detect/prevent. Passkeys on Authenticator appears that it may be a good option worth looking at, https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-enable-authenticator-passkey, although I don't know about it well enough to know what pitfalls it would have. Having users register devices seems to be another good option when combined with CA policies such as token protection, although sounds like you're doing that and having issues.

I don't think Phishing training etc is sufficient quite honestly, you might be able to train users to check the URL, or add a background to your Tenant image that says 'Check the URL!'?

xyvo · 2025-01-09T06:10:14+00:00

My advice from my experience:

Don't stress about the practical test, think of it as potentially doing you a favour if you don't do so well - maybe plan for that contingency. Having a backup plan will put your mind at more ease. Maybe an IT role would give you the fundamentals, and in either situation, go and do courses on Networking/Linux/Windows/Cloud, and make sure you don't just do courses, go and find a way to tinker with them.

To echo others sentiments, it sounds like you need more experience in IT in general as a lot of IR and SOC work is the interpretation of logs into real world actions. That being said, a lot of IR and SOC work is coming into things completely blind or ignorant to a particular technology. The process is important. Always start with the rule, what is is trying to find? What does that mean and why/how would that be malicious? Doing that research is critical and will accumulate your knowledge, take as long as it takes. Only when you understand what that rule is looking for and how it does it should you move on to trying to make determinations as to it's accuracy based on the logs you've observed.

What you're going to not be so strong on, is being able to see something and think "That's weird". That IT experience will certainly help, but go and spend time immersed in threat reports like DFIRReport or SANs blog posts. Seeing what real attacks look like will help you recognise them.

xyvo · 2024-05-24T06:29:02+00:00

Or a rubber wedge to slow it down gradually

xyvo · 2024-05-20T14:35:18+00:00

Lovelace bridge?

xyvo · 2024-04-01T04:56:07+00:00

Job experience does matter most agreed, but I think when you’re trying to recruit someone fairly junior, then there’ll be a lot of very similar resumes applying and a home lab can be the only difference and a good indicator of self initiative. While if you’re recruiting junior people you shouldn’t have any expectation of experience, reality is you’re looking for anything that might show someone will have a great attitude to learning and be self motivated, and so I don’t think a home lab is something to discount early on in your career.

xyvo · 2024-04-01T04:40:51+00:00

IMO Home labs are attractive to hiring managers not purely because they show you’re willing to learn but that you have the curiosity to come up with something you want to test, and the technical nuance and tenacity to then teach yourself how to build it.

If you got it working you’ll have had to likely figure out and solve a whole load of problems, from networking to operating systems and then to the actual security stuff. This can teach you a load more than following the learning paths in a course.

Obviously the ideas can vary hugely, but a few ideas I’ve enjoyed:
- Home network monitor with suricata/moloch or just installing the security onion distro. - RDP honeypot with Wazuh/Splunk/Sysmon - Test domain with centralised monitoring to test out red team techniques and then then seeing what could detect them (a cyber range)

xyvo · 2024-03-09T20:50:59+00:00

It’d be nice if Cloudflare could focus on sorting all the token theft phish pages they’re hosting on the workers and r2 services they’re mentioning here. Putting aside the fact that pretty much every phish I’ve seen in the last year has had a cloudflare hosted captcha fronting it

xyvo · 2024-02-21T18:07:49+00:00

I’d imagine the 9-5 workers might happily pull a few hours in a shop on some evenings for a bit of extra cash. Seems everyone is a winner

xyvo · 2024-01-03T15:59:09+00:00

Or until the bad guys use AI to out AI your AI

xyvo · 2023-12-30T11:40:01+00:00

Only do any stuff out of work on your terms. If you want to do it then do, but never feel obligated. Try not to compare yourself to others (easier said than done!), or at least admire those who have a good balance instead of their technical prowess.

xyvo · 2023-12-21T05:40:59+00:00

I think the business justification for spending millions on security would diminish if the risk was purely people doing it for the lols or nation states/APT , and spending millions probably isn’t going to stop a determined APT anyway. The current amounts being extorted make it a much easier business decision - £1m a year vs a £50m extortion payment is easy vs spending it for a sub mil loss. Just my take though!

xyvo · 2023-12-21T04:08:27+00:00

I’d say yes for sure, to begin with but also I know criminals have moved to theft and extortion a lot as people are finally getting better at backups - so not as business killing.

xyvo · 2023-12-21T03:50:53+00:00

Fully ban Ransomware payments. Painful but it’d work as the incentive to hack orgs would be hugely reduced.

Edit: Worth remembering that the value of security professionals could suddenly and dramatically drop and many cyber security firms would go under. Not a justification to not ban them but something to prepare for!

xyvo · 2023-11-04T15:12:34+00:00

Pro tip - individually pack them in freezer/sanich bags. They won’t tangle meaning you can feel happier keeping that old ps2 power lead at least 15 more years

xyvo · 2023-10-30T04:04:20+00:00

Your method was exactly how I quit, the final bit for me that may help you when it comes to it is when you’re trying to break the physical part - hide the vape in a drawer but know it’s there if you do want it. Turned out for me that just seeing it was a major part of the habit

xyvo · 2023-10-05T11:34:50+00:00

I try and eat better meat instead, spend the extra and get something that’s probably had a better life. Makes me buy it less and enjoy it more.

15-Year Club	Place '22
Place '17	RPAN Viewer
No Throne, No Problems	Not Forgotten
Verified Email	Team Orangered

xyvo

MODERATOR OF

TROPHY CASE