Curtis Middlehurst ⁽⁵⁾

A Security Operations Centre will naturally contain analysts with different experience levels and different exposure to incidents. For a lot of Cyber Security professionals, a SOC Analyst role is their first in the industry, however, the role requires the analyst to discern information from logs,…

Want to set up a Microsoft Sentinel lab on PAYG pricing? This blog post aims to provide you with a few tips to keep the Azure bill as low as possible whilst still giving you a good test bed for learning how to set Microsoft…

Note to SOC Analysts: Take a breather, it’s over. After crawling through all the sh*te webpages with the description “How to remove from pc virus plz **FIX FREE Download*”. You've found it. The blog post that will actually tell you where to find out what…

Modifications to Groups in Windows are some of the more common incidents an analyst can face. It is important that you can correctly interpret the logs to ensure correct information is escalated. Group modifications are one of the more obvious methods of privilege escalation in…

When looking into sign-in logs from Azure AD, you might have come across the user-agent ‘BAV2ROPC’. Whilst it is possible that some accounts would legitimately be signing in with this user-agent, what you could be seeing is a successful password spray that has bypassed MFA.