TryHackMe | Medium | Blue team | SIEM

1. Giriş ve Laboratuvar Mimarisi

A question-by-question breakdown of investigating a service-account compromise from web logs to lateral movement, using Splunk and Zeek.

Room: Benign Path: SOC Level 1 — SIEM Tools: Splunk, ANY.RUN

A DFIR walkthrough combining PCAP analysis and Splunk log correlation to reconstruct a full network intrusion — from ARP spoofing to…

Task 1 : IR Scenario

I recently worked through the PS Eclipse room on TryHackMe. The room focuses on analyzing Windows and PowerShell-related activity, and it…

Detecting Golden Tickets/Silver Tickets

Splunk Incident Analysis

Introduction

Task 2 IAM and User Credentials

TL;DR Splunk has released two advisories that fix 22 Splunk Enterprise vulnerabilities across four supported branches. The worst, CVE-2026-76268, lets an unauthenticated attacker run operating-sys…

Critical and high-severity vulnerabilities could allow attackers to bypass authentication, execute arbitrary code, and elevate their privileges.

How I built, tested, and tuned 11 Splunk detections in a home lab — and what broke along the way

Complete Detailed Walkthrough. Hi, I am CyberNaut-SM.

TL;DR Splunk published four advisories fixing 31 Splunk vulnerabilities in Splunk Enterprise and Splunk SOAR. Three of the flaws carry a critical CVSS score of 9.9. Admins should upgrade to Splunk…

Hunting an imposter account, a scheduled task and a certutil download through Windows process logs.

Patched vulnerabilities could allow attackers to execute code, elevate privileges, and leak sensitive information.

When I started learning cybersecurity, most of my learning involved understanding concepts, watching lessons, and making notes. But I…

Scenario