Blog
Technical insights on SIEM, EDR, and Blue Team operations from the SOC
5 posts
I Built a Self-Hosted Threat Intelligence Platform to Stop Tab-Hopping Forever
A few months ago I was triaging a suspicious IP and caught myself with VirusTotal, AbuseIPDB, Shodan, and OTX all open at once, reconciling results by hand. I’d done that same thing probably a …
Read MoreBuilding a Security-Focused Homelab: Lessons from Week One
Starting my homelab journey has been more rewarding than I expected. After researching budget options, I settled on a Dell OptiPlex 7070 with 16GB of RAM, 256GB of storage, and an Intel i5 8500T. …
Read MoreActive Node.js Malware Campaign Targeting Manual Reader Applications
We’re seeing a significant uptick in a malware campaign that’s affecting multiple customers. This one’s worth knowing about if you’re in a SOC or working with EDR platforms. …
Read MoreBuilding Effective Threat Hunting Queries
Effective threat hunting queries help you find what automated detections miss. Here’s my approach to building them. Start with a Hypothesis Before writing a query, form a hypothesis about …
Read MoreWelcome to my blog
I’m Elmer Phillips, a Security Analyst working in Managed Detection & Response at At-Bay. This blog is where I share practical notes from the SOC. Detection engineering, SIEM queries, threat …
Read More
No posts found
Try different search terms.