I started in computer security on BBS networks in the 1980s. Today I teach AP Computer Science and Cybersecurity while building toward a full-time remote role in SOC analysis or penetration testing.
My TryHackMe profile sits at USA Rank #76, Top 1% globally. I hold a Physical Penetration Testing certification, am completing Security+ on the CompTIA track, and document every room I complete in this blog.
I also run MakerMindStudio, a 3D printing and laser engraving operation, and publish health and systems writing under the FACTOTUM Protocol.
TryHackMe room writeups published as completed. Each walkthrough covers the tools used, the logic behind each step, and the security concepts the room demonstrates.
I review your resume and LinkedIn profile against current cybersecurity and tech hiring standards. You get a marked-up document with specific rewrites, not a checklist of generic suggestions.
A structured 90-day plan built around your current certifications, experience level, and target role. Covers what to study, what to build, and what to skip.
Line-by-line feedback on AP Computer Science Free Response Questions. Written for students preparing for the exam or teachers who want a second set of eyes on student work.
TryHackMe: Atomic Bird Goes Purple #2 Author: Mario Martinez Jr. (ku5e / Gary7) | TryHackMe USA Rank #76 | Top 1%
Difficulty: Medium
Topics: Purple Teaming, Threat Emulation, Atomic Red Team, Credential Access, Defense Evasion, Persistence, Registry Manipulation, Service Creation
Answers are redacted within the narrative to allow you to complete the tasks on your own, but a full table of answers is available at the end of this walkthrough.
...
TryHackMe: Atomic Bird Goes Purple #1
TryHackMe: Atomic Bird Goes Purple #1 Author: Mario Martinez Jr. (ku5e / Gary7) | TryHackMe USA Rank #76 | Top 1%
Difficulty: Medium
Topics: Purple Teaming, Threat Emulation, Atomic Red Team, Windows Event Logs, Sysmon, Aurora EDR
Answers are redacted within the narrative to allow you to complete the tasks on your own, but a full table of answers is available at the end of this walkthrough.
This room puts you inside a Purple Team exercise built around the Atomic Red Team project. You emulate real adversary tactics across system discovery, credential capture, file manipulation, clipboard abuse, and system file hijacking, then investigate the artifacts each technique leaves behind. The goal is not just to run attacks but to understand what defenders see when those attacks run.
...
What Nmap Actually Does
Nmap sends packets and listens for what comes back. What comes back tells you more about a network than most administrators know about their own infrastructure.
Gordon Lyon released Nmap in 1997 in a Phrack magazine article. It has been in active development since then and has appeared in over a dozen films, including The Matrix Reloaded, Die Hard 4.0, and Bourne Ultimatum, because filmmakers use it when they need a terminal to look like actual hacking. It is one of the most widely used security tools in existence, and most people who run it do not fully understand what it is doing.
...
Colonial Pipeline: One Password, Six Days, 17 States
DarkSide did not use a sophisticated zero-day to shut down 45 percent of the East Coast fuel supply. They used a password found in a leaked credential database and an account that had no multi-factor authentication.
On May 7, 2021, Colonial Pipeline shut down 5,550 miles of pipeline after discovering a ransomware infection. That pipeline moves 100 million gallons of fuel per day and supplies gasoline, diesel, and jet fuel from Texas to New York. It stayed offline for six days.
...
What Security+ Tests vs. What the Job Actually Requires
The Security+ exam will ask you to match a port number to a protocol. The job will ask you to look at a SIEM alert at 2 AM and decide whether it is worth waking someone up.
Those are different skills. The certification is still worth getting. But going in without understanding the gap leaves you underprepared for the work even after you pass.
What the Exam Tests The current Security+ (SY0-701) has up to 90 questions across 90 minutes. CompTIA divides the content into five domains: General Security Concepts, Threats, Vulnerabilities and Mitigations, Security Architecture, Security Operations, and Security Program Management and Oversight.
...
Credential Stuffing Is Not Brute Force
Brute force guesses passwords. Credential stuffing already has them.
That distinction matters because the defenses are different, and most people conflate the two. If you lock an account after five failed attempts, you stop a brute force attack. You do almost nothing to stop credential stuffing.
What Credential Stuffing Actually Is When a company gets breached and loses its user database, those credentials get sold, traded, and published. Have I Been Pwned tracks over 14 billion compromised accounts as of 2026. That number grows every month.
...
TryHackMe: CALDERA Walkthrough
TryHackMe: CALDERA Author: Mario Martinez Jr. (ku5e / Gary7) | TryHackMe USA Rank #76 | Top 1%
Difficulty: Medium
Topics: CALDERA Framework, Adversary Emulation, MITRE ATT&CK, Sysmon Log Analysis, Aurora EDR, Autonomous Incident Response, APT41 Threat Emulation
Answers are redacted within the narrative to allow you to complete the tasks on your own, but a full table of answers is available at the end of this walkthrough.
CALDERA is MITRE’s open-source adversary emulation framework. This room covers the full pipeline: deploying agents, building adversary profiles, running operations, analyzing detections with Sysmon and Aurora EDR, and executing autonomous incident response. The final task emulates APT41, a threat group attributed to Chinese state-sponsored espionage and financial crime active since 2012.
...
TryHackMe: Threat Modelling
Author: Mario Martinez Jr. (ku5e / Gary7) | TryHackMe USA Rank #76 | Top 1%
Difficulty: Easy
Topics: Threat Modelling, MITRE ATT&CK, DREAD, STRIDE, PASTA
Answers are redacted within the narrative to allow you to complete the tasks on your own, but a full table of answers is available at the end of this walkthrough.
This room walks through four threat modelling frameworks used by security teams to identify, categorise, and prioritise risks. You apply each framework to realistic organisational scenarios, including a financial services company and an e-commerce payment processor.
...
TryHackMe: Custom Alert Rules in Wazuh
Author: Mario Martinez Jr. (ku5e / Gary7) | TryHackMe USA Rank #76 | Top 1%
Difficulty: Medium
Topics: XDR/SIEM, Rule Syntax, Regex, Threat Detection
Answers are redacted within the narrative to allow you to complete the tasks on your own, but a full table of answers is available at the end of this walkthrough.
In this lab, we step into the role of a SOC analyst responsible for fine-tuning a Wazuh deployment. The default rule set captures many common threats, but specialized environments require custom detection logic to identify sophisticated adversary behavior. We focus on modifying the local rules configuration to trigger alerts based on specific log patterns and nested logic.
...
TryHackMe: Logstash — Data Processing Unit
Author: Mario Martinez Jr. (ku5e / Gary7) | TryHackMe USA Rank #76 | Top 1%
Difficulty: Easy/Medium
Topics: Data Normalization, Pipeline Logic, Logstash Plugin Architecture
Answers are redacted within the narrative to allow you to complete the tasks on your own, but a full table of answers is available at the end of this walkthrough.
Logstash is the transformation engine of the Elastic Stack. Beats agents ship data efficiently but cannot normalize disparate logs at any meaningful depth. Logstash fills that gap: a server-side pipeline that ingests data from multiple sources and routes it to configured outputs after applying transformation logic.
...
