Blog

Nmap sends packets and listens for what comes back. What comes back tells you more about a network than most administrators know about their own infrastructure. Gordon Lyon released Nmap in 1997 in a Phrack magazine article. It has been in active development since then and has appeared in over a dozen films, including The Matrix Reloaded, Die Hard 4.0, and Bourne Ultimatum, because filmmakers use it when they need a terminal to look like actual hacking. It is one of the most widely used security tools in existence, and most people who run it do not fully understand what it is doing. ...

DarkSide did not use a sophisticated zero-day to shut down 45 percent of the East Coast fuel supply. They used a password found in a leaked credential database and an account that had no multi-factor authentication. On May 7, 2021, Colonial Pipeline shut down 5,550 miles of pipeline after discovering a ransomware infection. That pipeline moves 100 million gallons of fuel per day and supplies gasoline, diesel, and jet fuel from Texas to New York. It stayed offline for six days. ...

The Security+ exam will ask you to match a port number to a protocol. The job will ask you to look at a SIEM alert at 2 AM and decide whether it is worth waking someone up. Those are different skills. The certification is still worth getting. But going in without understanding the gap leaves you underprepared for the work even after you pass. What the Exam Tests The current Security+ (SY0-701) has up to 90 questions across 90 minutes. CompTIA divides the content into five domains: General Security Concepts, Threats, Vulnerabilities and Mitigations, Security Architecture, Security Operations, and Security Program Management and Oversight. ...

Brute force guesses passwords. Credential stuffing already has them. That distinction matters because the defenses are different, and most people conflate the two. If you lock an account after five failed attempts, you stop a brute force attack. You do almost nothing to stop credential stuffing. What Credential Stuffing Actually Is When a company gets breached and loses its user database, those credentials get sold, traded, and published. Have I Been Pwned tracks over 14 billion compromised accounts as of 2026. That number grows every month. ...

TryHackMe: CALDERA Author: Mario Martinez Jr. (ku5e / Gary7) | TryHackMe USA Rank #76 | Top 1% Difficulty: Medium Topics: CALDERA Framework, Adversary Emulation, MITRE ATT&CK, Sysmon Log Analysis, Aurora EDR, Autonomous Incident Response, APT41 Threat Emulation Answers are redacted within the narrative to allow you to complete the tasks on your own, but a full table of answers is available at the end of this walkthrough. CALDERA is MITRE’s open-source adversary emulation framework. This room covers the full pipeline: deploying agents, building adversary profiles, running operations, analyzing detections with Sysmon and Aurora EDR, and executing autonomous incident response. The final task emulates APT41, a threat group attributed to Chinese state-sponsored espionage and financial crime active since 2012. ...

Author: Mario Martinez Jr. (ku5e / Gary7) | TryHackMe USA Rank #76 | Top 1% Difficulty: Easy Topics: Threat Modelling, MITRE ATT&CK, DREAD, STRIDE, PASTA Answers are redacted within the narrative to allow you to complete the tasks on your own, but a full table of answers is available at the end of this walkthrough. This room walks through four threat modelling frameworks used by security teams to identify, categorise, and prioritise risks. You apply each framework to realistic organisational scenarios, including a financial services company and an e-commerce payment processor. ...

Author: Mario Martinez Jr. (ku5e / Gary7) | TryHackMe USA Rank #76 | Top 1% Difficulty: Medium Topics: XDR/SIEM, Rule Syntax, Regex, Threat Detection Answers are redacted within the narrative to allow you to complete the tasks on your own, but a full table of answers is available at the end of this walkthrough. In this lab, we step into the role of a SOC analyst responsible for fine-tuning a Wazuh deployment. The default rule set captures many common threats, but specialized environments require custom detection logic to identify sophisticated adversary behavior. We focus on modifying the local rules configuration to trigger alerts based on specific log patterns and nested logic. ...

Author: Mario Martinez Jr. (ku5e / Gary7) | TryHackMe USA Rank #76 | Top 1% Difficulty: Easy/Medium Topics: Data Normalization, Pipeline Logic, Logstash Plugin Architecture Answers are redacted within the narrative to allow you to complete the tasks on your own, but a full table of answers is available at the end of this walkthrough. Logstash is the transformation engine of the Elastic Stack. Beats agents ship data efficiently but cannot normalize disparate logs at any meaningful depth. Logstash fills that gap: a server-side pipeline that ingests data from multiple sources and routes it to configured outputs after applying transformation logic. ...

Author: Mario Martinez Jr. (ku5e / Gary7) | TryHackMe USA Rank #76 | Top 1% Difficulty: Easy/Medium Topics: Data Visualization, SPL (Search Processing Language), Operational Intelligence Answers are redacted within the narrative to allow you to complete the tasks on your own, but a full table of answers is available at the end of this walkthrough. In this challenge, we act as a Splunk administrator tasked with repairing a broken data pipeline. The core issue involves a custom application that ingests logs incorrectly. Multi-line events are being fragmented, which ruins data integrity and makes analysis impossible. The fix requires navigating the backend filesystem and correcting the parsing rules that tell Splunk where each multi-line event begins. ...

Author: Mario Martinez Jr. (ku5e / Gary7) | TryHackMe USA Rank #76 | Top 1% Difficulty: Easy/Medium Topics: Data Visualization, SPL (Search Processing Language), Operational Intelligence Answers are redacted within the narrative to allow you to complete the tasks on your own, but a full table of answers is available at the end of this walkthrough. This room covers advanced Splunk capabilities, specifically how to organize data, create recurring reports, and build visual dashboards to monitor security events. ...