Hands-on cybersecurity case studies, from reconstructing a compromise to testing the signals a SOC can rely on. The focus: practical methods, observed evidence, and the limits of what each result proves.
Following the evidence across disk, memory, and application logs to understand what happened, how it happened, and which conclusions hold up.
An investigation of a compromised Windows Server 2008 host running XAMPP and DVWA. Disk and memory analysis are correlated with Apache logs to reconstruct exploitation, web-shell activity, and recovered commands.
Building and testing detections in controlled environments, with clear distinctions between telemetry visibility, a rule match, and confirmed exploitation.
A replay-tested analytic for detecting an application identity adding or modifying credentials on another application. Positive and negative tests examine the distinction between suspicious cross-app changes and self-management.
A controlled PHP/Apache exploit with independently verified command execution. The case study examines what QRadar recorded, where application telemetry falls short, and how those observations inform Sentinel hunting.
Testing the Windows path: building an IIS/PHP target and following process telemetry through Sysmon and WinCollect into QRadar. The results establish visibility and detection prerequisites; Windows PHP2Shell RCE was not demonstrated.