Personal website of to1un.https://to1un.com/enhttps://to1un.com/writing/eve-ng-vmware-network-connection/https://to1un.com/writing/eve-ng-vmware-network-connection/VMware Workstation host-only ağı (VMnet5) ile EVE-NG Cloud7 arayüzünü Linux bridge (pnet7) üzerinden köprüleyerek VMware sanal makinelerini lab topolojisine dahil etme rehberi.Mon, 06 Jan 2025 00:00:00 GMTtrto1unnetworkinglabeve-ngvmwarehttps://to1un.com/writing/splunk-lab/https://to1un.com/writing/splunk-lab/Splunk Enterprise ve Universal Forwarder kullanarak Windows 10 istemcisinden Event Log toplama ve indeksleme adımları.Thu, 09 May 2024 00:00:00 GMTtrto1unlabsplunksiemhttps://to1un.com/writing/purplelab/https://to1un.com/writing/purplelab/Atomic Red Team simülasyonları, malware detonation ve Sigma kural testleri için izole PurpleLab ortamı.Wed, 08 May 2024 00:00:00 GMTtrto1unlabsecuritydetection-engineeringhttps://to1un.com/writing/pickle-rick/https://to1un.com/writing/pickle-rick/TryHackMe Pickle Rick CTF çözümü; kaynak kod analizi, komut filtrelerini less ile aşma ve sudo yetki yükseltme.Mon, 15 Apr 2024 00:00:00 GMTtrto1unsecurityctfhttps://to1un.com/writing/boss-of-the-soc-v1-scenarios1/https://to1un.com/writing/boss-of-the-soc-v1-scenarios1/Splunk BOTS v1 veri setinde Po1s0n1vy APT grubunun imreallynotbatman.com web sitesine yönelik keşif, kaba kuvvet saldırısı ve defacement adımlarının SPL ile DFIR analizi.Thu, 07 Mar 2024 00:00:00 GMTtrto1unsecuritysplunkdfirincident-responsehttps://to1un.com/writing/boss-of-the-soc-v1-scenarios2/https://to1un.com/writing/boss-of-the-soc-v1-scenarios2/Splunk BOTS v1 veri setinde Bob Smith'in iş istasyonuna (we8105desk) bulaşan Cerber ransomware vakasının SPL ile DFIR analizi; steganografi, C2 iletişimi ve SMB dosya şifreleme tespiti.Thu, 07 Mar 2024 00:00:00 GMTtrto1unsecuritysplunkdfirransomwareincident-responsehttps://to1un.com/writing/malware-analysis/https://to1un.com/writing/malware-analysis/Şüpheli bir infostealer/trojan dosyasının Sysinternals Procmon, Process Hacker, Regshot ve Fiddler ile dinamik analizi; scheduled task kalıcılığı, C2 trafiği ve kimlik bilgisi hırsızlığı.Sat, 11 Nov 2023 00:00:00 GMTtrto1unsecuritymalware-analysisdfir