From curiosity to cybersecurity. SOC Analyst Linux | Networking | Security Operations Sharing lessons, labs, and beginner-friendly insights.
Lagos Nigeria
Joined September 2024
- Tweets9.9K
- Following1.5K
- Followers2.3K
- Likes6.3K
XXIII retweeted
Suspicious Login Pattern Hunt
Scenario:
A threat intelligence team discovers that employee credentials from a recent third-party breach may be circulating on the dark web.
The team wants to know:
Are any of those compromised credentials already being used to access the organisation?
As the analyst, you’re given VPN authentication logs and asked to investigate suspicious login activity.
The interesting part is the hypothesis:
An attacker may be using compromised employee credentials to access internal systems from an unusual geographic location.
There’s also an important piece of context:
HR confirmed that no employees are currently travelling internationally.
So now you have to investigate the login patterns, look for unusual locations and behaviour, and determine whether the activity could indicate credential abuse.
This is the kind of scenario I like seeing beginners practise because it puts you in the mindset of an actual analyst.
You’re not just learning what threat hunting means. You’re given a hypothesis, business context, logs and a security problem to investigate.
DTO has several hands-on exercises like this across different areas of cybersecurity.
If you're learning SOC/Blue Team, don't just watch videos.
Get your hands on some logs and start hunting.
defendtheorg.com/r/MASKOFF02…
Suspicious Login Pattern Hunt
Scenario:
A threat intelligence team discovers that employee credentials from a recent third-party breach may be circulating on the dark web.
The team wants to know:
Are any of those compromised credentials already being used to access the organisation?
As the analyst, you’re given VPN authentication logs and asked to investigate suspicious login activity.
The interesting part is the hypothesis:
An attacker may be using compromised employee credentials to access internal systems from an unusual geographic location.
There’s also an important piece of context:
HR confirmed that no employees are currently travelling internationally.
So now you have to investigate the login patterns, look for unusual locations and behaviour, and determine whether the activity could indicate credential abuse.
This is the kind of scenario I like seeing beginners practise because it puts you in the mindset of an actual analyst.
You’re not just learning what threat hunting means. You’re given a hypothesis, business context, logs and a security problem to investigate.
DTO has several hands-on exercises like this across different areas of cybersecurity.
If you're learning SOC/Blue Team, don't just watch videos.
Get your hands on some logs and start hunting.
defendtheorg.com/r/MASKOFF02…
XXIII retweeted
I was less busy today, so I decided to visit DTO and honestly, I was impressed.
I realised how much the platform has grown over the past few months.
Looking at it now, I genuinely wish something like this existed when I started learning cybersecurity.
For beginners, having a structured place to learn, practise, follow challenges, and actually build hands-on experience can make the journey a lot less confusing.
If you’re currently learning cybersecurity and tired of jumping from one random resource to another, explore DTO yourself and see what I mean.
defendtheorg.com/r/MASKOFF02…
I was less busy today, so I decided to visit DTO and honestly, I was impressed.
I realised how much the platform has grown over the past few months.
Looking at it now, I genuinely wish something like this existed when I started learning cybersecurity.
For beginners, having a structured place to learn, practise, follow challenges, and actually build hands-on experience can make the journey a lot less confusing.
If you’re currently learning cybersecurity and tired of jumping from one random resource to another, explore DTO yourself and see what I mean.
defendtheorg.com/r/MASKOFF02…
XXIII retweeted
I speak to a lot of candidates and I wish they understood 'entry level' is a temporary status. Absorb the training and pay increases once you've increased your value.
XXIII retweeted
🟦 ITS TIME TO UNDERSTAND BOTH SIDES 🟥
Purple Teaming is an exercise that brings the Red Team and the Blue Team together with a shared goal: Improve the Security Posture of the Org.
The 10th skill is live NOW - Give it a shot, at DefendTheOrg 🛡️
XXIII retweeted
What does purple teaming actually look like when you move beyond the theory?
That's exactly what I wanted to bring to DefendTheOrg.
The new Purple Teaming experience puts you in the middle of an attack simulation where you have to analyze telemetry, identify detection gaps, engineer improvements, map coverage to MITRE ATT&CK, and validate your work by rerunning the attack.
Because the goal isn't just to write more detections. It's to understand where your defenses fall short and systematically make them better.
Purple Teaming is live on DefendTheOrg. Go put your skills to the test.
XXIII retweeted
Added a chatbot to your app? You added an attack surface.
One prompt injection and it works for the attacker, not you.
Anthropic and OpenAI secure the model. Not your app. What you connect it to, what data it sees, what it's allowed to run, that's on you.
The model is fine. Your code is the problem.
#AppSec #AI
XXIII retweeted
The cybersecurity job market is competitive. Make your portfolio, practical experience and ability to communicate your strongest selling points.
You can watch 20 videos about threat hunting and still struggle when someone gives you actual logs to investigate.
That's the difference between understanding a concept and being able to apply it.
Practise reading logs. Look for patterns. Investigate suspicious activity. Learn to explain your findings.
If you need somewhere to practise, check out DefendTheOrg.
defendtheorg.com/r/MASKOFF02…
The cybersecurity job market is competitive. Make your portfolio, practical experience and ability to communicate your strongest selling points.
You can watch 20 videos about threat hunting and still struggle when someone gives you actual logs to investigate.
That's the difference between understanding a concept and being able to apply it.
Practise reading logs. Look for patterns. Investigate suspicious activity. Learn to explain your findings.
If you need somewhere to practise, check out DefendTheOrg.
defendtheorg.com/r/MASKOFF02…
XXIII retweeted
You can watch 20 videos about threat hunting and still struggle when someone gives you actual logs to investigate.
That's the difference between understanding a concept and being able to apply it.
Practise reading logs. Look for patterns. Investigate suspicious activity. Learn to explain your findings.
If you need somewhere to practise, check out DefendTheOrg.
defendtheorg.com/r/MASKOFF02…
You can watch 20 videos about threat hunting and still struggle when someone gives you actual logs to investigate.
That's the difference between understanding a concept and being able to apply it.
Practise reading logs. Look for patterns. Investigate suspicious activity. Learn to explain your findings.
If you need somewhere to practise, check out DefendTheOrg.
defendtheorg.com/r/MASKOFF02…
XXIII retweeted
Two OSPF routers are connected, but they are not forming a neighbour relationship.
Which setting should you check first?
A. Hello and Dead timers
B. Switch port security
C. VLAN database
D. NAT configuration
XXIII retweeted
You're not starting from zero. Your experience in IT compliance, asset management, procurement and operations already connects to cybersecurity, particularly GRC and IT risk management.
Start with security fundamentals, networking and basic hands-on practice. Explore GRC as a possible entry point, then build from there. Don't throw away the experience you already have.
XXIII retweeted
Cybersecurity hiring will go crazy in 2027 - and here's what I would do to take advantage of these opportunities to come 📈📈