Jishnu EC — Field Notes

🦠 Completed: History of Malware — TryHackMe

Wed, 05 Aug 2026 09:00:00 +0530

Worked through TryHackMe's History of Malware room — a walkthrough tracing malicious software from Von Neumann's 1949 theoretical work on self-replicating programs all the way to the Morris Worm's real-world fallout in 1988. Interesting seeing how much of today's malware taxonomy — worms, Trojans, boot-sector viruses, fork bombs — traces back to experiments and pranks that spiralled out of their creators' control long before "cybersecurity" was a job title.

Creeper & Reaper (1971) — The first self-replicating program spread over ARPANET and just displayed a taunting message; Reaper followed soon after as arguably the first antivirus, built specifically to hunt it down
ANIMAL (1975) — The first Trojan, disguised as a guessing game while a companion routine quietly copied itself into every directory the user could reach
Elk Cloner (1982) — Written by a 15-year-old as a prank, it became one of the first viruses to spread "in the wild" via floppy disk using a boot-sector infection technique
Morris Worm (1988) — A research experiment gone wrong that knocked out a meaningful share of the early internet and led to the first felony conviction under the US Computer Fraud and Abuse Act
Key Takeaway — Most of today's malware categories were first defined by accident, decades before defending against them was anyone's job

🎭 Built Shitty Human — Serverless Mood Tracking & Social App

Sat, 01 Aug 2026 09:00:00 +0530

Shipped Shitty Human — a 2,894-line mood tracker that grew into a full social app: friend requests, real-time chat, 30-second voice notes, and a 13-item achievement system the app calls "Citations." The whole thing is one HTML file talking straight to Firebase — no backend server, no framework, no build step. Firestore security rules do the job an API layer would normally do, validating a different required shape per chat-message type and locking fields like isPremium from ever being changed by a normal client write.

Zero Backend — Firebase Auth + Firestore only; a generated username@dayvibe.local address lets password auth work with no real email collected
Security Rules as the Backend — Hand-written Firestore rules validate message schemas per type, freeze immutable fields, and gate every read/write directly at the database
Voice Notes Under a Byte Ceiling — MediaRecorder-captured voice notes are base64-encoded and capped client- and rule-side to stay well under Firestore's 1MiB document limit
13 Citations — A full achievement system (Century Club, Night Owl, Comeback, and 10 more) unlocked by real usage patterns, not manual toggles
Key Takeaway — Firestore security rules alone can replace a surprising amount of what a traditional backend would normally guard

🎣 Completed: TryHackMe SOC Simulator — Introduction to Phishing

Sat, 18 Jul 2026 09:00:00 +0530

Worked through TryHackMe's SOC Simulator as a Tier 1 analyst, triaging five live alerts in a simulated Splunk environment. Identified three true positive phishing attempts — including a typosquatted Microsoft domain and a lookalike Amazon shipping scam — and correctly cleared two false positives after pivoting through firewall logs and internal correspondence to confirm context.

Alerts Triaged — 5 live alerts worked end-to-end as a Tier 1 SOC analyst inside a simulated Splunk environment
True Positives — 3 confirmed, including a typosquatted Microsoft domain and a lookalike Amazon shipping scam
False Positives Cleared — 2, confirmed by pivoting through firewall logs and internal correspondence for context
Result — 95 points, 1st place on the leaderboard, 60% true positive rate

🚩 General Skills — CyLab Security Academy

Sat, 04 Jul 2026 09:00:00 +0530

Completed the General Skills category — the foundational track every CTF player starts with. Most of the modules were finished back when the platform was still known as picoCTF, before its 2026 rebrand to CyLab Security Academy.

Linux Fundamentals — navigating the filesystem, permissions, and piping commands together to hunt down flags
Basic Scripting — quick Python/Bash one-liners to automate repetitive CTF grunt work
Encoding Schemes — Base64, hex, and other common encodings used to hide flags in plain sight
Key Takeaway — General Skills is the on-ramp; every other category (crypto, forensics, web) leans on these fundamentals

📈 Detection and Analysis — TryHackMe

Wed, 17 Jun 2026 09:00:00 +0530

Picked up where alert triage leaves off — this room dives into the Detection and Analysis phase of incident response. Learned to write SPL queries to dig deeper into logs and build a clearer picture of what actually happened after an alert fires.

SPL Queries — Writing Splunk Search Processing Language queries to pivot through logs and surface relevant events
Post-Triage Analysis — Moving past the initial alert to confirm scope, timeline, and root cause of an incident
Detection Logic — Understanding how correlation rules turn raw log data into actionable alerts
Key Takeaway — Triage tells you something happened; detection and analysis tells you exactly what, how, and how far it spread

🚨 SOC L1 Alert Triage — TryHackMe

Tue, 16 Jun 2026 09:00:00 +0530

Worked through a hands-on SOC L1 alert triage room with a real dashboard simulation — great way to practice prioritizing alerts, distinguishing false positives from genuine threats, and learning the day-to-day triage workflow analysts use on the job.

Real Dashboard Simulation — Practiced triage inside an actual SOC-style alert console, not just theory slides
Alert Prioritization — Sorting alerts by severity and business impact to decide what gets investigated first
False Positive Reduction — Identifying noisy or benign alerts to keep analyst attention on real threats
Key Takeaway — Fast, accurate triage at L1 is what keeps a SOC from drowning in alert fatigue

📋 Preparation — TryHackMe

Mon, 15 Jun 2026 09:00:00 +0530

Covered the Preparation phase of incident response — the foundation every SOC team needs before an incident ever happens. Dug into IR frameworks, building a Playbook/Procedure Pyramid (PPP), and the role of visibility, logging, and detection in being truly ready.

IR Frameworks — Structured approaches (NIST, SANS) that define how an organization prepares for and responds to incidents
Playbooks & Procedures (PPP) — Documented response steps that turn chaotic incidents into repeatable, consistent action
Visibility & Logging — Centralized log collection across endpoints and network as the backbone of any detection capability
Detection Engineering — Translating visibility into actionable alerts that catch real threats early
Key Takeaway — You can't respond to what you can't see — preparation is 90% of incident response

🔍 Spectrum Challenge — Blue Team Labs Online

Sun, 14 Jun 2026 09:00:00 +0530

Tackled the Spectrum challenge on BTLO — a surprisingly realistic forensic investigation combining audio steganography, zip cracking, and hidden data extraction. Audacity, fcrackzip, and steghide made this one a proper toolchain workout.

Audacity — Analyzed audio files for hidden data embedded in spectrograms and waveform anomalies
fcrackzip — Brute-forced password-protected zip archives to extract concealed evidence
steghide — Extracted hidden payloads embedded inside image files using steganography techniques
Key Takeaway — Real investigations rarely use one tool — the ability to chain techniques is what separates good analysts

📧 Phishing Email Analysis — LetsDefend

Wed, 10 Jun 2026 09:00:00 +0530

Deep-dived into phishing email analysis — covering static and dynamic techniques to dissect malicious emails, read and trace headers, analyze suspicious attachments, and identify threat actor infrastructure.

Email Header Analysis — Tracing Return-Path, Received headers, and X-Originating-IP to detect spoofing and map the full delivery chain
Static Analysis — Inspecting raw email source, embedded URLs, and attachment hashes without execution
Dynamic Analysis — Safely detonating phishing links and attachments in sandboxed environments for behavioral observation
Key Takeaway — Headers never lie — even the most convincing phish leaves forensic trails in the metadata

📊 Training Impact on Teams — TryHackMe

Tue, 09 Jun 2026 09:00:00 +0530

Explored how structured cybersecurity training drives measurable ROI for security teams — covering skill progression frameworks, detection rate improvements, and how to justify training investment to stakeholders.

ROI of Training — Quantifying the return on security training through reduced incident response time and improved detection accuracy
Skill Gap Analysis — Identifying team weaknesses and mapping training paths to close coverage gaps in the security posture
Team Performance Metrics — How training translates directly into faster triage, better threat identification, and lower MTTR
Key Takeaway — A well-trained SOC team is the most cost-effective security control an organization can invest in

🤖 AI, ML, DL & LLM Security Threats — TryHackMe

Mon, 08 Jun 2026 09:00:00 +0530

Covered the fundamentals of how AI, ML, DL, and LLMs work — and how they intersect with cybersecurity as both dangerous attack vectors and powerful defensive tools.

AI — The overarching field enabling machines/systems to mimic human behaviour and decision-making
Machine Learning — A subfield of AI where models are trained on input data to learn patterns and make predictions
Deep Learning — A subfield of ML using Neural Networks to self-learn and process mass amounts of data without human interaction
LLMs & Cyber Offense — AI-powered phishing, automated vulnerability discovery, deepfake social engineering
AI in Defense — Anomaly detection, intelligent SIEM correlation, and ML-driven threat hunting

🛡️ D3FEND Challenge — Blue Team Labs Online

Sat, 06 Jun 2026 09:00:00 +0530

Looks like a small one, but it’s deeply rooted to the core of MITRE D3FEND — a knowledge graph of cybersecurity countermeasures that maps defensive techniques against adversarial TTPs.

🔓 Basic Pentesting — TryHackMe

Thu, 04 Jun 2026 09:00:00 +0530

Worked through the Basic Pentesting room on TryHackMe — a beginner-to-intermediate Linux box covering the full kill chain: enumeration, exploitation, and privilege escalation to root.

Enumeration — Nmap service scan, Gobuster directory brute-force, SMB enumeration
Exploitation — Weak SSH credentials discovered via Hydra brute-force — initial foothold gained
Privilege Escalation — Linux privesc to root via misconfigured sudo permissions
Key Takeaway — Thorough enumeration is the foundation of every successful pentest

🧠 Learning Volatility — A Path Toward Forensic Archiving

Thu, 09 Apr 2026 09:00:00 +0530

Mastering Volatility isn't just about live incident response — it's a foundational step toward forensic archiving. Memory artifacts captured today can be preserved and referenced in case files long after the incident closes.

Forensic Archiving — Volatility outputs (pslist, netscan, malfind) exported as structured evidence for case records
Memory Artifact Preservation — volatile evidence captured before power-off becomes a permanent forensic record
Plugin Deep Dive — cmdline, dlllist, handles, and filescan reveal attacker footprint even without disk artifacts
Key Insight — Fileless malware leaves no trace on disk, but memory never lies

🚀 Completed Memory Analysis Introduction — TryHackMe

Wed, 08 Apr 2026 09:00:00 +0530

Dived into the fundamentals of memory forensics — how RAM works, how attackers exploit it, and how defenders catch threats in-memory before any trace hits disk.

RAM & Memory Structures — Stack, Heap, User vs Kernel Space
Process & Full Memory Dumps — capturing volatile data before it's gone
Code Injection Detection — identifying injected shellcode inside process memory
First Steps with Volatility — hands-on dump analysis and plugin usage

🚩 Released Udyama — My First Custom CTF Machine

Sun, 15 Feb 2026 09:00:00 +0530

Designed and packaged a fully custom Linux CTF VM with 2 flags — User and Root. Focused on real-world privilege escalation paths, not contrived puzzle challenges. Packaged as Ubuntu OVA for VirtualBox.

Platform — Ubuntu 22.04 OVA, runs in VirtualBox
Difficulty — Intermediate to Advanced
Focus — Realistic Linux privilege escalation & persistence techniques
Hosted on archive.org — free to download for the community

🛡️ Built Driver Vigilance — Real-Time Distraction Detection with ML

Sat, 10 May 2025 09:00:00 +0530

Designed and built a machine learning–driven driver monitoring system capable of detecting dangerous driving behaviors in real time — phone usage, turning around, reaching to the rear — and issuing instant alerts before they cause accidents.

Detection Scope — Phone usage, rear-seat distraction, abnormal head & body orientation
Core Stack — Python + OpenCV + ML classification model on live video input
Alert System — Real-time warnings triggered at configurable confidence thresholds
Key Insight — Most accidents begin 0.5–2 seconds before impact; real-time is the only acceptable latency

🛡️ Completed DFIR Introduction — TryHackMe

Mon, 10 Mar 2025 09:00:00 +0530

Solid grounding in Digital Forensics & Incident Response fundamentals — the methodology that separates a reactive responder from a structured, methodical analyst.

PICERL Framework — Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned
Evidence Handling — Chain of Custody, Evidence Preservation, Order of Volatility
Tools Covered — EZ Tools, KAPE, Autopsy, Volatility
Key Takeaway — Always collect most volatile evidence first; RAM disappears at shutdown

🔥 MemLoot Challenge — Ransomware Hidden as Spotify Installer

Mon, 24 Feb 2025 09:00:00 +0530

Analyzed a Windows memory dump using Volatility 3. A fake Spotify installer turned out to be Dark Havoc ransomware — a classic trojan delivery technique caught through memory forensics.

Malicious File — Spotify_setup.exe identified as Dark Havoc ransomware
C2 Server — 104.152.52.238:6548 · Encryption extension: .havoc
Execution Vector — Parent process explorer.exe, user double-clicked the fake installer
Detection Method — Process tree analysis + network artifacts from memory dump