SSH login attempts start showing up quickly on an internet-facing Linux server. Here’s how to find failed SSH logins with journalctl and auth.log, identify the usernames and IP addresses being targeted, and check whether anyone actually got in.
I moved my live AWS Cloud Resume infrastructure into Terraform without rebuilding the site or taking it offline. Along the way, I hit credential issues, import problems, and uncovered extra API Gateway routes and a broader Lambda permission I did not know were there.
A Linux server is running slow. What do you check first? Learn a practical troubleshooting process for Linux support interviews, including load, CPU, memory, disk, services, logs, and how to explain your reasoning clearly.
Everyone focuses on Linux, networking, and cloud tools. But in real IT, cybersecurity, and cloud work, and in the interviews that get you there, communication, calm troubleshooting, and trust matter just as much as technical know-how.
A LetsDefend SOC130 case where cleared logs, a backdoor account, and a fake powershell.exe led to a true positive VirusTotal missed.
In a recently published newsletter, I told the story of a government contractor in Australia who uploaded a spreadsheet full
A hands-on walkthrough of LetsDefend SOC137. Macro-enabled .docm file with obfuscated PowerShell, sandbox evasion, process injection, and MRU deletion. True Positive.
I built a Python bot that monitors my Linux server, detects SSH brute force and web shell scanning, sends Slack alerts, and auto-blocks attackers via UFW.
A hands-on walkthrough of LetsDefend SOC338. Lumma Stealer delivered via ClickFix phishing and DLL side-loading. Real investigation steps, MITRE tags, and verdict.
I installed Splunk on my own production server to build real SOC skills. Here’s what I found already probing my server, and how I locked myself out with my own detection stack.
