Cybermini Articles

Splunk in Plain English — A Practical SOC Guide

2026-06-02T06:36:33.845+05:30

Imagine you are a detective, and every device on your network — servers, laptops, firewalls, cloud systems — is leaving footprints everywhere. The problem is there are millions of footprints every single day, scattered across thousands of different files. Your job is to find the one set of footprints that does not belong. That is exactly the problem Splunk solves. It is the platform that collects every footprint from every device, puts them in one place, and gives you the tools to find the suspicious ones — fast.

In this blog, I will take you through Splunk from absolute scratch — what it is, how it works under the hood, how to write SPL queries like a pro, how to build dashboards and alerts, how to set up a SOC lab, and most importantly, the interview questions you will definitely face if you are going for a SOC analyst role. I have completed the TryHackMe Advanced Splunk rooms including SPL exploration, SOC lab setup, dashboards and reports, data manipulation, and the Fixit room — this is everything I learned, explained as simply as possible.

1. What is Splunk and Why Does Every SOC Use It?

Before we talk about Splunk specifically, we need to understand what problem it solves. Every device on a network generates logs — authentication events, network connections, process executions, file accesses, errors. A single enterprise network can generate billions of log entries per day. You cannot manually read those. You need a system that collects them all, stores them searchably, and lets you query them in real time. That system is called a SIEM — Security Information and Event Management platform. Splunk is the most widely deployed SIEM in the world.

Think of a SIEM like the control tower at a busy airport. Every aircraft (device), gate (application), and runway (network path) sends its status to the tower constantly. The tower (SIEM) sees everything, correlates events across all of them, and immediately alerts controllers when something is wrong. Without the tower, each aircraft is isolated and a collision could happen undetected.

Splunk specifically does three things: it collects data from any source, indexes it in a compressed and searchable format, and lets you search and visualize it using SPL — Search Processing Language. On top of that, you build dashboards, schedule reports, and configure alerts that fire automatically when suspicious patterns appear.

Splunk Products You Will Encounter in a SOC

Product	What It Does	Common in SOC?
Splunk Enterprise	The core platform — on-premises deployment for collecting, indexing, and searching data	Yes — the most common
Splunk Cloud	The SaaS version of Enterprise — Splunk manages the infrastructure	Yes — growing fast in enterprise
Splunk ES (Enterprise Security)	A SIEM application built on top of Enterprise — adds correlation searches, incident review, risk scoring	Yes — the SOC standard
Splunk SOAR (Phantom)	Security Orchestration, Automation, and Response — automates analyst actions like blocking IPs	Yes — used by Tier 2 and 3
Splunk Free	500 MB/day limit, single user, no alerting — good for home labs and learning	For learning only

Interview Tip: Interviewers love asking "What is the difference between Splunk and Splunk ES?" The answer is: Splunk is the platform. Splunk Enterprise Security is the SIEM application that runs on top of it. ES adds the Notable Events framework, correlation searches, risk-based alerting, and the incident review workflow that SOC analysts use daily. You need Splunk Enterprise to run ES.

2. Splunk Architecture — How the Data Flows

Understanding Splunk's architecture is not just academic — you will be asked about it in interviews, and more importantly, when something breaks in production, knowing the architecture is the only way to diagnose it. There are three core components.

Component 1: Forwarder — The Data Collector

Forwarders are lightweight agents installed on the machines you want to monitor — Windows servers, Linux endpoints, firewalls, anything. Their only job is to collect log data and send it to the indexer. There are two types you need to know:

Universal Forwarder (UF) — A tiny, dedicated agent (~20 MB) that collects and forwards data without doing any processing locally. Uses minimal CPU and RAM. This is what you install on every endpoint in the environment — hundreds or thousands of them. It cannot index data on its own.
Heavy Forwarder (HF) — A full Splunk instance that can parse, filter, mask, and route data before forwarding it. Used at aggregation points — for example, a syslog server receiving logs from 500 network devices would run an HF to normalise and route that data before it reaches the indexer.

Component 2: Indexer — The Storage Engine

The indexer receives raw data from forwarders, breaks it into individual events, extracts timestamps and fields, compresses it, and stores it on disk in time-ordered buckets. Each bucket goes through a lifecycle: Hot (actively being written), Warm (recent, read-only), Cold (older, may move to slower storage), and Frozen (archived or deleted based on your retention policy).

Data is stored inside indexes — logical containers you create (like index=windows or index=firewall). You search by specifying which index to look in. Always scope your searches to a specific index — searching without one scans everything and is extremely slow.

Component 3: Search Head — The Interface You Use

The Search Head is the web interface you log into at http://localhost:8000. It is where you write SPL queries, build dashboards, create alerts, and view results. When you run a search, the Search Head distributes it across all indexers in parallel, collects the results, and presents them to you. In enterprise environments, multiple Search Heads form a cluster for high availability.

Supporting Components

Component	What It Does
Deployment Server	Centrally pushes configurations and Splunk apps to hundreds or thousands of Universal Forwarders — you configure once and it distributes everywhere
Cluster Manager (Master Node)	Manages the indexer cluster — controls replication of data across indexers for high availability and no data loss
License Manager	Controls how much data (in GB per day) your deployment is allowed to index — exceed it and searches get blocked

Interview Tip: "What is the difference between a Universal Forwarder and a Heavy Forwarder?" — Universal Forwarder is lightweight, forwards raw data only, cannot index locally. Heavy Forwarder is a full Splunk binary that can parse, filter, mask sensitive data, and route to multiple destinations before forwarding. UFs go on every endpoint; HFs sit in front of indexers for data normalisation.

3. Splunk UI Walkthrough — Your First Login

When you log in to Splunk for the first time (default URL is http://localhost:8000), the interface can feel overwhelming. Let me walk you through the key areas so you can navigate confidently from day one.

The Navigation Bar

Section	What It Does	Used For
Search & Reporting	The primary search interface where you write SPL	Ad-hoc investigations, threat hunting, testing queries
Dashboards	Visual panels populated by saved searches	SOC monitoring screens, executive reporting
Alerts	Automated searches that trigger actions when conditions are met	Threat detection, automated notifications
Reports	Saved searches that can be scheduled and emailed	Daily/weekly compliance and summary reports
Settings > Indexes	Create and manage data indexes	Admin: set up new log buckets, manage retention
Settings > Data Inputs	Configure how data enters Splunk	Admin: add new log sources, file monitors, syslog
Settings > Lookups	Manage reference tables for data enrichment	Upload threat intel lists, asset tables, user directories

The Search Bar — Four Things to Always Check First

Time Picker (top right) — Controls the time window for your search. Always verify this before running. Leaving it on "All time" on a production system will time out or take minutes.
Search Mode — Fast mode (only event count and fields used in the query), Smart mode (Splunk decides), Verbose mode (all fields). Use Fast for large datasets, Verbose when investigating individual events.
Field Sidebar (left panel) — After running a search, this shows all extracted fields. Click any field to see its top values and add them to your search — great for building queries interactively.
Event Inspector — Click any event row to expand it and see every field Splunk extracted. This is how you discover what field names to use in your queries.

Tip: Before running any search, always specify at minimum an index and a time range. The pattern index=windows earliest=-1h latest=now scopes your search to just the last hour of Windows events — this prevents you from accidentally running a query over all time and all data, which on a real deployment can take many minutes and consume significant resources.

4. SPL Fundamentals — The Language of Splunk

SPL — Search Processing Language — is how you talk to Splunk. If you have used SQL before, SPL will feel familiar in some ways, but there is one critical difference: SPL is a pipeline language. You start with a search that retrieves events, and then you chain commands together using the pipe character |. Each command transforms the data and passes the result to the next one. This is incredibly powerful once it clicks.

Basic Search Syntax

Every SPL search follows the same basic structure:

index=indexname sourcetype=sourcetype keyword | command1 | command2 | command3

The part before the first pipe is the search expression — it retrieves raw events. Everything after the first pipe is the pipeline — it transforms those events into results.

# Simple keyword search
index=main failed

# Field-value search
index=windows EventCode=4625

# Multiple field-value conditions (AND is implied between terms)
index=windows EventCode=4625 host=dc-01

# OR and NOT
index=main (error OR failed OR denied)
index=main login NOT success

# Wildcard — asterisk matches any characters
index=main fail*                    # matches fail, failed, failure
index=firewall src_ip=192.168.*     # any IP starting with 192.168

Comparison Operators

index=web status=404               # equals
index=web bytes>1000000            # greater than
index=web status!=200              # not equal
index=web status>=400              # greater than or equal
index=windows EventCode IN (4624, 4625, 4648)   # multiple values

The Three Default Fields — Always Present on Every Event

Every event in Splunk automatically has these fields — you do not need to extract them, they are always there:

Field	What It Contains	Example Value
`index`	Which index the data lives in	`windows`, `firewall`
`sourcetype`	The format/parser applied to this data — determines which fields get extracted	`WinEventLog:Security`, `cisco:asa`
`source`	The file path or input the data came from	`/var/log/auth.log`
`host`	The device that generated the event	`dc-01`, `web-server-02`
`_time`	The event timestamp as a Unix epoch number	`1748736000`
`_raw`	The original raw log text exactly as it was received	The full unprocessed log line

Time Modifiers — Scoping Your Search Window

You can set the time range in the UI picker or directly in your SPL. Knowing the time syntax is important for alerts and reports where you cannot click a dropdown.

# Relative time — format: [+/-][number][unit]
# Units: s=seconds, m=minutes, h=hours, d=days, w=weeks, mon=months

index=main earliest=-1h latest=now         # last 1 hour
index=main earliest=-24h latest=-1h        # from 24 hours ago to 1 hour ago
index=main earliest=-7d                    # last 7 days

# Snapping with @ — round to the nearest boundary
earliest=-1d@d     # start of yesterday (midnight)
earliest=-1w@w     # start of last week (Monday midnight)
earliest=-1mon@mon # start of last month

# Absolute timestamps
earliest="06/01/2026:00:00:00"

Interview Tip: Interviewers sometimes ask "How do you search only within business hours?" The answer involves time modifiers and the date_hour field: index=windows | where date_hour>=9 AND date_hour<=17 AND date_wday!="saturday" AND date_wday!="sunday". This filters results to events that occurred between 9am–5pm on weekdays, regardless of the time range you searched.

5. Core SPL Commands — The 20 You Will Use 95% of the Time

Splunk has over 140 SPL commands. In a real SOC, you will reach for the same 20 commands repeatedly. I am going to cover every important one with real security examples so that you can immediately apply them.

A. stats — Aggregate and Count Events

The single most important SPL command. stats takes many events and computes statistics — counts, sums, averages, distinct counts — grouped by any field. If you only learn one command deeply, make it this one.

# Count events by a field value
index=windows EventCode=4625 | stats count by src_ip
# Answer: How many failed logins came from each source IP?

# Multiple statistics at once
index=web | stats count, avg(bytes), max(bytes) by src_ip

# Count distinct values (dc = distinct count)
index=windows | stats dc(user) as unique_users by host
# Answer: How many unique users logged into each server?

# List all values of a field per group
index=windows EventCode=4624 | stats values(src_ip) as source_ips by user
# Answer: What IP addresses did each user log in from?

# Earliest and latest event times per group
index=windows | stats earliest(_time) as first_seen, latest(_time) as last_seen by src_ip

stats functions to memorise: count — total events | dc(field) — distinct count | sum(field) — sum of a numeric field | avg/min/max(field) — basic statistics | values(field) — list unique values | list(field) — list all values including duplicates | earliest/latest(_time) — first and last event time.

B. timechart — Plot Events Over Time

timechart is like stats but adds a time dimension. The result is a table where the first column is a time bucket and subsequent columns are your statistics. This is what powers line charts and area charts on dashboards — perfect for spotting anomalous spikes.

# Count events per hour
index=windows EventCode=4625 | timechart span=1h count

# Count per 30-minute window, split by user (top 10 users)
index=windows | timechart span=30m count by user limit=10

# Average response time over 5-minute windows
index=web | timechart span=5m avg(response_time) by uri

C. table — Format Results as a Clean Table

# Show specific fields as a readable table
index=windows EventCode=4625
| table _time, host, user, src_ip, Failure_Reason

D. where — Filter After Aggregation

Use where to filter the results of a previous pipeline stage — especially after stats. It accepts eval-style expressions, null checks, and string functions.

# Find IPs with more than 50 failed logins
index=windows EventCode=4625 | stats count by src_ip | where count > 50

# Filter where a field contains a substring
index=main | where like(user, "%admin%")

# Filter null / not null fields
index=main | where isnull(user)
index=main | where isnotnull(dest_ip)

E. eval — Create or Modify Fields

eval is the most versatile command in SPL. It creates new computed fields or modifies existing ones using expressions, math, string functions, and conditional logic. You use it constantly.

# Basic math
index=web | eval size_kb = bytes / 1024

# Conditional logic with if()
index=windows EventCode=4625 | stats count by src_ip
| eval threat_level = if(count > 100, "HIGH", if(count > 20, "MEDIUM", "LOW"))

# case() — like a switch/case for multiple conditions
| eval event_type = case(
    EventCode=4624, "Successful Login",
    EventCode=4625, "Failed Login",
    EventCode=4648, "Explicit Credential Login",
    1=1, "Other"
  )

# String operations
| eval domain = lower(mvindex(split(user, "@"), 1))

# Format epoch timestamp as readable string
| eval readable_time = strftime(_time, "%Y-%m-%d %H:%M:%S")

# Round a number to 2 decimal places
| eval pct = round(failed / total * 100, 2)

F. rex — Extract Fields With Regular Expressions

When Splunk's automatic field extraction does not get what you need, rex lets you define your own regex with named capture groups. The group names automatically become Splunk field names.

# Extract username and IP from an SSH failure log
index=syslog | rex field=_raw "Failed password for (?<user>\S+) from (?<src_ip>\d+\.\d+\.\d+\.\d+)"

# Extract a port number
index=firewall | rex "dst_port=(?<dest_port>\d+)"

# rex mode=sed — substitute/redact a pattern
index=main | rex mode=sed "s/password=[^ ]*/password=REDACTED/g"

G. dedup — Remove Duplicate Events

# Keep only the first event per unique field value
index=windows | dedup user
index=windows | dedup user, src_ip     # unique combination of both fields
index=main | dedup 3 host              # keep the first 3 events per host

H. sort — Order Your Results

index=main | stats count by src_ip | sort - count   # descending (highest first)
index=main | stats count by src_ip | sort + count   # ascending (lowest first)
index=main | stats count by src_ip | sort - count limit=10  # top 10 only

I. rename — Rename Fields for Readability

index=main | rename src_ip as "Source IP", dest_ip as "Destination IP"
# Useful for dashboard panels and emailed reports where technical field names look bad

J. fields — Include or Exclude Fields

# Keep only these fields (faster queries — Splunk skips extracting the rest)
index=windows | fields host, user, EventCode, src_ip

# Remove fields you do not need
index=windows | fields - _raw, punct

K. head and tail — Limit Results

index=main | head 20     # first 20 events (most recent if sorted by time)
index=main | tail 10     # last 10 events

L. search — Filter in the Middle of a Pipeline

search is like adding a new keyword filter mid-pipeline. Unlike where, it accepts the same syntax as the initial search bar — wildcards, field comparisons, and keyword matching against _raw.

index=main | stats count by user | search count>10
index=windows | table host, user, src_ip | search src_ip="10.0.*"

Interview Tip — Classic Question: "Write a SPL query to detect a brute force attack." The answer: index=windows EventCode=4625 | stats count by src_ip, Account_Name | where count > 10 | sort - count. Walk through it: Event 4625 is failed logon, I group by source IP and targeted username, filter for more than 10 failures, then sort by worst offenders. In production I would add a 5-minute time window and throttle the resulting alert to avoid repeat notifications for the same IP.

6. Data Manipulation — Shaping Raw Logs Into Useful Data

Real-world logs are messy. They contain inconsistent field names, multi-value fields, missing values, custom timestamp formats, and encoded data. Data manipulation commands let you clean, normalise, and reshape that raw data into something that is actually useful for analysis.

transaction — Group Related Events Into Sessions

transaction groups individual events that belong to the same logical sequence into a single result. This is extremely useful for session tracking — grouping all activity by the same user session, or tracking login-to-logout sequences.

# Group all web events by session ID into one row per session
index=web | transaction session_id maxspan=30m

# Track login to logout as one session per user
index=windows EventCode IN (4624, 4634)
| transaction user startswith=(EventCode=4624) endswith=(EventCode=4634) maxspan=8h
| eval session_minutes = round(duration / 60, 1)
# transaction auto-creates: eventcount (how many events), duration (seconds), _time (start time)

Performance Warning: transaction is memory-intensive and slow on large datasets. For simple session tracking, prefer using stats earliest(_time) as login_time, latest(_time) as logout_time by user combined with eval duration = logout_time - login_time — it does the same thing orders of magnitude faster.

mvexpand — Explode Multi-Value Fields

Sometimes a single field contains multiple values — for example, a list of blocked IPs, or multiple group memberships. mvexpand creates one row per value so you can count or filter them individually.

# If a firewall event has multiple blocked IPs in one field
index=firewall | mvexpand blocked_ips
# Now each IP is its own row — you can stats count by blocked_ips

mvcount, mvindex, mvfilter — Work With Multi-Value Fields

# Count how many values are in a multi-value field
index=main | eval ip_count = mvcount(src_ip)

# Get only the first value (index 0)
index=main | eval first_ip = mvindex(src_ip, 0)

# Filter a multi-value field to only matching values
index=main | eval internal_ips = mvfilter(match(src_ip, "^10\."))

fillnull — Handle Missing Values

# Replace null values with a default string
index=main | fillnull value="unknown" user, src_ip

# Fill all null numeric fields with 0
index=main | fillnull value=0

streamstats — Running Statistics as Events Flow

streamstats is like stats but it computes a running calculation for each event in sequence — the result is added as a new field on every row rather than collapsing events into a summary table.

# Calculate time between consecutive events from the same source IP
index=firewall | sort src_ip, _time
| streamstats last(_time) as prev_time by src_ip
| eval interval_seconds = _time - prev_time

Complete Data Manipulation Example — Classifying Failed Logins

# Full pipeline: extract, classify, rank, and label threat level
index=windows EventCode=4625
| rex "Account Name:\s+(?<target_user>\S+)"
| rex "Source Network Address:\s+(?<src_ip>[\d\.]+)"
| eval targeting_admin = if(match(target_user, "(?i)admin"), "YES", "NO")
| stats count as attempts, dc(target_user) as accounts_targeted, values(target_user) as accounts by src_ip, targeting_admin
| where attempts > 5
| eval risk = case(
    targeting_admin="YES" AND attempts>20, "CRITICAL",
    attempts>50, "HIGH",
    1=1, "MEDIUM"
  )
| sort - attempts
| table src_ip, attempts, accounts_targeted, accounts, targeting_admin, risk

7. Lookups, Macros, and Field Extractions

These three features transform Splunk from a log aggregator into a true threat intelligence platform. Lookups enrich your data with external context, macros make your searches reusable, and field extractions teach Splunk how to understand custom log formats.

Lookups — Enriching Events With External Data

A lookup joins your search results with an external reference table — typically a CSV file. This is how you add threat intel context (is this IP known malicious?), asset data (which team owns this server?), or user directory information (is this a privileged account?) to raw log events.

Step 1: Create your reference CSV. For example, a threat intelligence file:

ip,reputation,country,threat_type
185.220.101.5,malicious,RU,Tor exit node
45.142.212.100,malicious,DE,C2 server
198.51.100.0,suspicious,CN,Scanner

Step 2: Upload it at Settings → Lookups → Lookup table files, then define it at Settings → Lookups → Lookup definitions.

Step 3: Use it in SPL:

# Enrich firewall events with threat intel
index=firewall
| lookup threat_intel ip as src_ip OUTPUT reputation, country, threat_type
| where reputation="malicious"
| table _time, src_ip, dest_ip, action, reputation, country, threat_type

# inputlookup — search the lookup table itself like a regular index
| inputlookup threat_intel.csv | where threat_type="C2 server"

# outputlookup — write your search results to a CSV file
index=windows EventCode=4625 | stats count by src_ip | outputlookup brute_force_ips.csv

Tip: In Settings → Lookups → Automatic Lookups, you can configure Splunk to run a lookup automatically every time a specific sourcetype is searched — no need to add | lookup to every query. This is how enterprise deployments enrich events transparently without making analysts remember to add enrichment commands.

Macros — Reusable SPL Snippets

A macro is a saved SPL string that you can call by name in any search using backtick syntax. Think of it like a function in programming — define complex logic once, reuse it everywhere, and update it in one place when something changes.

# Define a macro called "brute_force_check" that expands to "count > 50"
# Set up at Settings → Advanced Search → Search Macros

# Use it with backtick syntax — double backticks surround the name:
index=windows EventCode=4625 | stats count by src_ip | where `brute_force_check`

# Macros with arguments — define "high_count(1)" where $threshold$ is the argument
# Macro body: count > $threshold$
index=windows | stats count by src_ip | where `high_count(100)`

Field Extractions — Teaching Splunk Your Log Format

For standard formats (JSON, key=value, CEF, LEEF, Windows Event Logs, syslog), Splunk extracts fields automatically. For custom application logs, you need to teach it.

Using the Field Extractor (easiest way): Run a search, click on any event, then click "Extract New Fields." Highlight the value you want to extract and name the field — Splunk generates the regex for you automatically and saves it as a permanent extraction.

Using transforms.conf (production-grade):

# transforms.conf — define the regex extraction
[extract_ssh_failure]
REGEX = Failed password for (?<ssh_user>\S+) from (?<ssh_src_ip>[\d\.]+) port (?<ssh_port>\d+)
SOURCE_KEY = _raw

# props.conf — apply it to the right sourcetype
[linux_secure]
REPORT-ssh = extract_ssh_failure

Subsearches — Nested Queries

A subsearch runs inside square brackets, executes first, and feeds its results as a filter into the outer search. This lets you answer questions like "show me logins from IPs that also appeared in our threat feed today."

# Show logins from IPs that were also detected port-scanning us
index=windows EventCode=4624
    [search index=nids alert.category="Port Scan" | return 100 src_ip]

# The subsearch runs first, returns up to 100 src_ip values
# The outer search then filters 4624 events to only those source IPs

Subsearch Limitations: By default, subsearches return a maximum of 10,000 results and timeout after 60 seconds. For large threat intelligence comparisons (millions of IOCs), use lookups instead — no row limit, much faster execution, and no timeout risk.

8. Dashboards and Reports — Visualising the Threat Landscape

A well-built SOC dashboard is what lets an analyst understand the current threat posture in under 30 seconds — without running a single search manually. Dashboards are collections of panels, each powered by a saved SPL search that runs on a refresh schedule.

Building a SOC Dashboard — Step by Step

In Splunk, go to Dashboards → Create New Dashboard. Give it a name, choose Classic Dashboard (XML-based, more widely documented) or Dashboard Studio (modern, JSON-based, drag-and-drop). Then add panels.

Every good SOC overview dashboard needs these panels at minimum:

Event volume over time — a line or area chart using timechart to show total events per hour. Spikes are your first indicator something unusual happened.
Failed login count — a single-value panel showing total 4625 events in the last hour. Configure colour thresholds: green under 20, yellow 20–100, red above 100.
Top 10 source IPs generating blocked traffic — a bar chart of external IPs hitting your firewall deny rules.
High-severity alert table — the last 50 high or critical events with time, host, source IP, and description.
Alert breakdown by category — a pie or bar chart showing which alert types are firing most.

SPL for Common Dashboard Panels

# Panel 1: Event volume per hour (last 24 hours)
index=main earliest=-24h | timechart span=1h count by index

# Panel 2: Failed login count — single value
index=windows EventCode=4625 earliest=-1h | stats count

# Panel 3: Top 10 denied source IPs
index=firewall action=deny | stats count by src_ip | sort - count | head 10

# Panel 4: Recent high-severity events table
index=main severity=high earliest=-4h
| table _time, host, src_ip, dest_ip, signature, severity
| sort - _time

# Panel 5: Alert category breakdown
index=nids | stats count by alert_category | sort - count

Input Tokens — Making Dashboards Interactive

Tokens are variables in a dashboard that users can change via dropdowns or text boxes, dynamically updating all panels. For example, a host selector dropdown where choosing a different machine re-runs all searches filtered to that host.

# In dashboard XML, a time input creates a $time_tok$ token
# Then reference it in panel searches:
index=windows EventCode=4625 $time_tok$ | stats count by src_ip

Reports — Scheduled and Emailed Searches

Reports are saved searches that run automatically on a schedule and optionally email results to a distribution list. This is how you deliver daily security summaries to management without manual effort.

Run your search → Save As → Report → give it a name
Edit the report → Schedule → Enable scheduling → set cron (e.g., 0 8 * * 1-5 = 8am Monday–Friday)
Under Actions → Send email → add recipients, choose format (CSV, PDF, inline HTML)
For expensive reports run frequently, enable Report Acceleration — Splunk pre-computes results using indexed summaries, dramatically reducing search time

Interview Tip: "How would you set up a daily failed login report for the security manager?" Answer: Save the query index=windows EventCode=4625 earliest=-24h | stats count by src_ip, Account_Name | sort -count as a report. Schedule it to run at 7am daily. Enable PDF generation. Add the security manager's email to the delivery list. If the dataset is large, enable report acceleration. This shows you understand the full workflow — not just querying, but operationalising it.

9. Alerts — Making Splunk Your Automated Watchdog

Alerts are scheduled searches that automatically take action when a condition is met. This is the core of how a SIEM does threat detection — instead of analysts watching dashboards 24/7, Splunk watches for you and fires notifications when something needs attention.

Alert Types

Type	When It Runs	Best For
Scheduled	On a cron schedule you define (e.g., every 5 minutes)	Most SOC detections — reliable and controllable
Real-time	Continuously, as each event arrives	Immediate detection for critical events — use sparingly, high system load
Rolling window	Real-time but evaluated over a sliding time window	"More than X events in the last Y minutes" type conditions

Building a Brute Force Alert — Full Configuration

# Alert query: fire when any IP generates 10+ failed logins in 5 minutes
index=windows EventCode=4625
| stats count by src_ip, Account_Name
| where count >= 10

# Alert settings:
# Schedule: every 5 minutes
# Trigger when: Number of Results is greater than 0
# Throttle: suppress for 60 minutes per src_ip (prevents 100 duplicate alerts from one attacker)
# Actions: Send email to soc-team@company.com + Create Notable Event in Splunk ES

Alert Actions

Email — Send alert details to the SOC team or a ticket queue
Webhook — POST a JSON payload to Slack, PagerDuty, Jira, or your SOAR platform for automated response
Run a script — Execute a Python or bash script to block an IP, create an incident ticket, or isolate an endpoint
Create Notable Event (ES) — Generates an incident in Splunk ES's Incident Review workflow for SOC triage
Add risk score — Contribute risk points to a user or host in Splunk ES's Risk-Based Alerting framework

SOC Alert Reference — Build These From Day One

Alert Name	Detection Logic	Severity
Brute Force Login	EventCode=4625, count > 10 by src_ip in 5 minutes	🔴 High
Password Spray	EventCode=4625, many unique users targeted from one IP, low count per user	🔴 High
Account Lockout Storm	EventCode=4740, count > 5 unique accounts in 10 minutes	🔴 High
New Admin Account Created	EventCode=4720 AND EventCode=4728 for Administrators group	🔴 High
Security Log Cleared	EventCode=1102	🚨 Critical
Audit Policy Disabled	EventCode=4719	🚨 Critical
Suspicious Service Installed	EventCode=7045, service path contains %TEMP% or %APPDATA%	🔴 High
Large Data Exfiltration	Sum of bytes_out > 500 MB to external IP from single host	🔴 High
Encoded PowerShell Execution	Sysmon Event 1, CommandLine contains -enc or -EncodedCommand	🔴 High

Tip — Throttling: Always configure throttle on your alerts. Without throttling, a single attacker generating 10,000 failed logins will trigger 10,000 email alerts — which is itself a denial-of-service against your SOC. Set throttle field to src_ip and suppression period to 60 minutes so the first alert fires and re-alerts are suppressed until the incident is resolved.

10. SOC Lab Setup — Ingesting Real Logs

Setting up your own Splunk SOC lab is the most effective way to cement everything you have learned. Here is the exact process I followed, from installing Splunk to having real Windows and Linux events flowing in with all fields properly extracted.

Lab Architecture

You need at minimum: one Splunk instance (your "server") and one or two virtual machines to monitor. A typical home lab setup:

Splunk Free installed on a Linux VM or your host machine — access at http://localhost:8000
Windows VM with Universal Forwarder + Sysmon installed — sends Windows Event Logs and Sysmon telemetry
Linux VM with Universal Forwarder — sends auth.log, syslog, and application logs

Step 1: Install Splunk

# Linux (RPM-based):
sudo rpm -i splunk-9.x.x-linux-2.6-x86_64.rpm
sudo /opt/splunk/bin/splunk start --accept-license

# Linux (tar.gz):
tar -xvf splunk-9.x.x-Linux-x86_64.tgz -C /opt
/opt/splunk/bin/splunk start --accept-license

# Set it to start on boot:
/opt/splunk/bin/splunk enable boot-start

# Access at http://localhost:8000 — default user: admin

Step 2: Install Sysmon on Your Windows VM

Sysmon (System Monitor by Microsoft Sysinternals) is a free tool that dramatically enriches Windows event logging. Without Sysmon, Windows gives you about 15 useful event types. With Sysmon, you get 30+ additional event types including process creation with full hashes, network connections, DLL loads, file creation, and DNS queries — all the telemetry you need for real threat detection.

# Download Sysmon from Microsoft Sysinternals
# Download SwiftOnSecurity's sysmonconfig.xml (best community configuration)
# Install:
sysmon64.exe -accepteula -i sysmonconfig.xml

# Key Sysmon Event IDs:
# Event 1  - Process Create (with command line and file hash)
# Event 3  - Network Connection (outbound from a process)
# Event 7  - Image Loaded (DLL loaded by a process)
# Event 8  - CreateRemoteThread (classic process injection indicator)
# Event 11 - File Created
# Event 22 - DNS Query (what domains is this process resolving?)

Step 3: Install and Configure Universal Forwarder

# Windows — silent install with basic configuration
msiexec.exe /i splunkforwarder-9.x.x-x64-release.msi ^
    RECEIVING_INDEXER="your-splunk-ip:9997" ^
    WINEVENTLOG_SEC_ENABLE=1 ^
    WINEVENTLOG_SYS_ENABLE=1 ^
    /quiet

# After install, edit %SPLUNK_HOME%\etc\system\local\inputs.conf
# to add Sysmon:
[WinEventLog://Microsoft-Windows-Sysmon/Operational]
disabled = 0
index = sysmon

# Linux — edit /opt/splunkforwarder/etc/system/local/inputs.conf
[monitor:///var/log/auth.log]
index = linux_auth
sourcetype = linux_secure

[monitor:///var/log/syslog]
index = linux_syslog

Step 4: Open the Receiving Port on Splunk

# In the Splunk UI: Settings → Forwarding and receiving → Configure receiving → New → Port 9997
# Or via CLI:
/opt/splunk/bin/splunk enable listen 9997 -auth admin:yourpassword

Step 5: Create Indexes for Each Log Type

# In UI: Settings → Indexes → New Index
# Or via CLI:
/opt/splunk/bin/splunk add index windows
/opt/splunk/bin/splunk add index sysmon
/opt/splunk/bin/splunk add index linux_auth
/opt/splunk/bin/splunk add index firewall

Step 6: Verify Data Is Flowing

# Check which indexes have data and how much
| tstats count where index=* by index, sourcetype

# Check last event time per host — detect dead forwarders
| tstats latest(_time) as last_seen where index=windows by host
| eval last_seen = strftime(last_seen, "%Y-%m-%d %H:%M")
| eval hours_ago = round((now() - last_seen_epoch) / 3600, 1)
| sort + last_seen    # hosts not heard from recently appear first

Step 7: Install These Splunk Apps in Your Lab

App Name	Why You Need It
Sysmon App for Splunk	Pre-built dashboards for all Sysmon event types
TA-Sysmon	Technology Add-on that extracts Sysmon fields correctly
Splunk Security Essentials	Library of 200+ pre-built detections mapped to MITRE ATT&CK
MITRE ATT&CK App for Splunk	Visual matrix showing which techniques your detections cover
Splunk App for Windows Infrastructure	Windows-specific monitoring dashboards

11. Fixit Room — Troubleshooting Splunk Like a Pro

The TryHackMe Fixit room teaches something most tutorials skip: what to do when Splunk is broken. These troubleshooting skills are what separate a junior from a senior Splunk user — and they come up in interviews more often than you would expect.

Problem 1: No Data Appearing in Search

This is the most common problem. Before assuming the data is lost, check these in order:

# 1. Does ANY data exist in ANY index?
| tstats count where index=* by index

# 2. Check internal Splunk logs for errors
index=_internal sourcetype=splunkd ERROR

# 3. Check forwarder connectivity — are hosts sending data?
index=_internal source=*metrics.log group=tcpin_connections
| stats latest(_time) as last_contact by hostname
| eval last_contact = strftime(last_contact, "%Y-%m-%d %H:%M")

# 4. Check time picker — is it set to a time range with no data?
# 5. Check index name — a typo in inputs.conf sends data to the wrong index
# 6. Check sourcetype — wrong sourcetype = wrong parser = events may be malformed

Problem 2: Timestamp is Wrong on Events

# Check splunkd.log for timestamp parsing warnings
index=_internal sourcetype=splunkd (timestamp OR strptime)

# Fix by specifying the format explicitly in props.conf:
[my_custom_sourcetype]
TIME_PREFIX = timestamp=
TIME_FORMAT = %Y-%m-%dT%H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 25

Problem 3: Searches Are Very Slow

Always start with index= — without it Splunk scans all indexes
Always add a time constraint — earliest=-24h at minimum
Replace stats with tstats for simple counts on indexed fields — 10–100x faster
Open the Job Inspector after a search (Job → Inspect Job) — it shows which stage is slow and how many events were scanned at each step
Enable Report Acceleration for frequently scheduled reports

# tstats is dramatically faster than stats for volume metrics
# It works on index, sourcetype, host, source, _time only
| tstats count where index=windows sourcetype=WinEventLog:Security by host

Problem 4: License Warning or Exceeded

# Check daily ingestion volume
index=_internal source=*license_usage.log type=Usage
| timechart span=1d sum(b) as bytes_indexed
| eval GB = round(bytes_indexed / 1073741824, 2)

# Find which sourcetype is consuming the most license
index=_internal source=*license_usage.log type=Usage
| stats sum(b) as bytes by st    # st = sourcetype in license log
| sort - bytes
| eval MB = round(bytes / 1048576, 1)

Splunk Internal Indexes — Your Diagnostic Toolkit

Index	Contains	Use It For
`_internal`	Splunk's own operational logs and performance metrics	Errors, license usage, forwarder status, search performance
`_audit`	Splunk user activity — who searched what, who logged in	Compliance auditing, insider threat monitoring of Splunk itself
`_introspection`	Splunk process resource usage — CPU, memory, disk I/O	Performance tuning, capacity planning

Tip — Splunk on Splunk: Build a "Splunk Health" dashboard monitoring index=_internal. Include panels for: daily license usage trend, forwarder last-seen heartbeat, index queue fill percentage (if input queues fill, data gets dropped silently), and search concurrency. Monitoring Splunk itself is a mark of operational maturity.

12. Real-World SOC Threat Hunting Queries

This is where everything comes together. These are production-ready SPL queries for the threat scenarios you will encounter most frequently as a SOC analyst. Each one is something I have either used directly or built based on real attack patterns.

Detecting a Password Spray Attack

Password spray is different from brute force. Brute force = many passwords tried against one account. Password spray = one password tried against many accounts to avoid lockout policies. The SPL pattern to detect it is: one source IP, many unique targeted users, but low attempt count per user.

index=windows EventCode=4625
| stats dc(Account_Name) as targets, count as total_attempts by src_ip
| where targets > 10 AND (total_attempts / targets) < 5
| sort - targets
# Spray pattern: hits many accounts but only 1-4 times each

Detecting Lateral Movement

# Internal workstations connecting to many other internal machines on admin ports
index=firewall action=allow dest_port IN (445, 3389, 5985, 5986, 135, 139)
| where match(src_ip, "^10\.|^172\.16\.|^192\.168\.")
| stats dc(dest_ip) as unique_targets, values(dest_port) as ports_used by src_ip
| where unique_targets > 5
| sort - unique_targets

Detecting C2 Beacon Behaviour (Regular Timing Intervals)

Malware communicating with a command-and-control server beacons at suspiciously regular intervals. Legitimate user traffic is irregular — humans do not click at exactly the same second every 60 seconds. The lower the standard deviation of intervals, the more machine-like the traffic.

index=proxy action=allowed
| sort dest_host, _time
| streamstats last(_time) as prev_time by dest_host
| eval interval = _time - prev_time
| stats count, avg(interval) as avg_interval, stdev(interval) as stdev_interval by dest_host
| where count > 20 AND stdev_interval < 30
| sort + stdev_interval
# Very low stdev = very regular = suspicious beaconing

Detecting Pass-the-Hash

index=windows EventCode=4624
    Logon_Type=3
    Authentication_Package=NTLM
| where NOT match(Account_Name, "\$$")    # exclude machine accounts ending in $
| table _time, ComputerName, Account_Name, Source_Network_Address, Workstation_Name
# PTH: NTLM network logon (type 3) from a workstation is suspicious — legitimate AD environments use Kerberos

Detecting Suspicious PowerShell

index=sysmon EventCode=1
    (Image=*powershell* OR Image=*pwsh*)
    (CommandLine=*-enc* OR CommandLine=*-EncodedCommand* OR CommandLine=*IEX* OR CommandLine=*DownloadString*)
| table _time, host, User, ParentImage, CommandLine
| sort - _time

Detecting Data Exfiltration

index=firewall action=allow
| where NOT match(dest_ip, "^10\.|^172\.16\.|^192\.168\.")    # external destinations only
| stats sum(bytes_out) as total_bytes by src_ip, dest_ip
| eval MB = round(total_bytes / 1048576, 2)
| where MB > 500
| sort - MB

Detecting Kerberoasting

index=windows EventCode=4769
    Ticket_Options=0x40810000
    Ticket_Encryption_Type=0x17    # RC4-HMAC — weak encryption, targeted by Kerberoasting tools
| where NOT match(Service_Name, "\$$")    # exclude machine accounts
| stats count by Account_Name, Client_Address, Service_Name
| where count > 3
| sort - count

13. Interview Q&A — 35 Questions You Will Actually Be Asked

Architecture and Concepts

Q: What is Splunk and what problem does it solve in a SOC?

A: Splunk is a SIEM and data analytics platform. It solves the problem of scale — a SOC cannot manually monitor billions of log events per day across thousands of devices. Splunk collects all that data in one place, indexes it for fast searching, and lets analysts write SPL queries to find malicious patterns. On top of that, automated alerts fire when those patterns are detected, so the SOC is notified without anyone watching a screen 24/7.

Q: Explain Splunk's architecture — what are the three main components?

A: Forwarder, Indexer, and Search Head. Forwarders (Universal Forwarders) are lightweight agents installed on monitored systems — they collect data and ship it to the Indexer. The Indexer parses, compresses, and stores data in time-ordered indexes on disk. The Search Head is the web interface analysts use to write SPL queries, view results, build dashboards, and create alerts. In large deployments these components are separate machines; in a small lab they can all run on one.

Q: What is the difference between a sourcetype and an index?

A: An index is the storage container — the bucket on disk where data lives. A sourcetype is the parser — it tells Splunk what format the data is in and which field extraction rules to apply. For example, index=windows stores all Windows logs, but within that index you might have sourcetype=WinEventLog:Security for Security events and sourcetype=WinEventLog:System for System events — each gets different field extractions applied.

Q: What is Splunk CIM and why is it important?

A: CIM — Common Information Model — is a standardised schema that normalises field names across different data sources. Source IP might be called src, src_ip, SourceAddress, or c-ip depending on the vendor. CIM maps all of these to a single normalised field name so you can write one SPL query that works across Cisco firewall, Palo Alto, and Windows logs simultaneously. CIM is the foundation for Splunk ES correlation searches and makes cross-source threat hunting possible.

Q: What are hot, warm, cold, and frozen buckets?

A: These are the lifecycle stages for indexed data. Hot = actively being written to, most recent data. Warm = closed but searchable on fast storage. Cold = older data, may move to slower/cheaper storage. Frozen = archived or deleted — Splunk removes the search index metadata. You can configure a frozen archive script to copy data to cheap storage before Splunk removes it. Retention policies control when data transitions between stages, which is important for compliance (e.g., keep firewall logs for 1 year).

SPL Questions

Q: What is the pipe character in SPL and how does the pipeline work?

A: The pipe | passes the output of one command as the input to the next — it makes SPL a pipeline language. Each command transforms the dataset. For example: retrieve events with the initial search → | stats to aggregate → | where to filter the aggregated results → | sort to order → | table to format output. This composability means complex analysis is built from simple, chainable steps.

Q: What is the difference between stats and tstats?

A: stats searches through raw event data — flexible, works on any field, but slower on large datasets. tstats uses pre-built tsidx (time-series index) metadata — extremely fast but limited to indexed fields only (index, sourcetype, host, source, _time, and fields from accelerated data models). I use tstats for volume dashboards and forwarder monitoring where I just need counts, and stats for deep event-level analysis.

Q: When would you use transaction vs. stats?

A: I default to stats with earliest()/latest() and eval duration = last - first because it is much faster. I use transaction only when I need to see the full raw text of grouped events together (like viewing an entire HTTP session log), or when I need the eventcount field that transaction automatically provides, or when grouping by complex start/end conditions like "from EventCode=4624 to EventCode=4634".

Q: How do you use eval to handle conditional logic?

A: For binary conditions I use if(condition, value_if_true, value_if_false). For multiple conditions I use case(condition1, val1, condition2, val2, ..., 1=1, default) — the 1=1 at the end acts as a catch-all default (it is always true). For example: | eval risk = case(count>100 AND targeting_admin="YES", "CRITICAL", count>50, "HIGH", count>10, "MEDIUM", 1=1, "LOW").

Q: What is a subsearch and what are its limitations?

A: A subsearch is a Splunk search nested inside square brackets that runs first and feeds its results as a filter to the outer search. Limitation 1: returns maximum 10,000 results by default. Limitation 2: 60-second timeout. Limitation 3: the results are converted to a search filter, so only returned field values are usable, not full events. For large threat intel lists with millions of IOCs, use a lookup table instead — no row limit, no timeout, and orders of magnitude faster.

Q: Write SPL to detect impossible travel — same user logging in from two countries within one hour.

A: index=windows EventCode=4624 | lookup geoip src_ip OUTPUT country | stats values(country) as countries, dc(country) as country_count, earliest(_time) as first_login, latest(_time) as last_login by user | where country_count > 1 AND (last_login - first_login) < 3600 | eval time_diff_min = round((last_login - first_login) / 60, 1) | table user, countries, time_diff_min — this finds users who appear in more than one country within 3600 seconds.

SOC Operations Questions

Q: What is the difference between brute force and password spray — and how do you detect each in Splunk?

A: Brute force = many passwords tried against one account. Detect with: many 4625 events with the same Account_Name. Password spray = one password tried against many accounts to avoid lockout. Detect with: many 4625 events from the same src_ip but many different Account_Names, with low count per account. The SPL key is looking at dc(Account_Name) vs count / dc(Account_Name) ratio — spray shows high unique accounts, low attempts per account.

Q: What is alert fatigue and how does Splunk help solve it?

A: Alert fatigue is when analysts receive so many alerts that they start ignoring them — making even real threats go unnoticed. Splunk ES addresses this with Risk-Based Alerting (RBA): instead of alerting on every individual suspicious event, the system assigns risk scores to users and hosts as suspicious behaviours accumulate. An alert only fires when the cumulative risk score for an entity crosses a defined threshold. This dramatically reduces alert volume while maintaining detection coverage — one alert per compromised user, not one per event.

Q: Walk me through how you would investigate a potential compromised endpoint using Splunk.

A: I start with the initial indicator — confirm it is a true positive by reviewing the raw event. Then I scope the timeline: what did this host do in the 24 hours before and after the indicator? I check process creation (Sysmon Event 1) for suspicious parent-child relationships, network connections (Sysmon Event 3) for unexpected outbound connections, file creation (Sysmon Event 11) for dropped malware, and Windows Event Logs for new accounts or service installations. Then I check for lateral movement — did this host initiate SMB, RDP, or WMI connections to other internal hosts? I document everything in a timeline and escalate with the evidence gathered.

Q: What is Kerberoasting and which Event ID detects it?

A: Kerberoasting is an attack where an authenticated domain user requests Kerberos service tickets for service accounts (which anyone can do in AD), then attempts to crack the tickets offline to obtain the service account's password. The key indicator is Event ID 4769 (Kerberos service ticket requested) where the Ticket Encryption Type is 0x17 (RC4-HMAC). Legitimate modern environments use AES encryption (0x12, 0x11). Multiple 4769 events with RC4 encryption in a short period from one account is a strong Kerberoasting indicator.

Q: How do you detect Pass-the-Hash in Splunk?

A: Pass-the-Hash (PTH) uses an NTLM hash instead of a password to authenticate, bypassing the need to know the plaintext password. In Windows Event Logs, this appears as Event ID 4624 with Logon Type 3 (network) and Authentication Package = NTLM. Legitimate Windows environments increasingly use Kerberos for domain authentication, so NTLM network logons — especially from workstations to other workstations — are suspicious. I would exclude machine accounts (Account_Name ending in $) and look for NTLM Type 3 logons that do not match known service account patterns.

Q: How would you build a Splunk alert that minimises false positives?

A: Five steps: (1) Start with a high threshold and lower it gradually as you understand the environment's baseline. (2) Use a lookup whitelist of known-good IPs, users, or hosts and exclude them with NOT or lookup. (3) Add context with eval — only alert if source is external AND target is admin account AND count exceeds threshold. (4) Configure throttle per the key entity (src_ip, user) so one attacker generates one alert, not thousands. (5) Set a review schedule — check the alert monthly to tune thresholds as the environment changes. False positives come from one of two sources: wrong threshold, or missing whitelist context.

Troubleshooting and Admin Questions

Q: A forwarder stopped sending data three hours ago. How do you diagnose it?

A: Step 1 — confirm in Splunk: | tstats latest(_time) as last_seen where index=windows by host | eval last_seen=strftime(last_seen,"%H:%M") | sort +last_seen — hosts that stopped sending appear at the top. Step 2 — check network: can the forwarder reach port 9997 on the indexer? Step 3 — on the forwarder host, check the Splunk service is running. Step 4 — check $SPLUNK_HOME/var/log/splunk/splunkd.log for connection errors or certificate failures. Step 5 — check disk space on the monitored path and on the forwarder itself — full disks stop data collection. Step 6 — check inputs.conf — did the monitored file path change?

Q: What is props.conf and transforms.conf and how do they work together?

A: props.conf applies settings to sourcetypes, hosts, or sources — it is where you define timestamp format, line breaking rules, character encoding, and REPORT/EXTRACT directives that point to transforms.conf. transforms.conf is where the actual field extraction regexes and lookup definitions live. They work together: props.conf says "for data with sourcetype X, use the extraction rule named Y," and transforms.conf defines what rule Y actually does. Props is the assignment; transforms is the implementation.

Q: What is the Splunk Job Inspector and when do you use it?

A: The Job Inspector is a diagnostic panel accessible after any search via Job → Inspect Job. It breaks down how long each phase of the search took: events scanned, time to retrieve from disk, time spent in each SPL command. I use it when a search runs slower than expected — it immediately shows whether the bottleneck is the initial retrieval (fix: narrow the index and time range) or a specific pipeline command (fix: optimise or replace the slow command). It also shows the result count at each pipeline stage, which is invaluable when results disappear unexpectedly mid-pipeline.

14. Quick Reference Cheat Sheet

=== CORE SPL COMMANDS ===

RETRIEVAL
index=name                          Search a specific index
sourcetype=name                     Filter by data format/parser
host=hostname                       Filter by originating device
earliest=-1h latest=now             Time scoping (always include!)

TRANSFORMING
| stats count by field              Count events per field value
| stats dc(field) as n by grp       Count distinct values
| stats values(field) as f by grp  List unique field values per group
| timechart span=1h count           Event count per time bucket
| timechart span=30m count by user  Trend split by field (top 10 default)

FILTERING
| where count > 50                  Filter on computed/aggregated values
| where isnull(field)               Find events with missing field
| search field=value*               Keyword/wildcard filter mid-pipeline

TRANSFORMATION
| eval newfield = expression        Create or modify a field
| eval x = if(cond, val1, val2)     Conditional field
| eval x = case(c1,v1, c2,v2, 1=1, default)  Multi-condition
| eval t = strftime(_time, "%Y-%m-%d %H:%M")  Format timestamp
| rex "(?<fieldname>pattern)"       Extract field with regex

FORMATTING
| table field1, field2, field3      Clean tabular output
| fields field1, field2            Keep only these fields
| fields - field1                  Remove a field
| rename oldname as "New Name"     Rename field
| sort - count                     Sort descending
| sort + field                     Sort ascending
| head 10 / tail 10                Limit results
| dedup field                      Remove duplicates

ENRICHMENT
| lookup lookupname key_field OUTPUT f1, f2   Enrich with CSV data
| inputlookup lookupname.csv       Search the lookup table itself

=== SPL FOR SOC — READY TO USE ===

# Brute Force Detection
index=windows EventCode=4625 | stats count by src_ip | where count > 10 | sort -count

# Password Spray Detection
index=windows EventCode=4625
| stats dc(Account_Name) as targets, count as attempts by src_ip
| where targets > 10 AND (attempts/targets) < 5

# Admin Account Created
index=windows EventCode=4720 | table _time, host, TargetUserName, SubjectUserName

# Security Log Cleared
index=windows EventCode=1102 | table _time, host, SubjectUserName

# Audit Policy Changed
index=windows EventCode=4719 | table _time, host, SubjectUserName, AuditPolicyChanges

# Encoded PowerShell
index=sysmon EventCode=1 (Image=*powershell* OR Image=*pwsh*)
    (CommandLine=*-enc* OR CommandLine=*IEX* OR CommandLine=*DownloadString*)
| table _time, host, User, ParentImage, CommandLine

# Pass-the-Hash Indicator
index=windows EventCode=4624 Logon_Type=3 Authentication_Package=NTLM
| where NOT match(Account_Name, "\$$")
| table _time, ComputerName, Account_Name, Source_Network_Address

# Kerberoasting Indicator
index=windows EventCode=4769 Ticket_Encryption_Type=0x17
| stats count by Account_Name, Client_Address, Service_Name | where count > 3

# Check License Usage
index=_internal source=*license_usage.log type=Usage
| timechart span=1d sum(b) as bytes | eval GB=round(bytes/1073741824,2)

# Check Forwarder Health
| tstats latest(_time) as last_seen where index=* by host
| eval last_seen=strftime(last_seen,"%Y-%m-%d %H:%M") | sort +last_seen

=== SPLUNK ARCHITECTURE QUICK REFERENCE ===

Universal Forwarder  — lightweight agent on endpoints, forwards only, ~20MB
Heavy Forwarder      — full Splunk binary, can parse/filter/route before forwarding
Indexer              — receives, parses, stores data in time-ordered buckets
Search Head          — web UI for querying, dashboards, alerts
Deployment Server    — centrally pushes configs to hundreds of forwarders
License Manager      — enforces daily ingestion volume limit
Bucket lifecycle     — Hot → Warm → Cold → Frozen (archive/delete)

=== KEY SPLUNK INTERNAL INDEXES ===

index=_internal    — Splunk's own logs, errors, license, metrics
index=_audit       — who searched what, user login activity in Splunk
index=_introspection — Splunk process CPU/memory/disk usage

Final Thoughts

When I started with Splunk, it felt like being handed an incredibly powerful tool with no instruction manual. After completing the TryHackMe Advanced Splunk rooms and spending hours building real queries in my lab, it clicked — Splunk is not complicated, it is just layered. Learn the search syntax, then the core commands, then the transformations, then build something real. Each layer makes the previous one more powerful.

The most important advice I can give: always have a question in mind before you open the search bar. "Which IPs generated the most failed logins today?" "Did any internal host connect to an external IP on port 4444?" "Are there any accounts that logged in outside business hours?" SPL is just the language you use to answer those questions. The sharper your security instinct for what to ask, the more effective your SPL will be.

For interviews: know your architecture cold, be able to write a brute force detection query from memory, understand the difference between tstats and stats, and be able to explain how you would investigate a compromised endpoint step by step. If you have a home lab with real logs flowing, you can talk about it with genuine experience — and that is what gets you hired.

Keep building in your lab. Keep practising on TryHackMe. And the next time an interviewer asks "Have you worked with a SIEM?" — you will have a lot more than a one-word answer.

References & Further Reading

Every SOC Analyst Must Know These Windows Event IDs — Here's Why

2026-05-16T01:24:42.716+05:30

Imagine you are the security guard of a massive office building. Every time someone enters, leaves, opens a cabinet, or tries to break in — it gets recorded in a logbook. Now imagine if that logbook could automatically tell you when something suspicious happened. That is exactly what Windows Event Logs are — the logbook of your Windows system, and for a SOC analyst, it is the single most important source of truth.

In this blog, we will break down Windows Event Logs from scratch — what they are, how to read them, how to query them like a pro using PowerShell, and most importantly, which Event IDs you must memorize for your SOC analyst interview. Let's dive in.

1. What Are Windows Event Logs?

Windows Event Logs are records that Windows automatically creates whenever something significant happens on the system — a user logs in, a service crashes, a file is accessed, an audit policy changes, a script runs. Think of it as the operating system constantly writing a diary of everything that happens.

These logs are stored as .evtx files on the system and can be viewed using multiple tools. The default location is:

C:\Windows\System32\winevt\Logs\

Each log entry (called an Event) contains:

Event ID — a unique number identifying what happened
Source — which application or component generated the log
Level — severity: Information, Warning, Error, Critical, Verbose
Timestamp — when it happened (always in UTC in raw logs)
User — which account was involved
Computer — which machine it happened on
Description / Details — the full story of what happened

2. Types of Windows Event Logs

There are five default log categories in Windows:

Log Name	What It Records	SOC Relevance
Security	Logons, logoffs, privilege use, object access, policy changes	🔴 Highest — this is where attacks show up
System	OS-level events: driver failures, service crashes, reboots	🟡 Medium — useful for detecting persistence
Application	Events from installed applications and programs	🟡 Medium — malware may write here
Setup	Events during Windows installation and updates	🟢 Low — rarely used in SOC
Forwarded Events	Logs collected from remote machines via WEF	🔴 High — centralized monitoring

Beyond these defaults, Windows also has Applications and Services Logs — these are more specific logs like:

Microsoft-Windows-PowerShell/Operational — PowerShell activity (critical for detecting attacks)
Microsoft-Windows-Sysmon/Operational — Sysmon events (process creation, network connections)
Microsoft-Windows-TaskScheduler/Operational — Scheduled task activity

3. Tools to Read and Query Event Logs

There are three main ways to interact with Windows Event Logs. As a SOC analyst, you will use all three depending on the situation.

A. Event Viewer (GUI)

The built-in graphical tool. Open it by running eventvwr.msc. Good for quick manual investigation, but not scalable when you have thousands of events. You can create Custom Views to filter by Event ID, time range, and log source — great for narrowing down during an investigation.

B. wevtutil (Command Line)

A powerful command-line tool built into Windows. Great for scripting and automation.

# List all available logs
  wevtutil el
  
  # Get details about the Security log
  wevtutil gl Security

  # Query the last 5 Security events in readable text format
  wevtutil qe Security /c:5 /rd:true /f:text

  # Export a log to a file
  wevtutil epl Security C:\backup\security.evtx

C. Get-WinEvent (PowerShell) — The Analyst's Best Friend

This is the most powerful and flexible method. You can filter by Event ID, time, keyword, XPath, and even query offline .evtx files — perfect for forensic investigation.

# Query live Security log for failed logons (Event ID 4625)
  Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625}

  # Query an offline evtx file with XPath — find PowerShell script block logs
  Get-WinEvent -Path "$env:USERPROFILE\Desktop\merged.evtx" `
      -FilterXPath "*[System[(EventID=4104)]]" -Oldest -MaxEvents 1 | Format-List

  # Filter by Event ID and time range
  Get-WinEvent -FilterHashtable @{
      LogName   = 'Security'
      Id        = 4624
      StartTime = '2024-01-01'
      EndTime   = '2024-01-31'
  }
  
  # Search for specific username in failed logon events
  Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} |
      Where-Object { $_.Message -like "*administrator*" }

  # Count events grouped by Event ID
  Get-WinEvent -LogName Security |
      Group-Object Id | Sort-Object Count -Descending | Select-Object -First 10

Tip: Format-List shows ALL fields of an event. Format-Table gives a compact view. Always use Format-List when you need to read the full event message during investigation.

4. XPath Filtering — Precision Querying

XPath is a query language used to filter events with surgical precision. Think of it like SQL but for event logs. Windows Event Viewer actually generates XPath in the background when you use its filter UI — you can copy it directly and use it in PowerShell.

# XPath: Find Event ID 4625 (failed logon) from Security log
  Get-WinEvent -LogName Security `
      -FilterXPath "*[System[(EventID=4625)]]"

  # XPath: Find events in a specific time range
  Get-WinEvent -LogName Security -FilterXPath `
      "*[System[TimeCreated[@SystemTime>='2024-01-01T00:00:00.000Z']]]"

  # XPath: Filter by Event ID AND a specific username from an evtx file
  Get-WinEvent -Path "C:\Logs\security.evtx" -FilterXPath `
      "*[System[(EventID=4625)] and EventData[Data[@Name='TargetUserName']='admin']]"

The XPath structure always follows: *[System[(condition)]] for system-level fields and EventData[Data[@Name='FieldName']='Value'] for event-specific data fields.

5. Key Event IDs Every SOC Analyst Must Know

This is the most important section for your interview. Hiring managers love asking "which Event IDs do you monitor for X attack?" Here is a grouped reference:

Account Logon & Authentication

Event ID	What It Means	Why SOC Cares
4624	Successful logon	Baseline normal activity; anomalies = lateral movement
4625	Failed logon	Multiple failures = brute force attack
4634	Account logoff	Session duration tracking
4648	Logon with explicit credentials	Pass-the-Hash, runas abuse
4740	Account locked out	Brute force or password spray attack
4768	Kerberos TGT requested	Kerberoasting, AS-REP Roasting detection
4769	Kerberos service ticket requested	Kerberoasting — watch for RC4 encryption type (0x17)
4771	Kerberos pre-auth failed	Password guessing against domain accounts

Account & Group Management

Event ID	What It Means	Why SOC Cares
4720	New user account created	Attacker creating backdoor accounts
4726	User account deleted	Covering tracks after creating rogue account
4728 / 4732 / 4756	Member added to security / local / universal group	Privilege escalation — especially adding to Administrators
4738	User account changed	Password reset, account modifications by attacker

Process & Execution

Event ID	What It Means	Why SOC Cares
4688	New process created	Detect malicious processes: `cmd.exe` spawned by `word.exe`
4104	PowerShell script block logged	Detects obfuscated/malicious PowerShell — most important for detecting living-off-the-land attacks
4103	PowerShell module logging	Module-level PowerShell activity
7045	New service installed	Malware installing as a service for persistence

Scheduled Tasks

Event ID	What It Means	Why SOC Cares
4698	Scheduled task created	Classic persistence mechanism used by malware
4702	Scheduled task updated	Attacker modifying existing tasks to execute malware
4699	Scheduled task deleted	Covering tracks after execution

Audit & Log Tampering — Critical Red Flags

Event ID	What It Means	Why SOC Cares
1102	Security audit log was cleared	🚨 Major red flag — attacker destroying evidence
104	System log was cleared (in System log)	🚨 Same as above but for System log
4719	System audit policy changed	Attacker disabling logging to avoid detection
4656	Handle to an object was requested	File/registry access monitoring

Remember: Event ID 1102 (Security log cleared) is one of the most critical events in any SOC environment. If you see this in an interview question or real investigation, treat it as an active incident immediately. A legitimate admin rarely clears security logs without a documented change request.

6. Logon Types — What 4624 Is Really Telling You

Event ID 4624 (Successful Logon) includes a Logon Type field. This single field tells you HOW someone logged in, which completely changes the meaning of the event.

Logon Type	Name	Meaning
2	Interactive	Physical keyboard logon at the machine
3	Network	Accessing shared folders, network resources — most common
4	Batch	Scheduled task ran as a specific user
5	Service	A service started and logged on
7	Unlock	Workstation unlocked from screensaver
8	NetworkCleartext	Network logon with password sent in plaintext — 🚨 suspicious
10	RemoteInteractive	RDP logon — very important to monitor
11	CachedInteractive	Logon using cached domain credentials (offline)

In an investigation, Type 3 logons from unexpected machines or times = lateral movement. Type 10 logons from external IPs = suspicious RDP access. Type 8 = credentials sent in cleartext = immediate concern.

7. Detecting Real Attacks Using Event Logs

Scenario 1: Brute Force Attack

An attacker tries to guess a user's password repeatedly. You will see a flood of Event ID 4625 (failed logon) from the same source IP, followed eventually by either 4740 (account lockout) or 4624 (successful logon) — which means they got in.

# Detect multiple failed logons
  Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} |
      Group-Object {$_.Properties[5].Value} |
      Sort-Object Count -Descending |
      Select-Object Name, Count

Scenario 2: Suspicious PowerShell Execution

Attackers love using PowerShell because it is already installed on every Windows machine. Event ID 4104 logs the actual script content — even if it was obfuscated, Windows logs the decoded version.

# Find PowerShell script block events from an evtx file
  Get-WinEvent -Path "$env:USERPROFILE\Desktop\merged.evtx" `
      -FilterXPath "*[System[(EventID=4104)]]" -Oldest -MaxEvents 1 | Format-List

Look for keywords in the message: Invoke-Mimikatz, IEX, DownloadString, EncodedCommand, bypass, hidden — these are classic signs of malicious PowerShell.

Scenario 3: Attacker Clearing Logs

After a successful attack, experienced attackers clear logs to destroy evidence. This generates Event ID 1102 in the Security log — ironically logged just before they wipe everything else.

# Check if security log was cleared
  Get-WinEvent -FilterHashtable @{LogName='Security'; Id=1102}

Scenario 4: Persistence via Scheduled Task

Malware creates a scheduled task to survive reboots. Watch for Event ID 4698 (task created) especially when the task points to unusual paths like %TEMP%, %APPDATA%, or runs encoded PowerShell.

8. Log Tampering — The Attacker's Cover-Up

Sophisticated attackers do not just exploit systems — they cover their tracks. There are multiple ways they try to tamper with event logging:

Clearing logs — wevtutil cl Security or via Event Viewer → Event ID 1102
Disabling audit policy — auditpol /set /category:* /success:disable → Event ID 4719
Stopping the event log service — sc stop eventlog → logged in System log before it stops
ETW tampering — manipulating Event Tracing for Windows at the provider level (advanced, stealthy)
Patching the log service in memory — most advanced technique, covered in the Palantir blog on ETW tampering

Key point for interviews: If the Windows Event Log service is stopped, Event ID 6006 is written just before the service shuts down. No more logs are written after that point — which is itself a massive indicator of compromise.

9. Interview Q&A — SOC Analyst Edition

Q: What Event ID would you look for to detect a brute force attack?

A: Event ID 4625 (failed logon). I would look for a high volume of 4625 events from the same source IP or targeting the same account in a short time window. I would then correlate with 4740 (account lockout) and check if it was followed by a 4624 (successful logon), which would indicate the attacker succeeded.

Q: An attacker cleared the Security event log. How do you know?

A: Windows logs Event ID 1102 when the Security log is cleared, and this event itself captures who cleared it and when. I would also check the System log for Event ID 104. Additionally, a sudden gap in event timestamps is a strong indicator even if 1102 itself was removed.

Q: How do you detect malicious PowerShell activity?

A: I would look at Event ID 4104 in the Microsoft-Windows-PowerShell/Operational log, which captures script block logging. This logs the actual decoded content of PowerShell scripts. I would search for suspicious keywords like Invoke-Expression, IEX, DownloadString, EncodedCommand, and Mimikatz. I would use: Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; Id=4104}

Q: What is the difference between Event ID 4624 Logon Type 3 and Logon Type 10?

A: Logon Type 3 is a network logon — accessing shared folders or resources over the network. Logon Type 10 is a RemoteInteractive logon — meaning someone connected via RDP. In an investigation, Type 10 from an unexpected external IP is a strong indicator of unauthorized RDP access, while unusual Type 3 logons from machines that should not be talking to each other indicate lateral movement.

Q: How would you query an offline .evtx file for a specific Event ID?

A: Using PowerShell's Get-WinEvent with the -Path parameter and XPath filter:

Get-WinEvent -Path "C:\path\to\file.evtx" `
      -FilterXPath "*[System[(EventID=4625)]]" | Format-List

This is extremely useful in forensic investigations where I am analysing a disk image or exported log files from a compromised machine.

Q: What is Kerberoasting and which Event ID helps detect it?

A: Kerberoasting is an attack where an attacker requests Kerberos service tickets for service accounts and then attempts to crack them offline. The key indicator is Event ID 4769 (Kerberos service ticket requested) where the Ticket Encryption Type is 0x17 (RC4-HMAC). Legitimate modern environments use AES encryption, so RC4 requests are a red flag — especially if many are seen from one account in a short period.

Q: How would you detect a new persistence mechanism via scheduled tasks?

A: I would monitor Event ID 4698 (scheduled task created) in the Security log, or Microsoft-Windows-TaskScheduler/Operational log. I would look for tasks that run from unusual paths like %TEMP%, %APPDATA%, or execute encoded PowerShell commands. Any task created outside of known change windows or by non-admin accounts warrants immediate investigation.

Q: What is the significance of Event ID 4719?

A: Event ID 4719 means the System Audit Policy was changed. Attackers use this to disable logging so their subsequent actions are not recorded. If I see 4719 followed by a drop in expected event volume, it is a strong sign that an attacker is trying to blind our monitoring. This should trigger an immediate alert in any SIEM.

10. Quick Reference Cheat Sheet

=== MUST-KNOW EVENT IDs ===

  LOGON/AUTHENTICATION
  4624  - Successful logon
  4625  - Failed logon (brute force indicator)
  4648  - Logon with explicit credentials (Pass-the-Hash)
  4740  - Account locked out
  4768  - Kerberos TGT requested
  4769  - Kerberos service ticket requested (Kerberoasting)
  4771  - Kerberos pre-auth failed

  ACCOUNT MANAGEMENT
  4720  - User account created
  4726  - User account deleted
  4728/4732/4756 - Member added to group

  EXECUTION / PERSISTENCE
  4688  - New process created
  4104  - PowerShell script block logged
  4698  - Scheduled task created
  7045  - New service installed
  
  TAMPERING / COVER TRACKS
  1102  - Security log cleared 🚨
  104   - System log cleared 🚨
  4719  - Audit policy changed

  === POWERSHELL QUICK COMMANDS ===

  # Query live log
  Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625}

  # Query offline evtx file
  Get-WinEvent -Path "C:\path\to\file.evtx" -FilterXPath "*[System[(EventID=4104)]]" | Format-List

  # Count by Event ID
  Get-WinEvent -LogName Security | Group-Object Id | Sort-Object Count -Descending

  # Filter by username
  Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} |
      Where-Object { $_.Message -like "*administrator*" }

Final Thoughts

Windows Event Logs are not just a collection of system messages — they are the story of everything that happened on a machine. As a SOC analyst, your job is to read that story and find the chapters where something went wrong. The more fluent you become with Event IDs, PowerShell querying, and XPath filtering, the faster you will be able to identify threats before they become full-blown incidents.

Start with the Security log. Learn the critical Event IDs. Practice querying .evtx files with PowerShell. And always remember — if someone cleared the logs, that itself is the loudest alarm of all.

Keep practising on TryHackMe, and you will be investigation-ready in no time.

References & Further Reading

How to Pass CompTIA Security+ SY0-701 in 2 Months (839 Score Breakdown + Resources)

2026-04-01T00:51:00.001+05:30

How I Scored 839/900 on CompTIA Security+ SY0-701 — 2-Month Prep Strategy That Actually Worked

Score: 839/900 | Exam: CompTIA Security+ SY0-701 | Prep Time: 2 Months | Total Questions: 76 (including 3 PBQs)

I'm not going to sugarcoat it — CompTIA Security+ is not easy, but it is very passable with the right strategy. I cleared it with an 839 out of 900, and in this post I'll share exactly how I did it, domain by domain, so you can replicate the approach without wasting time.

My 2-Month Study Plan

Month 1 — Domain-by-domain study: Read, take notes, and build comparison tables and mnemonics for tricky concepts.

Month 2 — Heavy practice testing: Full focus on practice tests and PBQ simulations. Time management drills every session.

The biggest mistake people make is spending 90% of their time reading and only 10% practicing. I flipped that in month 2 — and it made all the difference.

Domain 1 — General Security Concepts

What to focus on:

Types of security controls — physical, technical, and administrative.
Cryptography basics — symmetric vs asymmetric, hashing algorithms, and use cases.
Certificate concepts — PKI, CA, certificate chain, and renewal.
Zero Trust architecture — control plane vs data plane.
WPA2 vs WPA3 differences — tested more than you'd expect.

Memorization tip: Group controls by type — preventive, detective, corrective, deterrent. Knowing the category instantly narrows your answer on scenario questions.

Domain 2 — Threats, Vulnerabilities & Mitigations

What to focus on:

All social engineering attack types — phishing, vishing, smishing, spear phishing, whaling, business email compromise (BEC).
Malware types — ransomware, RAT, rootkit, keylogger, worm vs virus.
Application attacks — SQL injection, XSS, buffer overflow, CSRF.
Vulnerability scan vs penetration test — know when to use each.
EOL (End of Life) vs legacy systems — a common scenario trap on the exam.

Exam trap: If the question says "which is the MOST immediate action" after discovering a vulnerability — the answer is almost always containment, not remediation.

Domain 3 — Security Architecture

What to focus on:

Firewall types — stateful vs stateless vs NGFW (Next-Generation Firewall).
Cloud models — IaaS, PaaS, SaaS and shared responsibility model.
RAID levels — RAID 0 (no redundancy), RAID 1 (mirroring), RAID 5 (striping with parity), RAID 10 (mirroring + striping).
Disaster recovery terms — RPO, RTO, MTTR, MTBF. Understand the difference between hot, warm, and cold sites.
3-2-1 backup rule — 3 copies, 2 different media, 1 offsite.

Memorization tip: RPO = how much data you can afford to lose. RTO = how fast you must recover. These two are constantly confused — keep them clear.

Domain 4 — Security Operations

What to focus on:

Incident response phases — Preparation → Identification → Containment → Eradication → Recovery → Lessons Learned. Memorize the order.
Log analysis — which log to check for which incident (Windows Event Log, firewall logs, DNS logs, authentication logs).
Security tools — SIEM, SOAR, EDR, IDS vs IPS. Know what each does and when to use it.
Change management process — why it matters for security operations.

Exam trap: IDS detects and alerts. IPS detects and blocks. If the question says the system is in "passive mode" — it's IDS, not IPS.

Domain 5 — Security Program Management & Oversight

What to focus on:

Risk formulas — Risk = Likelihood × Impact, ALE = SLE × ARO.
Agreement types — NDA (confidentiality), SLA (service levels), MOU (intent between parties), MSA (ongoing relationship). Know when each is used.
Data roles — owner, custodian, processor, controller.
Compliance and regulations — GDPR basics, HIPAA, data classification levels.

Memorization tip: For risk — ALE tells you the annual cost of a risk. Use it to justify security spend. If ALE is lower than the cost of a control, you accept the risk.

Critical Port Numbers You Must Memorize

These come up directly and in scenario questions. Know them cold.

Port	Service	Note
20 / 21	FTP	20 = data transfer, 21 = control
22	SSH / SFTP / SCP	Secure remote access and file transfer
23	Telnet	Insecure — almost always the wrong answer
25	SMTP	Email sending (outbound)
53	DNS	UDP by default; TCP for zone transfers
67 / 68	DHCP	67 = server, 68 = client
80	HTTP	Unencrypted web traffic
110	POP3	Email retrieval — insecure
143	IMAP	Email retrieval with folder sync
389	LDAP	Directory services
443	HTTPS	Encrypted web (TLS)
445	SMB	File sharing — exploited by WannaCry
465 / 587	SMTPS	Secure email sending
636	LDAPS	Secure LDAP
993	IMAPS	Secure IMAP
995	POP3S	Secure POP3
1433	MS SQL	Microsoft SQL Server
3306	MySQL	MySQL database
3389	RDP	Remote Desktop — major attack surface
8080	HTTP Alternate	Dev/proxy web traffic

Pattern to remember: The 900s are secure versions of the 100s — 993 = secure 143 (IMAPS), 995 = secure 110 (POP3S). Group them and the table memorizes itself.

PBQ Strategy — How I Finished 3 PBQs in 15–18 Minutes

The Security+ SY0-701 exam has 76 questions total including 3 PBQs (Performance-Based Questions). Most candidates panic on PBQs because they involve drag-and-drop, simulation, or log analysis tasks. I finished all 3 in 15–18 minutes. Here is how:

Use AI tools to practice PBQs before the exam. This was my single biggest advantage. I used AI to simulate real PBQ-style scenarios — SSH hardening, certificate chain ordering, log analysis, network vulnerability triage. By exam day, the PBQs felt familiar because I had already practiced the logic, not memorized specific answers.

Read the scenario carefully — the answer is almost always embedded in the information already given to you.
Use smart elimination — remove obviously wrong options first, then decide between the remaining ones.
Don't overthink it — PBQs test practical judgment, not trick knowledge.
Do PBQs first — they appear at the start of the exam. Knock them out while your mind is fresh.

I am confident I scored 90%+ on PBQs, and it significantly boosted my final score.

Time Management on Exam Day

With 76 questions and 90 minutes, that is roughly 70 seconds per question. My approach:

Complete PBQs first — they take longer and require focus. Get them done early.
Flag and move — if a question stumps you, flag it and keep moving. Never sit on one question for more than 2 minutes.
Last 10 minutes — review flagged questions only. Do not second-guess answers you have already submitted.

Final Honest Advice

Don't buy 10 books. Don't watch 40 hours of YouTube. Pick one solid resource, run practice tests daily in month 2, and use AI tools to simulate PBQ scenarios. That combination — focused notes + heavy practice testing + AI-assisted PBQ prep — is exactly what pushed me to 839.

Want My Quick Revision Notes?

Let me be honest — these are not a full course or textbook. I did not make them to teach Security+ from scratch.

I built these notes throughout my 2 months of practice tests — every time I got a question wrong, every concept I found confusing, every pair of similar-sounding terms that kept tripping me up — I captured it. The result is a compact, focused set of notes designed for 2–3 reads right before your exam.

What makes them different:

Built from real practice test mistakes — not copied from a textbook.
Packed with comparison tables for ambiguous topics where two answers always look the same.
Easy-to-remember techniques and mnemonics for tricky concepts.
Covers the topics that actually confused me — which means they will likely confuse you too.
9 PBQ practice scenarios to build hands-on confidence before exam day.

These notes are the result of my real exam preparation, my actual score, and a lot of hard work. I created them by focusing only on the concepts, patterns, and tricky areas that actually matter for CompTIA Security+ — so you can study smarter and revise faster. They also include PBQ-based preparation, which personally helped me a lot and gave me a big confidence boost before the exam.

While I cannot guarantee any score, I genuinely believe these notes can strongly support your preparation if you revise them 2–3 times before exam day. Think of them as your last-minute sharpening tool — not a replacement for study, but the best companion for the final stretch.

If you want to refer my notes, you can download my notes including some PBQ examples from the link below. I am sure it will help you to pass the exam.

Download My Security+ SY0-701 Study Notes + PBQ Bundle

Disclaimer: These are personal study notes based on my own preparation. Not affiliated with or endorsed by CompTIA.

Email Security Deep Dive: 13 Steps to Keep Your Emails Safe

2025-08-27T01:30:00.003+05:30

Email Security Checklist

The Email Security Checklist

1. Enable SPF (Sender Policy Framework)

What it is: SPF is like a guest list for your email domain. It tells the world that only specific servers are allowed to send email for your domain.

How it works:

Publish an SPF record in DNS.
When someone receives an email claiming to be from your domain, their mail server checks if the sending IP is listed in the SPF record.
If the IP is not listed, the email is rejected or marked as spam.

Example SPF record:

v=spf1 ip4:203.0.113.0/24 include:_spf.google.com -all

Only servers in the specified IP range and Google’s mail servers can send emails for this domain. Others are rejected.

Points to Note:

Prevents attackers from spoofing your domain and sending phishing or spam emails.

2. Enable DKIM (DomainKeys Identified Mail)

What it is: DKIM is a digital signature for each email, ensuring that the message hasn’t been tampered with.

How it works:

Your mail server signs outgoing emails with a private key.
Recipient mail servers verify the signature using your public key published in DNS.
If the signature matches, the email is considered authentic and untampered.

Example DKIM record:

v=DKIM1; k=rsa; p=PUBLIC_KEY_HERE

Scenario: If someone modifies the content of an email in transit, the DKIM signature breaks and the recipient sees the message as suspicious.

Points to Note:

Ensures email integrity and authenticity.
Improves domain reputation and email trustworthiness with providers.

3. Enable DMARC (Domain-based Message Authentication, Reporting & Conformance)

What it is: DMARC is a policy layer that combines SPF and DKIM, specifying what to do if authentication fails.

How it works:

Define a rule: reject, quarantine, or allow emails that fail SPF/DKIM checks.
Receive reports on failed authentication attempts.

Example DMARC record:

v=DMARC1; p=reject; rua=mailto:security@yourdomain.com

Scenario: Without DMARC, Gmail might accept spoofed emails. With DMARC set to reject, unauthorized emails are dropped before reaching the inbox.

Points to Note:

Enforces consistent authentication policies across all receivers.
Provides visibility into unauthorized email attempts.

4. Set up a Spam Filter

What it is: A mechanism that blocks junk emails and malware before they reach users.

How it works:

Uses blacklists, heuristics, machine learning, and attachment scanning.
Filters suspicious emails into spam/junk folders.

Example Filters: Barracuda, Mimecast, Proofpoint, Google Workspace built-in filter.

Points to Note:

Reduces exposure to phishing and malware.
Improves inbox hygiene and productivity.

5. Disable Relaying

What it is: Relaying allows outsiders to use your email server to send messages to third parties.

Bad Scenario:

Your server is misconfigured as an open relay.
Spammers use it to send millions of emails.
Your domain/IP gets blacklisted, causing legitimate emails to bounce.

Points to Note:

Always disable relaying unless explicitly allowing trusted servers.
Prevents abuse and protects domain reputation.

6. Set a Throttling Policy

What it is: Rate-limits that prevent hacked or compromised accounts from sending mass spam emails.

Example Rules:

Max 500 emails/day per user.
Max 50 recipients/email.

Scenario:

Alice’s account is hacked. The attacker tries to send 50,000 phishing emails.
Throttling policy blocks after 500 emails, reducing potential damage.
Example: If you send an email to 20 people in To, 15 in Cc, and 15 in Bcc, that totals 50 recipients → allowed. Sending to 60 recipients → blocked.

Points to Note:

Prevents mass spamming if an account is compromised.
Protects domain reputation and prevents blacklisting.
Encourages using proper bulk mailing tools for legitimate campaigns (e.g., SendGrid, Mailchimp, Google Groups).

7. Restrict Local Email Domain

What it is: Prevents outsiders from sending fake emails that appear to come from your internal domain.

Scenario Explained:

Without Restriction (Bad Case):

A hacker outside your company sends an email from ceo@company.com to finance@company.com.
Your mail server delivers it because it looks like internal mail.
The finance employee sees the fake CEO email and may wire money → this is called CEO Fraud / Business Email Compromise (BEC).

With Restriction (Good Case):

The mail system only accepts emails claiming to be from @company.com if they come from official internal mail servers (e.g., Microsoft 365 or Google Workspace).
The hacker’s email from an external server is blocked or flagged.
Finance never sees the fake CEO email → attack fails.

Points to Note:

Ensures only legitimate internal servers can send emails using your domain.
Prevents CEO fraud, internal phishing, and business email compromise (BEC).

8. Set Attachment Restrictions

What it is: Block dangerous file types to prevent malware from entering your network.

Rules:

Block extensions: .exe, .bat, .vbs, .jar, .scr
Allow only safe extensions: .pdf, .docx, .png

Scenario:

User receives invoice.pdf.exe disguised as a PDF.
Without restrictions → malware executes on the system.
With restrictions → email blocked at the gateway before reaching the user.

Points to Note:

Since most malware is delivered via attachments, restricting risky file types is essential.
Scan attachments to ensure even allowed file types are safe.

9. Ensure Log Visibility and History

What it is: Collect and monitor logs from mail servers to track activity and detect security incidents.

Example Logs:

Was the email delivered?
Did SPF/DKIM authentication fail?
Who attempted to brute-force login?

Tools: Splunk, ELK, SIEM integration.

Points to Note:

Logs are vital for investigating phishing attempts and delivery issues.
Helps meet compliance and auditing requirements.

10. Consider Email Encryption

What it is: Ensures that only intended recipients can read the email content.

Types:

S/MIME (uses certificates)
PGP (uses key pairs)

Scenario:

A lawyer sends confidential case files via email.
Encrypted email ensures that even if intercepted, the content is unreadable.

Points to Note:

Email encryption ensures confidentiality for sensitive information.
Critical for industries like finance and healthcare to comply with regulations like HIPAA.

11. Enable DNSSEC (Domain Name System Security Extensions)

What it is: DNSSEC secures DNS records to prevent attackers from redirecting traffic or tampering with email-related DNS entries (like SPF, DKIM, and DMARC).

How it works:

DNS responses are digitally signed using public-key cryptography.
Only authenticated responses from the domain’s authoritative DNS server are accepted.
This prevents DNS spoofing and cache poisoning attacks.

Scenario Example:

A user tries to visit www.example.com.
Without DNSSEC: An attacker poisons the DNS cache and redirects the user to www.fake-example.com, which looks identical. The attacker can capture login credentials.
With DNSSEC: The browser or email server verifies the DNS response signature. If the response is altered, it is rejected, preventing the user from being redirected to a malicious site.
Similarly, email servers checking SPF/DKIM/DMARC records rely on DNS. Without DNSSEC, attackers could alter TXT records to bypass email authentication, leading to phishing and spoofing attacks.

Points to Note:

Secures DNS records against tampering and spoofing.
Protects email authentication mechanisms (SPF, DKIM, DMARC).
Prevents attackers from redirecting users to malicious websites.

12. Educate Your Community

What it is: Security is not just technology; it starts with people. Educating users on safe email practices is critical to reduce phishing and malware risks.

Key Training Topics:

How to recognize phishing emails and social engineering attempts.
Which files are safe to send or receive via email and alternatives for large file sharing.
How to avoid clicking malicious links and detect suspicious email behavior.
What information is safe to share via email.

Points to Note:

A culture of security awareness reduces human error and prevents data breaches.
Periodic refresher training ensures practices stay up-to-date.
Supports technological measures like spam filters and email restrictions.

13. Regularly Test Configurations

What it is: Regular testing ensures that email security settings remain effective over time and configuration changes do not create vulnerabilities.

Tools for Testing: MXToolbox, G Suite/Office 365 security scorecards, and email spoofing simulations.

How to Test:

Run periodic SPF/DKIM/DMARC checks to confirm proper email authentication.
Send test emails to verify spam filters and attachment restrictions are working.
Monitor logs for unusual activity or policy violations.
Compare current settings with company security policies to prevent configuration drift.

Points to Note:

Continuous testing ensures potential vulnerabilities are discovered and fixed promptly.
Helps maintain compliance with internal and external security policies.
Supports consistent protection against phishing, spoofing, and malware delivery.

Preventing CEO Impersonation in Emails

Q: How can we prevent someone from impersonating our CEO via email?

A: The best approach is to implement SPF, DKIM, and DMARC. SPF defines which mail servers are allowed to send emails for our domain. DKIM adds a digital signature to verify the integrity of the message. DMARC enforces policies based on SPF and DKIM results, for example, rejecting emails that fail both checks.

Q: Can you give a concrete example of how this works?

A: Suppose a hacker tries to send an email from ceo@company.com to finance@company.com using a free Gmail account. Our SPF record only allows our Google Workspace servers. SPF fails, DKIM fails because the email doesn’t have a valid signature from our domain, and DMARC rejects the message. This prevents the fraudulent email from ever reaching finance.

Q: Why is this better than just telling employees to be careful?

A: Technical controls like SPF, DKIM, and DMARC stop attacks before employees even see them. Human caution is important, but relying solely on users is risky, because phishing emails can look very convincing—like an urgent wire transfer request from the CEO.

Q: What if the hacker uses a Gmail account that is part of Google Workspace?

A: It must be part of our authorized Workspace domain. SPF only allows our corporate Workspace servers. A free Gmail account or Workspace account from another domain will fail SPF and DMARC, and DKIM signatures from other domains won’t validate against our public key.

Q: Could an internal employee accidentally impersonate the CEO?

A: We can restrict local email domain sending rules. Emails claiming to be from @company.com must come from official internal mail servers. Even internal machines or scripts outside the mail server cannot send as the CEO, preventing internal spoofing or accidental misuse.

Q: How can we monitor if someone is trying to spoof our domain?

A: DMARC reporting provides aggregate (rua) and forensic (ruf) reports about emails failing SPF/DKIM. We can see attempts, source IPs, and take corrective actions, such as updating DNS or investigating potential attacks.

Q: How would you explain this to a non-technical executive?

A: I would say: “We have a digital gatekeeper for emails. It checks if an email truly comes from us and hasn’t been tampered with. If a fake email tries to impersonate the CEO, the system blocks it before anyone sees it, preventing fraud.”

In preparing this blog, I referred to a helpful GitHub repository: Email Security Checklist Repository .

Additionally, AI platforms helped me understand the concepts in depth, allowing me to explain each step in a simple and practical way.

Master Kubernetes: Architecture, Commands, and Real-World Applications

2025-08-13T01:25:00.001+05:30

Kubernetes Basics for DevOps & DevSecOps

Kubernetes Basics for DevSecOps

1. Introduction to Kubernetes

In the early days of deploying applications, we used to run them directly on physical servers. This approach was inflexible and inefficient — if one application needed more resources, it could starve others. Virtual machines (VMs) improved this by isolating workloads, but they were heavy and took time to provision.

Then came containers. Containers are lightweight, portable, and can run anywhere — your laptop, a server in the cloud, or even a Raspberry Pi. But managing containers at scale quickly becomes a nightmare. Imagine you have 500 containers — how do you start them, stop them, update them, and ensure they recover from failures automatically?

Enter Kubernetes — an open-source container orchestration platform that automates deployment, scaling, and management of containerized applications. It was originally developed by Google and is now maintained by the Cloud Native Computing Foundation (CNCF).

2. Kubernetes Architecture

Kubernetes is an open-source platform designed to automate deploying, scaling, and operating application containers. Kubernetes enables developers and operators to manage containerized applications with ease, providing a robust and scalable infrastructure for modern applications.

Image sources:

phoenixNAP - Understanding Kubernetes Architecture with Diagrams

Qovery - What Is Kubernetes?

Control Plane

The Control Plane is the brain of the Kubernetes cluster. It manages the cluster's state and makes global decisions about the cluster (e.g., scheduling). The main components of the Control Plane include:

API Server: Serves the Kubernetes API and is the entry point for commands and queries.
etcd: A consistent and highly-available key-value store used as Kubernetes' backing store for all cluster data.
Scheduler: Watches for newly created Pods and assigns them to nodes.
Controller Manager: Runs controller processes that regulate the state of the system, ensuring the desired state matches the actual state.

Node Components

Nodes are the machines (physical or virtual) that run your application workloads. Each node contains the necessary components to run Pods and is managed by the Control Plane. The main components of a node include:

kubelet: Ensures that containers are running in a Pod.
kube-proxy: Maintains network rules for Pod communication.
Container Runtime: Responsible for running containers (e.g., Docker, containerd).

Workloads

Workloads are the applications or services running on your cluster. Kubernetes provides several abstractions to manage these workloads:

Pod: The smallest and simplest Kubernetes object; a Pod represents a set of running containers on the cluster.
Deployment: Provides declarative updates to Pods and ReplicaSets.
ReplicaSet: Ensures that a specified number of pod replicas are running at any given time.
StatefulSet: Manages the deployment and scaling of a set of Pods, and provides guarantees about the ordering and uniqueness of these Pods.
DaemonSet: Ensures that all (or some) Nodes run a copy of a Pod.
Job: Creates one or more Pods and ensures that a specified number of them successfully terminate.
CronJob: Runs Jobs on a scheduled time.

Services

Services are an abstraction that defines a logical set of Pods and a policy by which to access them. They enable communication between various components within and outside the cluster. Types of Services include:

ClusterIP: Exposes the Service on a cluster-internal IP.
NodePort: Exposes the Service on each Node’s IP at a static port.
LoadBalancer: Exposes the Service externally using a cloud provider's load balancer.
ExternalName: Maps the Service to the contents of the externalName field (e.g., foo.bar.example.com).

Networking

Kubernetes networking allows Pods to communicate with each other and with the outside world. Key concepts include:

Pod-to-Pod Communication: All Pods can communicate with each other without NAT.
Service Discovery: Services can be discovered within the cluster using DNS or environment variables.
Network Policies: Controls the communication between Pods and/or Services.

Storage

Kubernetes provides abstractions for managing storage resources:

Volumes: A directory containing data, accessible to the containers in a Pod.
Persistent Volumes (PV): A piece of storage in the cluster that has been provisioned by an administrator.
Persistent Volume Claims (PVC): A request for storage by a user.
Storage Classes: Provides a way to describe the "classes" of storage available in a cluster.

3. Kubernetes Landscape

The Kubernetes ecosystem includes tools for logging, monitoring, CI/CD, and security. Some popular components are:

Helm: Package manager for Kubernetes applications.
Prometheus & Grafana: Monitoring and visualization.
Istio/Linkerd: Service mesh solutions for traffic management and security.
ArgoCD: GitOps continuous delivery tool.

4. Kubernetes Configuration

Think of Kubernetes YAML files as blueprints for a city you’re building.

The Service is like the city’s address system — it tells visitors where to go.

The Deployment is like the city’s construction plan — it says what to build and how many buildings you need.

We’ll look at these two “blueprints” one by one.

Step 1: The Service — Your App’s “Reception Desk”

When you define a service in Kubernetes, you’re basically setting up a reception desk that greets requests and forwards them to the right place.

Here’s the file:

apiVersion: v1
kind: Service
metadata:
  name: example-nginx-service
spec:
  selector:
    app: nginx
  ports:
    - protocol: TCP
      port: 8080
      targetPort: 80
  type: ClusterIP

What’s going on here?

apiVersion: v1 → We’re using version 1 of Kubernetes API for a basic service.
kind: Service → Tells Kubernetes we’re creating a Service.
metadata → name → We name it example-nginx-service.
selector: app: nginx → This service will only talk to pods with the label app=nginx.
ports →

port: 8080 → Visitors come here.
targetPort: 80 → Requests are forwarded here inside the pod.

type: ClusterIP → The default type; service is accessible only inside the cluster.

💡 Why define the service first?
Because when Kubernetes starts a container, it creates environment variables for each service that’s already running. If your service exists first, your pods will know where to find it from the start.

Step 2: The Deployment — The Building Plan

If the Service is the receptionist, the Deployment is the construction crew that builds and maintains the actual app instances (pods).

Here’s the deployment YAML file:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: example-nginx-deployment
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:latest
        ports:
        - containerPort: 80

Breaking it down:

apiVersion: apps/v1 → For deployments, we use the apps/v1 API.
kind: Deployment → We’re defining a Deployment.
replicas: 3 → We want 3 identical pods running.
selector → matchLabels: app: nginx → Matches the Service’s selector so they connect properly.
template → This is the “blueprint” for each pod:

metadata: labels: app: nginx → The pods get the nginx label.
spec → containers →

Runs the nginx:latest image.
Exposes containerPort: 80 (which matches the service’s targetPort).

How Kubernetes Keeps Things in Check

Once you apply these YAML files, Kubernetes treats them like a promise:

“I promise there will always be 3 nginx pods, connected to this service, running and ready.”

Behind the scenes, Kubernetes uses etcd (its “memory bank”) to store the current state and constantly compares it to your desired state.

If you said 3 pods but only 2 are running, Kubernetes will create another one.

If one crashes, Kubernetes will replace it automatically.

5. kubectl – Kubernetes Command-Line Tool

That’s where kubectl comes in. Kubectl is a command-line tool that talks to the Kubernetes API Server (part of the control plane) and tells it what to do. Think of it as remote control for your Kubernetes cluster.

1. kubectl apply

Purpose: Takes a YAML file and tells Kubernetes to create or update resources based on it.

kubectl apply -f example-deployment.yaml

This tells Kubernetes: "Here’s my configuration, please make it happen."

2. kubectl get

Purpose: Checks the status of resources (Pods, Deployments, Services, etc.).

kubectl get pods -n example-namespace

Example output:

NAME          READY   STATUS    RESTARTS   AGE
example-pod   1/1     Running   0          2m18s

Other useful commands:

kubectl get services
kubectl get deployments

3. kubectl describe

Purpose: Shows detailed information about a specific resource — useful for troubleshooting.

kubectl describe pod example-pod -n example-namespace

Details include:

Node it’s running on
IP address
Events (helpful for finding issues)

4. kubectl logs

Purpose: View application logs from inside a Pod.

kubectl logs example-pod -n example-namespace

If your application crashes, logs help you understand why.

5. kubectl exec

Purpose: Opens a shell inside a container for debugging.

kubectl exec -it example-pod -n example-namespace -- sh

Now you can run commands inside the container, like checking files or testing network connectivity.

6. kubectl port-forward

Purpose: Forward traffic from your local machine to a Pod in the cluster — useful for testing apps without exposing them publicly.

kubectl port-forward service/example-service 8090:8080

Now you can access your service locally at http://localhost:8090.

Summary

apply → Create/update from YAML
get → Check resource status
describe → Detailed info
logs → View app logs
exec → Get inside a container
port-forward → Access app locally

6. Kubernetes Security

Kubernetes is relatively new but wildly popular, especially with startups and tech-forward companies. Introducing any new tool into your system brings new security challenges, and Kubernetes is no exception. Think about it: inside Kubernetes, many tiny "pods" (containers) chat with each other over a network. By default, they can talk freely — a tempting door for attackers if left unchecked.

As a DevSecOps engineer, your job is to lock down those doors, ensuring that pods only talk when they should and that the entire system stays safe from prying eyes.

Kubernetes Hardening: Building Your Fort

Container hardening is your first line of defense. It’s all about scanning containers for vulnerabilities and patching them before attackers find a way in. Kubernetes hardening means following best security practices across your cluster to keep it locked tight.

Here’s how you can start:

Lock Down Your Pods

Don’t run containers with root privileges unless absolutely necessary.
Use immutable file systems to prevent unwanted changes.
Regularly scan container images for vulnerabilities or misconfigurations.
Avoid privileged containers that have too much access.
Use Pod Security Standards (PSS) and Pod Security Admission (PSA) to enforce security policies.

Harden Your Network

Communication is vital, but it’s also a risk. Secure your Kubernetes network by:

Restricting access to the control plane using firewalls and role-based access control (RBAC).
Encrypting communication between control plane components with TLS.
Creating explicit deny policies — deny first, allow later.
Encrypting sensitive data using Kubernetes Secrets, instead of storing them as plain text.

Authentication and Authorization — Your Gatekeepers

No security plan is complete without controlling who gets in and what they can do:

Disable anonymous access — no freeloaders allowed!
Use strong authentication methods for users.
Define RBAC policies for every team and service account, giving only the minimum permissions needed.

Stay Alert with Logging and Monitoring

You can’t protect what you don’t see. Keep an eye on what’s happening inside your cluster:

Enable audit logging to track changes and access.
Use log monitoring and alerting systems to catch suspicious activity early.

Security Is a Continuous Journey

It’s not enough to just secure your Kubernetes cluster once — you have to keep it secure:

Patch and update Kubernetes components quickly when fixes are available.
Run vulnerability scans and penetration tests regularly.
Remove old or unused components that could become attack vectors.

Kubernetes Security in Action: Key Practices to Know

Let’s highlight three powerful tools in your Kubernetes security toolkit:

1. Role-Based Access Control (RBAC)

RBAC restricts what users and services can do inside your cluster. You define roles with specific permissions (like creating or deleting resources), then assign those roles to users or service accounts. This keeps your resources safe from unauthorized access.

2. Secrets Management

Kubernetes Secrets store sensitive info like passwords or tokens securely (encoded in base64). For better protection, enable encryption at rest and control access tightly using RBAC. This helps prevent leaks of critical data.

3. Pod Security Admission (PSA) and Pod Security Standards (PSS)

These enforce security policies for pods at different levels:

Privileged: Nearly unrestricted access (risky, but sometimes necessary).
Baseline: Default minimal restrictions to prevent common privilege escalations.
Restricted: Strictest settings following best container security practices.

PSA works behind the scenes to enforce these rules whenever pods are created or updated.

Note: Before Kubernetes v1.25, Pod Security Policies (PSPs) handled this, but they are now deprecated.

Wrapping It Up

Kubernetes security is complex but essential. As a DevSecOps engineer, mastering these hardening practices and tools is your way to keep your cluster resilient against attacks — and keep your applications running safe and sound.

Embrace automated security scans, enforce strict access controls, monitor continuously, and stay ahead of vulnerabilities. That’s how you turn Kubernetes from a powerful platform into a secure fortress.

Docker 101: Understanding Containers from Scratch

2025-08-08T00:58:00.002+05:30

Docker Basics and Docker Compose Explained

Docker Through My Lens

Introduction to Docker

Docker is a platform designed to create, deploy, and run applications inside containers. Containers bundle an application with all its dependencies, ensuring consistency across different environments.

Unlike virtual machines, containers are lightweight and share the host operating system kernel, making them efficient for development, testing, and deployment.

Basic Docker Commands

To start using Docker, here are some essential commands:

docker run [image] – Runs a container from the specified image.
docker ps – Lists running containers.
docker ps -a – Lists all containers, including stopped ones.
docker stop [container_id] – Stops a running container.
docker rm [container_id] – Removes a container.
docker images – Lists available Docker images.
docker rmi [image_id] – Removes a Docker image.

Creating Your First Docker Container

You can run a simple container by pulling a test image and running it:

docker run hello-world

This command downloads the hello-world image if it’s not already on your system and runs it, printing a confirmation message.

Dockerfile: Building Your Own Image

A Dockerfile is a text file that contains instructions to build a Docker image. It automates image creation and ensures consistency.

Example Dockerfile for a Node.js application:

# Dockerfile
FROM node:18
WORKDIR /app
COPY package*.json ./
RUN npm install
COPY . .
EXPOSE 3000
CMD ["node", "index.js"]

Explanation:

FROM node:18 – Uses the official Node.js image version 18 as the base.
WORKDIR /app – Sets the working directory inside the container.
COPY package*.json ./ – Copies package files for dependency installation.
RUN npm install – Installs Node.js dependencies.
COPY . . – Copies the rest of the application files.
EXPOSE 3000 – Declares port 3000 for external access.
CMD ["node", "index.js"] – Defines the command to run the app.

Building and Running Your Image

Build the image using:

docker build -t my-node-app .

Run the container with:

docker run -d -p 3000:3000 my-node-app

Step-by-Step: Create Your Own Docker Container

Let’s build a simple Docker container step by step using a basic "Hello World" Node.js app.

Create a project directory:
```
mkdir my-node-app
cd my-node-app
```

Create a simple app file:

echo "console.log('Hello from my container!');" > index.js

Write a Dockerfile:

FROM node:18
WORKDIR /app
COPY index.js .
CMD ["node", "index.js"]

Build your Docker image:
```
docker build -t my-node-app .
```
Run the container:
```
docker run my-node-app
```
You should see the message: Hello from my container!

This simple example shows how you can package a basic Node.js script inside a container and run it anywhere.

Why Use Docker Compose?

Most applications require multiple components, like a web server and a database. Managing these containers individually can be tedious and error-prone.

Docker Compose solves this by defining and running multi-container Docker applications via a simple YAML file (docker-compose.yml).

Compose allows you to start, stop, and manage all related containers as a single service with one command.

Key Docker Compose Commands

Command	Description	Example
up	Create, build, and start containers	`docker-compose up`
start	Start existing containers	`docker-compose start`
stop	Stop running containers	`docker-compose stop`
down	Stop and remove containers, networks	`docker-compose down`
build	Build or rebuild containers	`docker-compose build`

Example: E-Commerce Application Using Docker Compose

Suppose you have an e-commerce site running on an Apache web server and a MySQL database storing customer data.

You could manually run:

docker network create ecommerce
docker run -p 80:80 --name webserver --net ecommerce webserver-image
docker run --name database --net ecommerce -e MYSQL_ROOT_PASSWORD=secret mysql:latest

This approach is repetitive and error-prone if you want to scale or manage containers frequently.

Instead, with Docker Compose, you can define your services in a docker-compose.yml file:

version: '3.3'
services:
  web:
    build: ./webserver
    ports:
      - '80:80'
    networks:
      - ecommerce
  database:
    image: mysql:latest
    environment:
      - MYSQL_ROOT_PASSWORD=helloworld
      - MYSQL_DATABASE=ecommerce
    networks:
      - ecommerce

networks:
  ecommerce:

Running docker-compose up spins up both services connected via the ecommerce network automatically.

Docker Socket Explained

The Docker daemon (which manages containers) listens on a Unix socket file, usually /var/run/docker.sock.

This socket acts like a communication channel between Docker clients (like the CLI) and the Docker service.

Real-World Scenario

In CI/CD pipelines, tools like Jenkins often run inside Docker containers but need to control Docker on the host to build or run containers.

By mounting the Docker socket inside the Jenkins container:

docker run -v /var/run/docker.sock:/var/run/docker.sock jenkins

Jenkins can issue Docker commands to the host’s Docker daemon as if it were running directly on the host.

Security Considerations

Exposing the Docker socket to containers is a serious security risk.
If compromised, attackers can control all Docker containers and the host system.

Conclusion

Docker and Docker Compose are essential tools that simplify the development and deployment of applications by using containers.

Understanding Dockerfiles, basic commands, and how to manage multi-container applications with Compose helps you build consistent, portable environments.

Finally, understanding internal components like the Docker socket helps when automating container management but always be cautious of the security implications.

Exploiting and Securing GitLab: Lessons from a TryHackMe Lab

2025-08-05T01:06:00.001+05:30

Perimeter security isn’t enough—because sometimes the threat is already inside.

In this blog post, I’m sharing what I learned from a hands-on TryHackMe lab on GitLab security. It revealed how a simple internal misconfiguration—like open registration or overly permissive repo access—can lead to major data exposure inside an organization. I’ll walk you through the red team perspective on exploiting a misconfigured GitLab instance, and then flip the script to explain how you can secure your own internal build systems.

Scenario: Inside the Walls of a Large Organization

Think of a large organization—like a bank—with thousands of employees and multiple teams handling development, IT operations, and security. To keep intellectual property (IP) secure, these organizations often host self-managed GitLab instances on their internal network.

But here’s where things can go wrong:

GitLab is hosted internally
Allows anyone on the internal network to register
Has some projects set to public visibility

At first glance, this doesn’t sound too dangerous. But imagine:

10,000 employees on the internal network
2,000 developers needing GitLab access
If any one of those users is compromised, the attacker can register a GitLab account and view exposed projects

Suddenly, your attack surface grows exponentially—and your private codebase is at risk.

Exploiting a Vulnerable GitLab Instance

As a red teamer in this simulated environment, the first step was registering a GitLab account on the internal server (http://gitlab.tryhackme.loc/). Once logged in, I had visibility into all public repositories.

Instead of browsing them manually, I used a Python script that leverages the GitLab API to automatically enumerate and download every accessible repo.

Here’s the key part of the script:

Connects to the GitLab API using a personal access token
Lists all visible projects
Tries to download each project archive
Saves them locally with a unique ID

This script is not stealthy—it attempts to pull everything it can, making it obvious in logs. But in a red team or CTF context, it’s great for proof of concept.

GitLab API Token Setup

To use the script, I generated a GitLab Personal Access Token with read_repository scope:

Go to your GitLab profile → Preferences
Navigate to Access Tokens
Set a name, expiry, and select scopes (e.g., read_repository)
Generate and copy the token (it won’t be shown again)

Security Misconfigurations Exploited

Open User Registration
Anyone on the internal network could create a GitLab account. No restriction = expanded attack surface.
Public Repositories Within the Internal Network
Developers assumed “internal” meant “safe to share publicly.” Public visibility on GitLab meant any valid user could view the code.

Final Flag

How to Secure Your GitLab Environment

Group-Based Access Control

Organize projects into GitLab groups and set permissions at the group level. This simplifies permission management across multiple repositories and ensures consistent security policies.

Access Levels

GitLab roles include:

Guest – View limited info
Reporter – Read-only access to code and CI logs
Developer – Push code and trigger pipelines
Maintainer – Merge changes and manage pipelines
Owner – Full administrative access

Always follow the principle of least privilege.

Sensitive Information Protection

.gitignore: Prevent sensitive files like .env or config.yml from being tracked in version control.
Environment Variables: Store secrets like API keys securely during CI/CD runs without exposing them in source code.
Branch Protection: Lock down critical branches (like main) so that changes must pass code review and automated testing.

Additional Best Practices

Enable 2FA for all GitLab users.
Review access permissions regularly, especially when users change roles or leave.
Monitor audit logs to detect unauthorized access or suspicious activity.
Use secret scanning tools to detect accidental commits of credentials or API keys.

Mastering the Intelligence Lifecycle - Cybrary

2025-05-22T01:03:00.006+05:30

Advanced Cyber Threat Intelligence

1. Introduction to the Intelligence Lifecycle

The course begins by outlining the intelligence lifecycle, a structured approach comprising:

Collection: Gathering raw data from various sources.
Processing: Organizing and structuring the collected data.
Analysis: Interpreting processed data to generate actionable intelligence.
Dissemination: Sharing intelligence with relevant stakeholders.

This framework ensures a systematic method for developing and leveraging threat intelligence programs.

2. Data Collection Sources

Effective threat intelligence begins with robust data collection from both internal and external sources:

Internal Sources:

Endpoint Logs: Data from devices within the organization.
Network Traffic: Information from firewalls, routers, and switches.
Security Tools: Outputs from SIEMs, IDS/IPS, and antivirus solutions.

External Sources:

Private Feeds: Subscription-based services like Recorded Future or Anomali.
Community Sharing: Information from ISACs and ISAOs.
Public Data: Open-source intelligence (OSINT) from platforms like VirusTotal or Shodan.

Example: An organization might use internal firewall logs to detect unusual outbound traffic and correlate this with external threat feeds to identify potential command-and-control (C2) communications.

Example: A security team may gather IOCs (Indicators of Compromise) from their SIEM (internal) and compare them with OSINT sources like Abuse.ch (external) for validation.

3. Processing and Data Management

Raw data must be processed to extract meaningful insights:

Standardization: Utilizing formats like STIX and TAXII to ensure consistency.
Scoring Systems: Applying CVSS (Common Vulnerability Scoring System) to assess the severity of vulnerabilities.

Example: By converting diverse threat data into STIX format, analysts can more easily share and interpret information across different platforms and organizations.

4. Analysis Techniques

This is the core of the course and emphasizes the importance of deep, structured analysis.

Structured Analytic Techniques:

ACH (Analysis of Competing Hypotheses): Evaluating multiple hypotheses to determine the most probable explanation.
Cyber Kill Chain: Understanding attack stages to disrupt adversaries (e.g., Reconnaissance → Delivery → Exploitation).
Diamond Model: Maps adversary, victim, infrastructure, and capability relationships.

Campaign Analysis:

MITRE ATT&CK Framework: Mapping adversary tactics and techniques to understand behavior patterns.
Heatmaps and Visualizations: Identifying trends and anomalies in attack data.

Visual Analysis

Visual Analysis is a technique used by cyber threat analysts to detect patterns, anomalies, and relationships in large datasets by representing the data visually. Instead of reviewing long logs or tables, visual tools allow analysts to quickly interpret complex attack data and identify potential threats more efficiently.

Real-World Example:

Imagine a SOC team investigating a series of login attempts. Instead of combing through thousands of log entries, they use a heatmap that highlights login activity by time and location. This immediately reveals that most logins are from internal IPs, but there’s a suspicious spike from a foreign country at 3 AM, which could indicate a brute-force or credential stuffing attempt.

Tools Often Used:

Maltego – for mapping relationships between actors and infrastructure.
ELK Stack (Elasticsearch, Logstash, Kibana) – for visualizing logs and timelines.
MITRE ATT&CK Navigator – to track adversary techniques across campaigns.

Course of Action (CoA)

In the Course of Action step, analysts and defenders recommend specific defensive or responsive actions based on the findings from threat intelligence. These actions are tied closely to where the adversary is in the Cyber Kill Chain and the nature of their tactics.

Real-World Example:

If an organization detects a phishing campaign that leads to credential theft (Delivery → Exploitation in the Kill Chain), a recommended course of action might include:

Blocking the phishing domain.
Resetting affected user passwords.
Deploying Multi-Factor Authentication (MFA).
Educating employees on phishing recognition.

The Diamond Model can also assist by analyzing the adversary, their infrastructure, capabilities, and the victim profile to suggest targeted responses.

Example: A campaign using phishing and credential dumping techniques can be tracked using ATT&CK to predict the next steps.

Example: During the analysis of a phishing campaign, ACH can help determine whether the observed activities align more closely with financially motivated cybercriminals or state-sponsored actors.

5. Attribution and Bias Management

Attributing cyberattacks to specific actors involves careful consideration:

Attribution Challenges: Similar tools and techniques can be used by different threat actors.
Cognitive Biases: Awareness of biases like confirmation bias is crucial.
Logical Fallacies: Avoiding flawed reasoning that leads to false conclusions.

Nation-State Attribution

Nation-State Attribution is the process of linking a cyberattack to a state-sponsored actor. This is particularly complex and sensitive because it involves geopolitical implications and requires strong, corroborated evidence. Analysts typically use a combination of malware signatures, TTPs (Tactics, Techniques, and Procedures), infrastructure, and historical context.

Real-World Example:

A ransomware variant is discovered in a bank’s network. The malware uses custom encryption routines and communicates with C2 servers linked to known infrastructure used by a group like APT28 (Fancy Bear). These are linked through:

Malware code similarity.
Infrastructure re-use (same domains or IPs).
Timezone-based activity patterns.

The analysis might suggest Russia-based nation-state involvement, but analysts must avoid jumping to conclusions due to false flag tactics — where attackers mimic other groups to mislead attribution.

Example: Jumping to conclusions based on previous incidents without verifying data can lead to false positives.

Example: The presence of a particular malware strain should not automatically result in attributing an attack to a known group without supporting evidence.

6. Dissemination and Feedback

The final stage of the lifecycle involves sharing intelligence and gathering feedback.

Intelligence Types:

Tactical Intelligence: Short-term, technical details like IPs and malware hashes.
Operational Intelligence: Information about ongoing campaigns or TTPs.
Strategic Intelligence: High-level analysis for decision-makers.

Sharing Intelligence:

Collaboration with other organizations enhances defense.
Feedback improves future data collection and analysis.

Example: Sharing IOC data with a sector-specific ISAC can help identify industry-wide threats.

Example: A strategic report highlighting emerging ransomware trends can inform executive decisions on investing in backup and recovery solutions.

Reference: Screenshots and course summary content taken from Advanced Cyber Threat Intelligence - LinkedIn Learning.

Deep Dive into Cybersecurity: Security+ Level Knowledge Without the Certificate

2025-04-16T00:30:00.007+05:30

📚 My Cybersecurity Learning Journey

Key Topics from a 17-Hour Security+ Course

🔹 CIA Triad Explained

Confidentiality: Ensuring that sensitive data is only accessed by authorized users. This is often achieved using encryption and access controls.

Integrity: Ensuring data is accurate and untampered. Techniques like hashing, checksums, and digital signatures help validate that data hasn't been altered.

Availability: Making sure systems and data are accessible when needed. Achieved through backups, redundancy, load balancing, and fault-tolerant design.

🔹 Types of Threats

Malware: Includes viruses, ransomware, worms, and trojans that compromise devices or networks.
Social Engineering: Manipulating users into giving up confidential info. Example: Phishing emails.
Insider Threats: Employees or contractors misusing access, accidentally or intentionally.
Advanced Persistent Threats (APTs): Long-term targeted attacks, often by well-funded threat actors.
Zero-Day Vulnerabilities: Exploits for unknown software bugs before a fix is available.

🔹 Networking Fundamentals for Security

Studied basic networking concepts: IP addressing (IPv4/IPv6), MAC addresses, ports, and protocols like TCP/UDP. Learned about the OSI model, and how each layer relates to security implementations. Gained insights into VLANs, VPNs, routers, switches, and secure architecture design.

🔹 Security Protocols

SSL/TLS: Secures web communication via encryption. TLS is widely used in HTTPS.
IPSec: Secures IP traffic, mainly used in VPNs for encrypted tunnels.
SSH: Secure Shell protocol for secure remote login and file transfers.
SFTP: Secure file transfer protocol using SSH.
WPA3: Wi-Fi Protected Access protocol for securing wireless networks.

🔹 Firewalls & Network Security

Understood how stateful firewalls track active connections and how stateless firewalls inspect packets individually. Learned about configuring ACLs, DMZs for isolating public-facing services, and NAT for IP address masking. Also studied IDS/IPS for threat detection and prevention.

🔹 Security Operations Center (SOC)

Learned how a SOC monitors and manages security posture using tools like SIEM (Security Information and Event Management). Understood the use of SOAR for automating incident response, and endpoint security solutions like EDR/XDR for managing threats on devices.

🔹 Threat Hunting & Threat Intelligence

Studied proactive threat hunting strategies — using indicators of compromise (IoCs), behavior analytics, and threat intelligence feeds. Learned how organizations gather and analyze threat data to understand attacker TTPs (Tactics, Techniques, Procedures) and prepare defenses accordingly.

🔹 Host Security

Anti-virus and anti-malware solutions
Regular patching to fix vulnerabilities
Host-based firewalls and secure configurations
OS hardening to remove unnecessary services and enforce strict permissions

🔹 Identity and Access Management (IAM)

MFA (Multi-Factor Authentication): Adds additional verification steps to improve login security.
SSO (Single Sign-On): One login grants access to multiple systems.
RBAC: Access based on user roles.
ABAC: Access based on attributes like department or or sensitivity of information.
LBAC: Access based on location .
Emphasized the Principle of Least Privilege and Separation of Duties to reduce risk.

🔹 AAA – Authentication, Authorization, Accounting

Authentication: Verifying identity (e.g., username & password, biometrics).
Authorization: Granting permissions based on identity (e.g., admin rights).
Accounting: Logging actions (e.g., login attempts, file access) for auditing.

🔹 Mobile Device Security

Learned about MDM (Mobile Device Management) tools for enforcing security policies. Topics included encryption, remote wipe, app whitelisting, and handling BYOD (Bring Your Own Device) risks with secure containers and user awareness.

🔹 Incident Response & Digital Forensics

Studied the full Incident Response (IR) lifecycle: Preparation → Detection → Containment → Eradication → Recovery. Learned forensic steps for evidence preservation: identification, collection, analysis, and documentation. Understood the importance of maintaining chain of custody for legal admissibility.

🔹 Cryptography

Symmetric Encryption (AES): Uses one shared key for encryption and decryption. Fast and efficient for large data.
Asymmetric Encryption (RSA): Uses public and private key pairs. Suitable for secure key exchange and digital signatures.
Hashing Algorithms (SHA-2, MD5): Provide data integrity by creating fixed-length representations.
Digital Signatures: Ensure data authenticity and integrity. Common in secure emails and documents.
PKI (Public Key Infrastructure): Framework for managing digital certificates and public keys.
TLS/SSL Handshake: A multi-step negotiation process to establish secure communication between a client and server using certificates and encryption keys.

🔚 Final Thoughts: Was It Worth It?

After completing the full CompTIA Security+ course on LinkedIn Learning (37 hours), I can confidently say it was absolutely worth it for anyone looking to build a solid foundation in cybersecurity.

The course covers a wide spectrum of essential topics—from understanding basic networking and threats to learning real-world concepts like incident response, cryptography, and security operations.

Even though it doesn’t offer a certification like the official CompTIA Security+ exam, the knowledge and clarity I gained were invaluable. The content was well-structured, beginner-friendly, and practical enough to help me grasp the real-world applications of cybersecurity concepts.

If you're someone looking to start your journey in cybersecurity, I highly recommend this course. It's an excellent way to get exposure to key domains and terminology used in the industry—before diving into more advanced certifications or practical labs.

Bottom Line: Great investment of time for beginners. Solid theoretical grounding, clear explanations

Beware of Instagram Shopping Scams: Tips to Stay Safe

2024-09-21T08:16:00.001+05:30

Beware of Instagram Shopping Scams: Tips to Stay Safe

In recent years, Instagram has evolved into a popular marketplace, allowing users to discover and purchase products directly through the platform. While this has made shopping more convenient, it has also opened the door to a rise in scams and fraudulent activities. Here’s what you need to know about Instagram shopping scams and how to protect yourself.

What Are Instagram Shopping Scams?

Instagram shopping scams typically involve fake accounts or websites that mimic legitimate brands. Scammers often create attractive posts featuring trendy products at unbeatable prices, luring unsuspecting shoppers into making purchases. Once you’ve placed an order, you might receive subpar merchandise, or worse, nothing at all.

I'm receiving a lot of calls nowadays about scams, and people are asking how they can get a refund and whether there is any chance of getting their money back.

Common Types of Scams are Fake Accounts, Phishing Links and Non-Delivery

Precautions to take :

1. Verify the Seller: Check the account’s followers, reviews, and engagement. Legitimate brands usually have a significant following and authentic interactions with customers. Even this is not always necessary, as it may not be an authentic account.

2. Research Before You Buy: Look up the brand online. A quick search can reveal whether others have had positive or negative experiences with the seller.

3. Watch for Red Flags: Be cautious of accounts with few posts or followers, poor-quality images, or prices that seem too good to be true.

4. Use Secure Payment Methods: Avoid providing sensitive information directly through Instagram. Use secure payment platforms that offer buyer protection. Try to avoid using UPI payments and use Cash on Delivery or credit cards options, as this gives us a better chance to stop the transaction and increases the likelihood of getting a refund in case of fraud.

5. Read Reviews: Check for reviews on independent sites or forums. This can give you some insight into the reliability of the seller.

6. Try to avoid shopping on weekends, as fraudsters often choose these days to carry out scams because banks are closed, leaving victims with fewer opportunities to take action.

Reporting an account on Instagram is a good option, but sometimes it can be problematic, especially when there is an ongoing case with the cyber cell to catch fraudsters. When we report the account, the scammers may become aware and switch off their mobile numbers, making it harder for the police to track them. This can sometimes be a disadvantage.

Please share your suggestions in the comments.

I hope this blog will be helpful to people. Please like and share it with your family, friends, and colleagues to raise awareness about these Instagram scams.

Job Scams / Telegram Scams in India

2024-02-01T01:12:00.000+05:30

Awareness is necessity

Job scams and telegram scams have become a rampant issue in India, with many unsuspecting individuals falling victim to these fraudulent activities. These scams not only cause financial loss but also result in emotional distress and a loss of trust in online platforms. In this blog, we will discuss the ongoing job scam and telegram scam in India, and provide some tips on how to identify and avoid falling prey to these scams.

The job scam in India has been on the rise, with scammers posing as recruiters or employers offering lucrative job opportunities. These scammers often target job seekers who are desperate for employment and are willing to take any opportunity that comes their way.

They use fake job postings, promising high salaries and attractive benefits to lure in their victims. Once the victim is hooked, they are asked to pay a fee for processing their application or for other reasons. In reality, there is no job, and the victim ends up losing their hard-earned money.

Another prevalent scam in India is the telegram scam, where scammers use the popular messaging app Telegram to deceive people into investing in fake schemes or cryptocurrencies. These scammers often create fake investment groups or channels, promising high returns on investment. They use fake testimonials and success stories to lure in unsuspecting individuals, convincing them to invest their money. Once the victim invests, the scammers disappear with the money, leaving the victim in financial ruin.

To avoid falling victim to these scams, it is essential to be vigilant and cautious when dealing with job offers or investment opportunities online. Here are some tips to help you identify and avoid job and telegram scams:

Research the company or recruiter:
Before applying for a job or investing in any scheme, research the company or individual offering the opportunity. Look for reviews and feedback from others who have interacted with them.
Never pay for a job
Legitimate employers do not ask for money upfront for job applications, interviews, or any other reason. Be wary of any job offer that requires you to pay a fee.
Verify information
If you come across a job posting or investment opportunity that seems too good to be true, verify the information through multiple sources before proceeding
Trust your instincts
If something feels off or too good to be true, trust your instincts and proceed with caution.

In conclusion, job scams and telegram scams are a growing concern in India, and it is crucial for individuals to be aware of these fraudulent activities and take necessary precautions. By staying informed and exercising caution, we can protect ourselves from falling victim to these scams and help create a safer online environment for everyone.

What If your Private Information leaked without your consent?

2023-09-05T12:02:00.002+05:30

Awareness is necessity

In today's digital era, privacy is a major concern for everyone. With the increasing use of technology, it has become easier to share one’s personal information online. However, it also imposes the risk of information being misused or leaked without one’s knowledge. One such example is private photos getting uploaded on illegal websites or the dark web without your knowledge or consent. If you ever find yourself in such a situation, it is important to take immediate action to protect your privacy and rights. In this blog, we will discuss what to do in accordance with Indian Law if someone uploads your private photos on illegal websites or the dark web.

File a complaint with the Cyber Crime Cell
The first step you should take is to file a complaint with the Cyber Crime Cell of your city or town. This can be done either online or by visiting the nearest police station. Here you can call cybercrime helpline number 1930 immediately or you can register a complaint on our government portal www.cybercrime.gov.in. You will need to provide details of the incident, including when and where the photos were uploaded, and any other relevant information that may help in identifying the culprit. The Cyber Crime Cell will investigate the matter and take appropriate action against the person responsible.
Contact the website owner or hosting provider
If you know the website where your photos have been uploaded, you can contact the website owner or hosting provider and request them to remove the content. When a request is initiated by Law Enforcement, they may take it seriously and take immediate action. Most websites have a process for reporting such content, and they will usually take it down if it violates their terms of service. However, if the website is hosted on the dark web, it may be difficult to track down the owner or hosting provider.
Take legal action
If the above steps do not yield results, you can consider taking legal action against the person responsible for uploading your private photos. This can be done by filing a case in court under various sections of the Indian Penal Code, including Section 354 (outraging modesty of a woman), Section 499 (defamation) and Section 500 (punishment for defamation). You can also seek damages for the harm caused to your reputation and mental wellbeing.

Precautionary steps:

Protect your personal information
One of the best ways to prevent your private photos from being uploaded online is to protect your personal information. Be cautious when sharing personal information on social media or any other online platform. Avoid sharing sensitive information such as your phone number, address, or email address with strangers.
Use strong passwords
Make sure you use strong passwords for all your online accounts, including social media, email, and cloud storage. Avoid using easy-to-guess passwords such as your name or date of birth. Use a combination of letters, numbers, and symbols to create a strong password.
Be cautious when sharing photos
Be careful when sharing photos online, especially if they are of a personal nature. Avoid sending such photos to strangers or people you do not trust. If you must share such photos, make sure you use a secure messaging app that offers end-to-end encryption.

This is my humble request to every woman and every couple avoid capture your private moments on a mobile device or any digital device because when we talked about digital world nothing is 100% secure. I believe that prevention is better than cure.

Conclusion:

If someone uploads your private photos on illegal websites or the dark web, firstly don’t panic and fear no one, cause there is Law and Order to protect one’s privacy. Also do not fall under any blackmailing trap, just take the necessary steps immediately to protect your privacy and rights. Follow the steps and precautions mentioned above to ensure that your personal information remains secure and protected. Remember, prevention is always better than cure.

Stay Safe Stay Secure, Jai Hind!

Protecting Yourself from Vishing & Smishing frauds in India

2023-08-17T14:18:00.006+05:30

Awareness is necessity

Vishing & Smishing fraud is a type of scam that involves the use of text messages and Voice calls to trick individuals into revealing sensitive personal information such as bank account details, passwords, and credit card numbers. This type of fraud has become increasingly common in India, with many people falling victim to these scams every year. In this blog, we will discuss what Vishing & Smishing frauds are, how it works, and what steps you can take to prevent falling victim to these scams.

What is Vishing & Smishing Fraud?

Vishing & Smishing fraud is a type of social engineering scam that involves the use of text messages and Voice calls to trick individuals into revealing sensitive personal information. The term "vishing" is a combination of "voice" and "phishing," which refers to the use of voice calls to trick individuals into revealing personal information. In "Smishing" fraud, scammers use text messages instead of voice calls to deceive their victims.

How Does Vishing & Smishing Fraud Work?

Vishing & Smishing fraud typically starts with a text message that appears to be from a legitimate source, such as a bank or a government agency. The message may ask the recipient to click on a link or call a phone number to verify their account details or claim a prize. Once the victim clicks on the link or calls the number, they are directed to a fake website or automated voice system that prompts them to enter their personal information.

The fake website or voice system may look and sound legitimate, making it difficult for the victim to detect that they are being scammed. The scammers may also use techniques such as urgency or fear to pressure the victim into giving up their personal information.

Prevention Steps for Vishing & Smishing Fraud

Be cautious of unsolicited text messages and Calls: If you receive a text message or call from an unknown source asking for personal information, do not respond. Legitimate companies and government agencies will not ask for personal information over text message.
Do not click on links: If a text message contains a link, do not click on it. The link may direct you to a fake website that will prompt you to enter personal information.
Verify the source: If you receive a text message from a company or government agency that you do business with, verify the source before responding. Call the company or agency directly to confirm that they sent the message.
Use two-factor authentication: Two-factor authentication adds an extra layer of security to your accounts. It requires you to enter a code that is sent to your phone in addition to your password.
Keep your software up to date: Make sure that your phone's software is up to date. Updates often include security patches that can help protect against Vishing & Smishing fraud and other types of scams.

Conclusion:

Vishing & Smishing fraud is a serious threat in India. Scammers use text messages to trick individuals into revealing sensitive personal information. To prevent falling victim to these scams, it is important to be cautious of unsolicited text messages, verify the source, avoid clicking on links, use two-factor authentication, and keep your software up to date. By taking these steps, you can help protect yourself from Vishing & Smishing fraud and other types of scams.

If you are already scammed and lost money, then you can call cybercrime helpline number 1930 immediately or you can register a complaint on our government portal www.cybercrime.gov.in. The first 2-4 hours are called golden hours. If you register a complaint in these golden hours, then chances are increased of getting money back.

Stay Safe Stay Secure, Jai Hind!

Protecting Yourself from Online UPI Fraud in India

2023-06-28T09:39:00.002+05:30

Awareness is necessity

As online transactions continue to gain popularity in India, so does the risk of online fraud. One of the widely-used payment systems in the country is Unified Payments Interface (UPI), which enables users to instantly transfer funds between bank accounts. However, with the rise in digital transactions, instances of UPI fraud have also increased. In this blog, we will discuss the various types of UPI frauds, provide tips for mitigation, and highlight the helpline services available to assist victims.

Types of UPI Fraud:

SIM Card Swapping: Scammers convince telecom service providers to issue a new SIM card linked to the victim's mobile number. This allows them to intercept OTPs (One-Time Passwords) sent during UPI transactions.
Phishing: Fraudsters send deceptive emails or messages posing as legitimate institutions, tricking users into revealing their UPI credentials or other sensitive information.
Remote Access Fraud: Fraudsters gain unauthorized access to victims' smartphones through malicious apps or remote desktop software, enabling them to control the device and initiate fraudulent UPI transactions.
QR Code Scams: Scammers generate fake QR codes and trick users into scanning them, redirecting payments to their own accounts instead of the intended recipient.

Mitigation Measures:

Stay Vigilant: Be cautious while sharing personal information or UPI credentials. Verify the authenticity of messages, emails, or phone calls before responding or taking any action.
Use Trusted Apps: Download UPI apps only from official sources such as Google Play Store or Apple App Store. Avoid using unauthorized or third-party apps that may compromise your security.
Enable Two-Factor Authentication: Activate two-factor authentication for UPI transactions to add an extra layer of security. This typically involves using a combination of passwords, PINs, or biometrics.
Secure Your Device: Keep your smartphone's operating system and apps up to date to ensure you have the latest security patches. Install reliable antivirus software to protect against malware.
Monitor Your Transactions: Regularly review your UPI transaction history to identify any suspicious activity. Report any unauthorized transactions immediately to your bank and the concerned authorities.

Helpline Services:

If you become a victim of UPI fraud, it is crucial to act swiftly. Here are some helpline services available in India:

Register your complaint on 1930 helpline (working 24x7) is specifically meant for financial frauds.
Reserve Bank of India (RBI): Contact the RBI's helpline number (1800 1201740) or email them at helpdoc@rbi.org.in to seek guidance or report UPI fraud.You will get a refund if wrong transaction occurred.
National Cyber Crime Reporting Portal: The Ministry of Home Affairs operates this portal (www.cybercrime.gov.in) where you can report cybercrimes, including UPI fraud.

Conclusion:

While online UPI transactions offer convenience and speed, it is essential to remain vigilant and take necessary precautions to protect yourself from fraud. By staying informed about the various types of UPI fraud, implementing mitigation measures, and promptly reporting any suspicious activity, you can help safeguard your finances. Remember, awareness and timely action are key to combating online UPI fraud effectively.

ઑનલાઇન બેંકિંગ છેતરપિંડી વિશે સાયબર સુરક્ષા ટીપ્સ

2022-10-15T14:23:00.001+05:30

Awareness is necessity

આજકાલ, ઓનલાઈન બેંકિંગ frauds દિવસેને દિવસે વધી રહી છે. ઈન્ટરનેટ ઉપયોગ, ઈન્ટરનેટ સુરક્ષા અને સાયબર ક્રાઈમ અંગે જાગૃતિ ક્રાઈમ ઘટાડવામાં મદદરૂપ થઈ શકે છે. તેથી અહીં કેટલીક Security guidelines પ્રદાન કરવામાં આવી છે જે તમારે બેંક ટ્રાન્ઝેક્શન દરમિયાન અનુસરવી જોઈએ.

સેફ બેંક ટ્રાન્ઝેક્શન ટિપ્સ:

SMS દ્વારા અથવા ઈમેઈલ દ્વારા મોકલવામાં આવેલ ATM PIN કોડ અને OTP "વન ટાઈમ પાસવર્ડ" કોઈપણ સાથે ક્યારેય જાહેર કરશો નહીં, પછી ભલે તે બેંકમાં કર્મચારી હોય, કારણ કે બેંક તમને તમારા ખાતા અથવા ક્રેડિટ કાર્ડના કોડ વિશે ક્યારેય પૂછતી નથી.
બેંકિંગ વ્યવહારો કરવા માટે પબ્લિક કોમ્પ્યુટરનો ઉપયોગ કરવાનું ટાળો.
જો તમે Public Wi-Fi દ્વારા ઈન્ટરનેટ સાથે જોડાયેલા હોવ તો ઈલેક્ટ્રોનિક બેંકિંગ વ્યવહારો કરવાનું ટાળો.
વોટ્સએપ, ફેસબુક, ટેલિગ્રામ વગેરે પર, ઈમેઈલ, ચેટ્સ અથવા મેસેજમાં આપેલી કોઈપણ લિંક દ્વારા ખોલતી બેંકિંગ વેબસાઈટ પર બેંકની વિગતો અથવા ઓળખપત્ર ક્યારેય દાખલ કરશો નહીં.
હંમેશા personal computer અને latest ઓપરેટિંગ સિસ્ટમ સાથે સ્થાપિત મોબાઇલ ઉપકરણો પર બેંકિંગ વ્યવહારો કરો.
કમ્પ્યુટર્સ પર ઇન્સ્ટોલ કરેલી એપ્લિકેશન્સમાં મોટાભાગના જોખમોને શોધવા અને તેનાથી સુરક્ષિત રહેવા માટે એન્ટિવાયરસ સૉફ્ટવેર ઇન્સ્ટોલ કરો.
તમે ઓનલાઈન બેંકિંગ સેવાઓનો ઉપયોગ કરવાનું સમાપ્ત કરો પછી તરત જ તમારા Bank account માંથી લોગઆઉટ કરો.
તમારા બેંકિંગ passwords ને બ્રાઉઝર અથવા અન્ય કોઈપણ પાસવર્ડ સેવિંગ એપ્લિકેશનમાં ક્યારેય સાચવશો નહીં.

Contact details of Gujarat Police

તમારા મોબાઈલ માં તમારા જિલ્લા નો ક્રાઇમ બ્રાન્ચ નંબર save કરી ને રાખજો.

Sr no.	District Name	Contact No
1	Ahmedabad	(O) 079-25633636
2	Amreli	(O) 02792-222333
3	Anand	(O) 02692-260027
4	Aravalli	--
5	Banaskantha	(O) 02742-257015
6	Bharuch	(O) 02642-223303
7	Bhavnagar	(O) 0278-2520050
8	Botad	(O) 02849-251416
9	Chhota Udepur	--
10	Dahod	(O) 02673-222300
11	Dang	(O) 02631-220248
12	Devbhoomi Dwarka	--
13	Gandhinagar	(O) 23210901
14	Gir Somnath	--
15	Jamnagar	(O) 0288-2554203
16	Junagadh	(O) 0285-2635633
17	Kutch	(O) 02832-250960
18	Kheda	(O) 0268-2550250
19	Mahisaga	--
20	Mehsana	--
21	Morbi	--
22	Narmada	(O) 02640-222167
23	Navsari	(O) 02637-245333
24	Panchmahal	(O) 02672-242200
25	Patan	--
26	Porbandar	(O) 0286-2211222
27	Rajkot	(O) 0281-2459888
28	Sabarkantha	(O) 02772-247333
29	Surat	(O) 0261-2651831
30	Surendranagar	(O) 02752-282100
31	Tapi	--
32	Vadodara	(O) 0265-2431414,(O) 0265-2431515
33	Valsad	(O) 02632-254222

How to Protect ourselves from Online Banking frauds: Tips & Ticks

2022-10-15T14:21:00.004+05:30

Awareness is necessity

Nowadays, Online banking frauds are increasing day by day, and awareness about Internet use, Internet Security and cyber crime can be helpful in mitigating cyber crime. So here I am sharing some security guidelines you should follow during bank transactions as given by Delhi Police.

Safe Bank Transaction Tips:

Always do banking transactions on self-computer and mobile devices, installed with original operating system.
Use the latest Antivirus software in order to detect and stay protected from most of the threats and vulnerabilities in the applications installed on computers.
Never disclose ATM PIN codes and OTP “One Time Password” sent by the bank through SMS or on Email with anyone, even if he is an employee at the bank, as bank never ask you about the codes of your account or any credit card details.
Avoid using public computers for making banking transactions.
Avoid electronic banking transactions if you are connected to the Internet via public Wi-Fi.
Never enter bank details or credentials on a banking website which opens through any link provided in emails, chats or messages on WhatsApp, Facebook, Telegram etc.
Logout from your account as soon as you finish using the online banking services.
Never save your banking credentials in browser or any other password saving applications.

Contact details of Gujarat Police

Save your district crime branch number on your mobile.

Sr no.	District Name	Contact No
1	Ahmedabad	(O) 079-25633636
2	Amreli	(O) 02792-222333
3	Anand	(O) 02692-260027
4	Aravalli	--
5	Banaskantha	(O) 02742-257015
6	Bharuch	(O) 02642-223303
7	Bhavnagar	(O) 0278-2520050
8	Botad	(O) 02849-251416
9	Chhota Udepur	--
10	Dahod	(O) 02673-222300
11	Dang	(O) 02631-220248
12	Devbhoomi Dwarka	--
13	Gandhinagar	(O) 23210901
14	Gir Somnath	--
15	Jamnagar	(O) 0288-2554203
16	Junagadh	(O) 0285-2635633
17	Kutch	(O) 02832-250960
18	Kheda	(O) 0268-2550250
19	Mahisaga	--
20	Mehsana	--
21	Morbi	--
22	Narmada	(O) 02640-222167
23	Navsari	(O) 02637-245333
24	Panchmahal	(O) 02672-242200
25	Patan	--
26	Porbandar	(O) 0286-2211222
27	Rajkot	(O) 0281-2459888
28	Sabarkantha	(O) 02772-247333
29	Surat	(O) 0261-2651831
30	Surendranagar	(O) 02752-282100
31	Tapi	--
32	Vadodara	(O) 0265-2431414,(O) 0265-2431515
33	Valsad	(O) 02632-254222

Narishakti Zindabad

2022-03-08T21:18:00.000+05:30

Happy International Women's Day

" There is no limit to what we, as women can accomplish

On this auspicious day 'Women's Day', Not only Do they face Molestations and Physical threats but Cyber criminal out there think women as a easy target, but let me tell you that yes you are the most powerful and no one should think that Women is a easy target for any Crime.

Power, Knowledge, and Money are the most important one, Power is Shakti and Shakti is Woman, knowledge is Saraswati and Saraswati is Woman, Money is Laxmi and Laxmi is Woman. So what is the need of underestimate, You are Powerful.

Narishakti Zindabad.....!

In the society, where women is only as good as her cooking Show them that you can bake and earn your own bread. Show them the tremendous strength,courage and intellect you have got. Show them who you really are. Make theme feel intimidated of your capabilities and envy of your audacity. Listen to no one and just your heart achieve heights, go places.

Follow your passion to break all the barriers of patriarchy.

You boss lady ! Hold your crown high, fight hard, don't give up and most importantly " Break the Bias". There is no limit to what we, as women can accomplish.

Once again,Happy international women's day !!

A new WhatsApp Scam : Amazon's 30th anniversary celebration free gifts!

2021-05-06T11:49:00.007+05:30

Awareness is necessity

One of my friend sent a message yesterday asking me to take a survey to claim free gifts as part of Amazon’s 30th Anniversary celebration.

Did you receive this kind of message ?

If yes then beware !!!
It’s a new whatsapp scam. "

Letme inform you first that according to WIKIPEDIA Jeff Bezos founded Amazon in July 1994. Now count the years . It's only 26 years. And here in the title they mentioned a 30th anniversary celebration.

There are several ways to identify the link whether it is original or fake.

When users click on the message, a new window opens saying “Congratulations, you have been chosen to participate in our survey”. Users are asked to answer four questions. After the user submits the answers , Bunch of gift boxes appears on the screen asking user to make a selection. In most cases it is the Huawei Mate 40 pro .

I marked red squares on screenshots , when you try to click on that button or sign-in label , they are unclickable. This is a sign of a phishing/fake page. Then this website asks users to share the quiz with “5 whatsapp groups” and “20 friends”.

Never Do this

You are becoming a part of such a scam unintentionally and spreading it to more people. Providing some personal information on such websites can be dangerous .

When you click on complete registration button, it will redirect you to fake links. Keep in mind while visiting such fake websites that it will redirect you on malicious links and pop-ups and then when we download, its something else. It maybe any worm or any encrypted malware. Some bad people can use such links to spread/install malware in your device.

You can see page redirection fake links in below images.

So the motive behind this article is to spread awareness about this kind of WhatsApp scam. As cybercriminals are becoming very smart day by day, they are using new ideas to make people fool and gather informations.

પ્રાઇઝ સ્કેમ: જો તમારે ઇનામ મેળવવા માટે ચૂકવણી કરવી પડતી હોય તો તે ઇનામ નથી

2020-10-29T21:52:00.005+05:30

Awareness is necessity

શું તમને ક્યારેય કોઈ કોલ્સ આવ્યા છે કે જેમાં તમે કોઈ પણ ઓનલાઇન શોપિંગ વેબસાઇટમાંથી ઇનામ અથવા લોટરી જીતી લીધી હોય તેવું કહે છે?

શક્યતા છે કે આ કોલ્સ ફ્રોડ છે.

સાયબર સ્વયંસેવક તરીકે, મેં આ પ્રકારની છેતરપિંડીઓના કેટલાક કેસ નું અધ્યયન કર્યું છે.
ચાલો સમજીએ કે આ પ્રકારની છેતરપિંડી કેવી રીતે થાય છે? !!

છેતરપિંડી કરનાર તમને કોઈપણ વિશ્વસનીય ઓનલાઇન શોપિંગ સાઇટમાંથી કર્મચારી હોવાનુ કહે છે.તેઓ તમને સાઇટ પરથી તમારી છેલ્લી ખરીદી વિશેની વિગતો, ઉત્પાદન અને ઓર્ડર ની વિગતો સાથે તમને મનાવવાનો પ્રયાસ કરે છે.

જ્યારે કોઈ વ્યક્તિ માને છે કે છેતરપિંડી કરનાર ઓનલાઇન સાઇટનો કર્મચારી છે, ત્યારે તેઓ તમને વિવિધ ઇનામો જેવા કે લેપટોપ, ટીવી, મોબાઇલ ફોન વિશે આકર્ષક યોજનાઓ આપે છે અને તમારી પાસેથી એક ઇનામ પસંદ કરવાનો વિકલ્પ આપે છે.જ્યારે તમે થોડી રુચિ બતાવો અને ઇનામ પસંદ કરો ત્યારે ઉલ્લેખિત ઇનામમાંથી, તેઓ તમને SMS તરીકે એક લિંક મોકલે છે.મોકલેલી લિંક એ છેતરપિંડીની લિંક છે જે તમારી વિગતો જેવી કે બેંક વિગતો તેમજ વ્યક્તિગત માહિતી માટે પૂછે છે.નોંધણી કરતી વખતે, તે તમને તમારા સ્થાને પહોંચાડવા માટે ફક્ત શિપિંગ અને હેન્ડલિંગ ચાર્જ ચૂકવવાનું કહેશે. બધી પ્રક્રિયા પછી અને ફી ચૂકવ્યા પછી તમને ખબર પડે કે કોઈ ઇનામ નથી.

એક કિસ્સો તાજેતરમાં બન્યો છે જ્યાં એક પીડિતાએ રૂ. 96,૦૦૦ /- ગુમાવ્યા હતા. છેતરપિંડી કરનારાઓને શોધવા ખૂબ જ મુશ્કેલ છે

તેથી આપણે આ પ્રકારના ગુનાઓથી બચવા માટેની રીત આ છે:

જાગૃત રહો અને આ પ્રકારના છેતરપિંડી કોલ પર ક્યારેય વિશ્વાસ ન કરો.
કોઈ પણ શોપિંગ વેબસાઇટ કોલ ઇનામ અથવા લોટરી વિશે માહિતી આપતી નથી.
કોઈપણને ફોન પર વ્યક્તિગત વિગતો, બેંક વિગતો અથવા ઓટીપી શેર કરશો નહીં.
લોટરી અને લકી ડ્રોના કોલ્સ ને અવગણો. ખાસ કરીને જો તમે કોઈ લકી ડ્રોમાં પ્રવેશ કર્યો નથી.
તમે ઓનલાઇન સરકારી પોર્ટલ પર તમારી ફરિયાદ નોંધાવી શકો છો:

All over India- : http://cybercrime.gov.in
For Gujarat- :cc-cid@gujarat.gov.in
સાયબર ક્રાઇમ હેલ્પલાઈન માટે- :1800-1800191 or 155260
નાણાકીય છેતરપિંડી (financial fraud emergency number)- :100/112

જ્યારે પણ કોઈ શારીરિક ગુના માટે આપણને કટોકટીની મદદની જરૂર પડે છે ત્યારે આપણે પોલીસ વિભાગમાં 100 ડાયલ કરીને સંપર્ક કરીએ છીએ, સાયબર ગુનાના કિસ્સામાં પણ આવું થવું જોઈએ.

PRIZE SCAM: If you have to pay to get the prize, it's not a prize

2020-10-29T21:15:00.003+05:30

Awareness is necessity

Have you ever got any calls stating that you have won a prize or lottery from any online shopping website?

The chances are these calls are fraud

As a Cyber volunteer, I have analyzed some case studies of these kinds of frauds.
Let’s understand how this type of fraud happens !!

The fraudster calls you imposing as an employee from any trusted online shopping site. They try to convince you by giving you the details about your last purchase from the site, with the product and order details.

When a person believes that the fraudster is an employee from the online site, they give them attractive schemes about different prizes like laptop, T.V, mobile phones and give an option to select one prize from them.When you show some interest and select a prize from the mentioned prize, they send us a link as SMS. The link sent is the fraud link which asks for our registration details like bank details as well as personal information. While registration they ask us to pay just the shipping and handling charges to get it delivered to your place.After all the process and paying the fees you find out there is no prize.

One such case happened recently where a victim lost their ₹ 96,000/-. For such scams, tracing back fraudsters is very difficult.

So the way we can avoid such crime is by:

Be aware and never believe in this kind of fraud call.
No shopping website calls informing about the prize or lottery.
Never give personal details, bank details or OTP over the phone to anyone.
Ignore messages and calls of lottery and lucky draw. especially if you have not entered any lucky draw.
Inform about such crimes on the government portals mentioned:

All over India- : http://cybercrime.gov.in
For Gujarat- :cc-cid@gujarat.gov.in
For cybercrime helpline- :1800-1800191 or 155260
For financial fraud emergency number- :100/112

Whenever we need emergency help for any physical crime we approach the police department by dialling 100, the same should be done in the case of cyber crimes too.

શું તમે ઇ-સિમ ફ્રોડ વિશે જાણો છો ? શું છે આ ઇ-સિમ ?

2020-10-05T14:43:00.004+05:30

Awareness is necessity

જામતારા સ્થળ વિશે ક્યારેય સાંભળ્યું છે? તમારામાંથી ઘણાએ Netflix પરની પ્રખ્યાત series "Jamtara: Sab ka number ayega" જોઇ હશે.તે ઝારખંડની રાજધાની રાંચી નજીક આવેલું છે. આ સ્થાન ફિશિંગ અને બેંક ફ્રોડ નું કેન્દ્ર બન્યું છે.

તાજેતરમાં જામતારા ચર્ચામાં આવેલું છે કારણ કે આ સ્થાનના છેતરપિંડી કરનારાઓએ નવા પ્રકારના ગુના / છેતરપિંડી (scam/fraud) શરૂ કરી છે, એટલે કે ઇ-સિમ ફ્રોડ.

શું તમે જાણો છો e-SIM શું છે ?

e-SIM એટલે "Embedded Subscriber Identity Module." તમારે ટેલિકોમ ઓપરેટર નું સીમકાર્ડ અલગથી ખરીદવાની જરૂર નથી અને તેને તમારા મોબાઇલમાં દાખલ કરવાની પણ જરૂર નથી.ઇ-સિમ (e-SIM) તમારા સ્માર્ટફોનના હાર્ડવેરનો એક ભાગ છે. આ ઇ-સિમ ચિપ તમારા સ્માર્ટફોન પર પ્રી-ઇન્સ્ટોલ કરેલી હોય છે.તેનું કામ આપણા સામાન્ય સિમ જેવું જ હોય છે જે IMSI નંબર, કેટલીક સંપર્ક વિગતો (contact numbers) જેવી માહિતીને સાચવે છે.ઇ-સિમ ફરીથી લખી શકાય તેવું હોય છે. અગાઉના ટેલિકોમ ઓપરેટરને લગતી વિગતો erase કરી શકાય છે અને નવી ટેલિકોમ ઓપરેટર દ્વારા નવી માહિતી ફરીથી લખી શકાય છે.

આ પ્રકારની છેતરપિંડી તમારા બેંક એકાઉન્ટ્સને સેકંડમાં ખાલી કરી શકે છે. આ ઇ-સિમ છેતરપિંડીનું કૌભાંડ હાલના સમયમાં સમગ્ર ભારતમાં ફેલાવાનું શરૂ થયું છે.ઇ-સિમ રેકેટના સંબંધમાં પાંચ લોકોની ધરપકડ કરવામાં આવી છે. પોલીસને આશંકા છે કે તેઓ પંજાબ, ઝારખંડ, હરિયાણા, પશ્ચિમ બંગાળ,તેલંગાણા અને બિહાર આજુબાજુની 300 થી વધુ રાષ્ટ્રીયકૃત અને ખાનગી બેંક access ધરાવે છે.

શું તમે જાણો છો ઇ-સિમ ફ્રોડ કરનારાઓ કયા પ્રકાર ની યુક્તિઓનો ઉપયોગ કરે છે?

નીચે લેખમાં INDIATV સમાચાર દ્વારા સમજાવાયેલ ઇ-સિમ ફ્રોડ રેકેટની કાર્યપ્રણાલી છે.

જામતારાના છેતરપિંડી કરનારાઓ પહેલા મોબાઈલ નંબરની શ્રેણી (mobile number series) એકઠા કરે છે. પછી આ fraud message મોકલે છે "KYC વિગતો અપડેટ નહીં થાય તો તમારું કાર્ડ 24 કલાકમાં block કરવામાં આવશે."
પછી તેઓ ઇ-સિમ સેવા પૂરી પાડતા કોઈપણ ટેલિકોમ ઓપરેટર ની customer care એક્ઝિક્યુટિવ તરીકે કોલ દ્વારા તેમનો સંપર્ક કરે છે.ભારતમાં, તે મુખ્યત્વે એરટેલ છે.
ત્યારબાદ Users ને તે ચોક્કસ ટેલિકોમ ઓપરેટર customer care ની ઇમેઇલ (છેતરપિંડી કરનારાઓ દ્વારા મોકલેલ) ફોરવર્ડ કરવાનું કહેવામાં આવે છે.
ઇમેઇલ આઈડી સ્કેમર્સની હોય છે જેથી તેઓ Users ની બેંક માહિતીને access કરવા માટે મેઇલ આઈડી ની નોંધણી કરાવી શકે.
એકવાર સંદેશ મોકલ્યા પછી, ઇ-સિમ સંબંધિત auto generated message પ્રાપ્ત થાય છે. પછી બીજો message પ્રાપ્ત થાય છે જેમાં KYC અપડેટ કરવા માટે વિગતો ભરવા માટે Google ફોર્મની લિંક હોય છે.
એકવાર Users તેમની વિગતો ભરો જેમાં બેંક એકાઉન્ટ નંબર શામેલ હોય છે. પછી એક QR કોડ ઇમેઇલ દ્વારા મોકલવામાં આવે છે એટલે ઇ-સિમ active થાય છે અને સામાન્ય સિમ block થતાં છેતરપિંડી કરનારાઓ e-SIM દ્વારા phone number નો access મેળવે છે.

આ રીતે, સ્કેમર્સ ફોન નંબરનો ઉપયોગ ઓટીપી મેળવવા માટે કરી શકે છે અને લોકો પાસેથી પૈસા ચોરી કરવા માટે e-wallet માં બેંકની વિગતો દાખલ કરી શકે છે.

ઇ-સિમ છેતરપિંડી સાથે સંબંધિત તાજેતરના કેસો:

ભારતમાં લોકો ઇ-સિમ વિશે જાગૃત નથી, અને છેતરપિંડી કરનારાઓ તેનો લાભ લઈ રહ્યા છે.સ્કેમર્સ સામાન્ય સિમ (જે પીડિતાના મોબાઇલ ડિવાઇસમાં હાજર હોય છે) તે જ નંબરના e-SIM સાથે (જે સ્કેમર્સ ના મોબાઇલ ડિવાઇસમાં હાજર હશે) તેની અદલાબદલ કરી રહ્યા છે.

હૈદરાબાદના સાયબર સેલને 14/07/2020 થી 22/7/2020 દરમિયાન એ જ પ્રકારની છેતરપિંડી અંગે ત્રણ ફરિયાદો મળી છે.બધા કિસ્સાઓમાં કાર્યપ્રણાલી સમાન છે.અંતે, પીડિતાને એરટેલ સીમકાર્ડનો એક auto-generated કરેલો સંદેશ મળ્યો અને સીમકાર્ડ block થઈ ગયો અને ₹ 9, 20,897/- ની રકમ તેના બેંક ખાતામાંથી કાપવામાં આવી હતી. આ જ પ્રકારના બે કેસ એક જ મહિનામાં બન્યા હતા જ્યાં પીડિતોના ખાતામાંથી ₹ 5,94,799/- અને ₹1,03,990/- ની રકમ કાપવામાં આવી હતી. તેથી, પીડિતોએ પોલીસને જરૂરી કાર્યવાહી કરવા વિનંતી કરી હતી.

ઇ-સિમ કૌભાંડથી સુરક્ષિત કેવી રીતે રહેવું?

કોઈપણ fraud સંદેશાઓ પર વિશ્વાસ ન કરો. જ્યાં સુધી તમે તમારા સીમને ઇ-સિમમાં રૂપાંતરિત કરવાની વિનંતી ન કરો ત્યાં સુધી ટેલિકોમ કંપનીઓ આવા સંદેશા ક્યારેય મોકલતા નથી.
Google ફોર્મ્સ દ્વારા અથવા કોલ્સ દ્વારા ક્યારેય બેંક વિગતો, પાસવર્ડ્સ સબમિટ કરશો નહીં.
જો કોઈ તમને KYC વિગતો વિશે પૂછવા અથવા તેને અપડેટ કરવા માટે કહે છે, તો કોઈ વિગતો આપશો નહીં.
auto-generated ઇમેઇલ્સ અને સંદેશાઓ કાળજીપૂર્વક વાંચો.
જો KYC માં કોઈ અપડેટ્સ અથવા ફેરફારો કરવાના હોય, તો નજીકની સ્ટોરની મુલાકાત લો.
Any Desk અથવા Team Viewer એપ્લિકેશનો દ્વારા તમારી કમ્પ્યુટર સ્ક્રીન અથવા મોબાઇલ સ્ક્રીન અજાણ્યા વ્યક્તિ સાથે ક્યારેય શેર કરશો નહીં.
છેતરપિંડી કરનારાઓ દ્વારા સૂચવેલ કોઈપણ ઇમેઇલ્સ અથવા સંદેશાઓ ફોરવર્ડ કરશો નહીં. જો તમને લાગે કે તે કોઈ કૌભાંડ અથવા શંકાસ્પદ પ્રવૃત્તિ છે, તો ગ્રાહક સંભાળનો સંપર્ક કરો અને ઇ-સિમ activation પ્રક્રિયાને રોકવા માટે 121 પર "NO SIM" મોકલો.

આ લેખ પાછળ નો ઉદ્દેશ જાગૃતિ ફેલાવાનો છે . દિવસે દિવસે સાઈબર ક્રિમીનલસ ખૂબ જ સ્માર્ટ બની રહ્યા છે .લોકો ને મૂર્ખ બનાવવા માટે તેઓ અવાર નવાર નવા નવા આઈડિયાઓનો ઉપયોગ કરે છે. તમે પણ આવા બનાવોનો ભોગ ન બનો તેથી તમને આ પ્રકારના ફ્રોડ ની માહિતી હોવી ખૂબ જરૂરી છે.તો સાવધાન રહો અને બીજા ને પણ આવા ફ્રોડ વિશે માહિતી આપતા રહો.

e-SIM fraud : All you need to know about e-SIM and SIM swapping fraud

2020-10-04T18:34:00.004+05:30

Awareness is necessity

Ever heard about the place, Jamtara? Many of you must have seen the famous series "Jamtara: Sab ka number ayega" on Netflix. It is located near Jharkhand's capital Ranchi. This place has become a hub for phishing and bank fraud.

Recently, Jamtara has come in the limelight because this place's fraudsters have started a new type of crime/ fraud, i.e. e-SIM fraud.

Do you know what eSIM is?

e-SIM stands for the "Embedded Subscriber Identity Module." You don't need to buy a telecom operator's SIM card separately and insert it into your mobile. e-SIM is a part of your smartphone's hardware. This e-SIM chip comes pre-installed on your smartphone. Its working is the same as our standard SIM, which saves information like IMSI number, some contact details etc. e-SIM is re-writable means previous telecom operator related details can be erased and new information can be written again by a new telecom operator.

This type of fraud can empty your bank accounts in seconds. This e-SIM fraud racket has started to spread all over India in recent times. Five people have been arrested in connection with the e-SIM racket. Police have suspected that they have access to over 300 nationalized and private bank around Punjab, Jharkhand, Haryana, West Bengal, Telangana and Bihar.

What are the tricks used by fraudsters to attack?

Below is the modus operandi of the e-SIM fraud racket explained by INDIATV news in their article.

Jamtara's fraudsters first collect a series of mobile numbers. Then these thugs send a message stating that "your card will be blocked in 24hours if KYC details are not updated."
Then they contact them via call imposing as customer care executive of any telecom operator that provides e-SIM service. In India, it is mainly airtel.
Users are then asked to forward an email ID (sent by the fraudsters) to that particular telecom operator's customer care.
The email ID belongs to the scammers so that they can register their email IDs to access the user's bank information. Once the message is sent, an auto-generated message is received regarding the e-SIM activation.
Then another message is received containing a link to a Google form asking users to fill in details for the KYC updating. Once users fill in their details that include the bank account number.
The e-SIM is activated, and a QR code is sent to the fraudsters (via email) to access the user's phone number as the physical SIM card gets blocked.

This way, the scammers can use the phone number to get OTPs and enter the banking details in e-wallets to steal money from people.

Recent cases related to e-SIM swapping fraud

In India, people aren't aware of e-SIM, and fraudsters are taking advantage of this. The scammers are swapping the physical SIM which is present in the victim's mobile device with eSIM of the same number that will be with scammers.

The cyber cell of Hyderabad has received more than three complaints received between 14/07/2020 to 22/7/2020 regarding the same type of fraud. Modus Operandi is the same in all cases. At last, the victim received an auto-generated message from Airtel SIM card got blocked, and an amount of Rs.9, 20,897/- has been deducted from his bank accounts. Similar kinds of two cases occurred in the same month where the amount of Rs.5, 94,799/- and Rs.1, 03,990/- were deducted from the victims' accounts. Hence, the victims have requested the police to take necessary action.

How to stay safe from eSIM scam?

Don't believe any fraudulent messages. Telecom companies never send such messages until you have requested to convert your SIM to e-SIM.
Never submit bank details, passwords through Google forms or over calls.
If someone calls you to ask about KYC details or update it, DO NOT give any details.
Read auto-generated emails and messages carefully.
If any updates or changes are to be done in KYC, visit the nearby store.
Never share your computer screen or mobile screen with unknown by using Any desk or Team Viewer applications.
DO NOT forward any emails or messages as instructed by the fraudsters. If you feel it is any scam or suspicious activity, contact the customer care and send "NO SIM" to 121 to stop the e-SIM activation process.

So the motive behind this article is to spread awareness about this kind of eSIM scams. As cybercriminals are becoming very smart day by day, they are using new ideas to make people fool.

Do you know, by blindly following trends and using hashtags you can be the victim of cyber crime? : #couplechallenge

2020-09-29T19:09:00.008+05:30

Awareness is necessity

"Nohashtag challenges"

Nowadays, #couplechallenge, #smilechallenge, #chirichchallenge trending on social media platforms. But do you know the history of hashtags?

Lets see, how hashtag was invented.

Chris Messina a product designer who has been working in Silicon Valley created the idea of hashtag. He and his small group of colleagues were thinking that twitter needs some kind of frame work. He got the idea of hashtag from internet chat room that had pound symbol in front of them.

His main idea to create hashtag was for the internet and wanted that anybody writing text on internet be able to participate in global conversation. In 2007, he asked one of his friends to use #sandiego for his tweets and this way the use of hashtag started.

In 2009, Twitter added the option of hashtag to its search bar. And this way hashtag became a trend. This trend then being followed by other apps like tumbler, Facebook, instagram and other social media platform.

Initially hashtags were used for global conversations, trending topics and other important conversations. But in recent scenarios, hashtags are widely used for challenges like #couplechallenge, #smilechallenge, #chirichchallange and many more. Most people are blindly following the trend and posting their photos on social media platform.

But do you know by blindly following such trends and using hashtags you can be the victim of cyber crime?

In a recent case in Delhi, a man morphed a women’s photo to malign/deteriorate her image likely because of her political connections.

Morphing is basically smooth changes made in images using computer animation techniques.

Becareful about your social media posting !!

If you are using hashtags and posting your pictures on social media platform then you are more prone to crime related to morphing. For example, we post a picture with #couplechallange and social media privacy setting is set to private or just friends. We feel that it is shared just with our friends. But when we use hashtag it is not private anymore. Whenever anyone writes #couplechallange in the search box he/she can easily get access to your photos even if they are not in your friend list.

So what we conclude from this is that don’t ever blindly follow such trends. And even if you want to post your pictures keep your account private and don’t use hashtags.

શું તમે જાણો છો કે હેશટેગ્સ #couplechallenge નો ઉપયોગ કરીને, તમે સાયબર ક્રાઇમનો ભોગ બની શકો છો?

2020-09-29T19:07:00.009+05:30

Awareness is necessity

"Nohashtag challenges"

આજકાલ, સોશિયલ મીડિયા પ્લેટફોર્મ પર #couplechallenge, #smilechalenlenge, #chirichchallenge ટ્રેંડિંગ છે. પરંતુ શું તમે હેશટેગ્સનો ઇતિહાસ જાણો છો?

ચાલો પહેલા જોઈએ કે #hashtag ની શોધ કેવી રીતે થઈ.

સિલિકોન વેલીમાં કામ કરતા પ્રોડકટ ડિઝાઇનર ક્રિસ મેસિના એ હેશટેગનો આઈડિયા બનાવ્યો હતો.તે અને તેના કર્મચારીઓ મિત્રો વિચારી રહ્યા હતા કે ટ્વિટરને કેટલાક માળખાની જરૂર છે.તેને સામે પાઉન્ડ સિમ્બોલ હતું તેમાંથી હેશટેગ કન્સેપ્ટ મળ્યો.હેશટેગ બનાવવાનો તેમનો મુખ્ય વિચાર ઇન્ટરનેટનો હતો, અને ઈચ્છતા હતા કે વૈશ્વિક વાર્તાલાપમાં ભાગ લેવા ઇન્ટરનેટ પર કોઈપણ લખાણ લખે.

2007 માં, તેણે તેના એક મિત્રને તેના tweet માટે #sandiego નો ઉપયોગ કરવા કહ્યું અને આ રીતે, હેશટેગનો ઉપયોગ શરૂ થયો.

2009 માં, ટ્વિટરે તેના સર્ચ બારમાં હેશટેગનો વિકલ્પ ઉમેર્યો. અને આ રીતે, હેશટેગ એક વલણ બની હતી. આ વલણ પછી અન્ય એપ્લિકેશન્સ જેવી કે ટમ્બલર, ફેસબુક, ઇન્સ્ટાગ્રામ અને અન્ય social media પ્લેટફોર્મ સુધી વિસ્તરિત થયો હતો.

શરૂઆતમાં, હેશટેગ્સનો ઉપયોગ વૈશ્વિક વાર્તાલાપ, ટ્રેંડિંગ વિષયો અને અન્ય અર્થપૂર્ણ વાર્તાલાપ માટે થતો હતો. પરંતુ હાલના સંજોગોમાં, હેશટેગ્સનો ઉપયોગ #couplechallenge, #smilechallenge,#chirichchallenge અને ઘણા #challenges માટે વ્યાપકપણે થાય છે. મોટાભાગના લોકો તેને અનુસરી રહ્યા છે અને સોશિયલ મીડિયા પ્લેટફોર્મ પર તેમના ફોટા પોસ્ટ કરી રહ્યા છે.

પરંતુ શું તમે જાણો છો કે આ પ્રકારના હેશટેગ્સનો ઉપયોગ કરીને, તમે સાયબર ક્રાઇમનો ભોગ બની શકો છો?

દિલ્હીના તાજેતરના કેસમાં, એક વ્યક્તિએ મહિલા ના રાજકારણમાં તેની પ્રતિષ્ઠા બગાડવા ફોટાને મોર્ફ કરી દીધા હતા.

મોર્ફિંગ(Morphing) એ કમ્પ્યુટર એનિમેશન તકનીકનો ઉપયોગ કરીને છબીઓમાં કરવામાં આવેલા સરળ ફેરફારો છે.

તમારી સોશિયલ મીડિયા પોસ્ટિંગ વિશે સાવચેત રહો !!

જો તમે #hashtags નો ઉપયોગ કરી રહ્યાં છો અને સોશિયલ મીડિયા પ્લેટફોર્મ પર તમારા photos પોસ્ટ કરી રહ્યાં છો, તો તમે મોર્ફિંગથી સંબંધિત ગુનાઓ માટે વધુ સંવેદનશીલ છો. ઉદાહરણ તરીકે, આપણે #couplechallange સાથે એક photo પોસ્ટ કરીએ છીએ અને સોશિયલ મીડિયા privacy setting only Me અથવા only friends પર સેટ છે. પરંતુ જ્યારે આપણે હેશટેગનો ઉપયોગ કરીએ છીએ, તે હવે ખાનગી નથી. ફેસબુકમાં #couplechallenge લખીને કોઈપણ તમારા ફોટા જોઈ શકે છે.જ્યારે કોઈ પણ #couplechallange લખે છે, ત્યારે તે તમારા ફોટાની સૂચિમાં ન હોય તો પણ તે ઝડપથી તમારા ફોટાઓ ના access મેળવી શકે છે.

તેથી આપણે આ બ્લોગમાંથી જે શીખી રહ્યાં છે તે છે કે આવા વલણોને આંધળાઈથી ક્યારેય અનુસરો નહીં . અને જો તમે તમારી photo પોસ્ટ કરવા માંગતા હોવ તો પણ તમારું એકાઉન્ટ ખાનગી રાખો અને હેશટેગ્સ(#) નો ઉપયોગ ન કરો.

OLX fraud : Beware of this new fraud/scam of 'Army men'

2020-09-25T16:35:00.004+05:30

Awareness is necessity

Nowadays, OLX related frauds are increasing, such as share OLX password/OTP, QR code scams, Paytm link scam etc. The most occurring cases are related to Army personnel.

Instead of writing all the things, it will be better to watch the video by a YouTuber, Mr. Rohit R Gaba and lets see How fraudster makes fools to people as Army personnel.

Here, in the video, the fraudster talked about QR code. Let's understand what a QR code is and how fraud can be occurred by QR code.

QR code (Quick Response code), We can store so much information within it in text form.

I made one QR code that stores information such as a person's name, aadhar card number, etc. We can store any data with the QR code. Same fraudster store bank details and malicious code so that when you scan that QR code, the money will be debit from the account directly.

How to protect ourselves from online OLX frauds?

Always prefer face to face meetings with buyers or sellers and choose a safe location for the meeting.
You should know about UPI scams, OTP frauds, Paytm link scam. Choose safe payment methods. Because if we make any mistake, then we can not blame the bank.
Don't share your personal details or bank details with someone or in chat conversations. If needed, then always share true copied documents with others.
Sometimes it happens that they are sending fake IDs in chat conversations. Prefer to verify ID face to face then confirms the deal.

What to do if OLX fraud occurred?

Contact your nearest cyber cell or local crime branch and register a complaint.
Do report at the OLX help centre also. You can mail at safety@olx.in or call on their help centre contact number.
Keep all relevant information handy to support your case, such as chat conversations, payment transaction proofs, call recordings etc.

Contact details of Gujarat Police

Save your district crime branch number on your mobile.

Sr no.	District Name	Contact No
1	Ahmedabad	(O) 079-25633636
2	Amreli	(O) 02792-222333
3	Anand	(O) 02692-260027
4	Aravalli	--
5	Banaskantha	(O) 02742-257015
6	Bharuch	(O) 02642-223303
7	Bhavnagar	(O) 0278-2520050
8	Botad	(O) 02849-251416
9	Chhota Udepur	--
10	Dahod	(O) 02673-222300
11	Dang	(O) 02631-220248
12	Devbhoomi Dwarka	--
13	Gandhinagar	(O) 23210901
14	Gir Somnath	--
15	Jamnagar	(O) 0288-2554203
16	Junagadh	(O) 0285-2635633
17	Kutch	(O) 02832-250960
18	Kheda	(O) 0268-2550250
19	Mahisaga	--
20	Mehsana	--
21	Morbi	--
22	Narmada	(O) 02640-222167
23	Navsari	(O) 02637-245333
24	Panchmahal	(O) 02672-242200
25	Patan	--
26	Porbandar	(O) 0286-2211222
27	Rajkot	(O) 0281-2459888
28	Sabarkantha	(O) 02772-247333
29	Surat	(O) 0261-2651831
30	Surendranagar	(O) 02752-282100
31	Tapi	--
32	Vadodara	(O) 0265-2431414,(O) 0265-2431515
33	Valsad	(O) 02632-254222

So the motive behind this article is to spread awareness about this kind of OLX frauds. As cybercriminals are becoming very smart day by day, they are using new ideas to make people fool.