Lab
Security notebook
Lab-based work in an isolated environment I own. Each writeup follows the same shape — scenario, topology, what I did, what it left behind in the logs, and how you'd detect or stop it.
2025-05-18 · T1558.003
Service ticket requests, and what they look like in the log
Simulating service ticket abuse in the lab, then working backwards to the Event IDs and query that would catch it.
Windows Server, Active Directory, Sysmon, PowerShell, Wireshark
2025-03-02
OverTheWire Bandit — Linux fundamentals, levels 0–5
A working log of the first six Bandit levels — completed 0 through 5 — framed as the Linux and shell concepts each one drills, not as answers to copy.
Linux, bash, ssh, cat, file, find, ls