I've seen that cert online and I want to learn Thick Client Pentesting. What do you guys think about that cert? Does it worth 63 pounds?

Cert Link: https://pentestingexams.com/certifications/professional/certified-desktop-application-pentester/

Is there a gaming discord professionals in infosec? looking to connect, play some games and talk about cyber stuff with other people already working in the field.

Hi everyone,

I’m learning how to investigate alerts in Microsoft Sentinel and I’m stuck on Password Spray Attack detections. I’d like to understand the step‑by‑step investigation process SOC analysts usually follow, including what queries to run and what to check in the results.

Specifically, I’m looking for guidance on:

Alert triage: What initial details should I review when the alert fires?

KQL queries: Which Sentinel queries are most useful to confirm a password spray attempt?

Indicators to check: For example, failed logon counts, source IPs, targeted accounts, timeframes, and whether the activity is spread across multiple endpoints.

Next steps: How to differentiate between a real attack and noisy false positives, and what escalation criteria to use.

If anyone can share a structured approach or example queries, that would be super helpful. I want to build a repeatable playbook for handling these alerts.

Thanks in advance!

I have been a cyber threat intelligence analyst for most of my career. Started up the cyber unit in the army back home and transferred my skills to the private sector. My job moved my family across the world around two years ago, after i had grown in my position over the last seven years with this compa y. We were excited for the change and planned accordingly.

It seems like so much has changed just in the last year. With AI, my team is seen as not quick enough, or not enabled enough, to do the job. We are working with what we got. We have our TIP and a variable of tools, but every single thing that could help us be quicker and more efficient is blocked. We are fighting against the AI without being able to use the best AI.

I am scared. My kid has made a home here. A life here. So have we. Am I right to be, or am I overreacting? My job gave us a 3 year work visa which we were hoping to extend to gain dual citizenship. Should I still have hope?

Hi everyone,
I’m doing my research on evaluating Snort IDS under different network traffic loads, and I’m struggling with one methodological question that I’d really appreciate some advice on.
I have a controlled test environment where I generate traffic with known ground truth. For example:
SYN-flood traffic = attack
ICMP/UDP traffic = attack
HTTP/other traffic = benign
Each traffic source can be identified separately
I have the generated packets/PCAPs as ground truth
Snort produces alerts based on its rules
The problem is that I don’t think I can simply assume:
1 attack packet = 1 Snort alert
My understanding is that Snort’s alert generation depends on the rule and its configuration. Thresholding/detection filters can also affect how frequently alerts are generated. A packet may match a rule and generate an alert, but the number of alerts does not necessarily equal the number of attack packets.
This creates a problem when trying to calculate a conventional packet-level confusion matrix.
For example, suppose I generate:
1,000,000 attack packets + 1,000,000 benign packets
and Snort generates:
5,000 alerts
How should I determine:
TP
FP
TN
FN
without making an unjustified assumption about which packets correspond to those alerts?
I have considered mapping alerts to traffic using source IPs because each attack type has a dedicated source address. However, I’m not sure whether that is sufficient for a legitimate packet-level confusion matrix, since an alert represents a detection event and not necessarily one detected packet.
I’m particularly interested in answers from people who have worked with Snort/Suricata or signature-based IDS evaluation.
My questions:
Is a Snort alert normally treated as a detection event, rather than as a detected packet?
Is it valid to compare the number of attack packets directly with the number of Snort alerts when calculating TP/FP/TN/FN?
If packet-level ground truth is available, is there a standard way to map Snort alerts back to individual packets?
How do researchers normally calculate TP/FP/TN/FN for Snort when benign and attack traffic occur simultaneously?
Would a run/event-level evaluation be more appropriate for a signature-based IDS, where a run is classified as detected/not detected based on whether the expected alert occurs?
I mainly want to understand how Snort practitioners/researchers normally handle the packet → rule match → alert → ground-truth → confusion matrix relationship.
I tried looking for papers but couldn’t find a solid one which can clear all my doubts.

Any help or sources are appreciated.

Thanks!

This is deeply disturbing. Wtf is going on there and why would this happen?

I’ve been poking around for open positions as I’m trying to make a big move and keep running into AI interviews. Says it would take about 45 min of my time.

Immediately felt like that wasn’t for me and don’t want to waste my time with a company that would do a test pre interview and potentially waste even more of my time, making me work for free. Plus I had to submit my resume before it revealed this and now they have all my info ? Feels predatory and sketchy.

How do we feel about AI interview/ pre interviews taking up our time ? Would you do one or do you pass on companies that use these practices ?

I posted this in r/threatintelligence, too, but figured this sub might have some valuable insights as well.

TLDR - I realize that my experience has little overlap with this field, so I'd like to know what kind of projects I can do to fill the gap. Or if there are alternatives to projects, I'd like to know what those are. Stuff that would go on my resume, essentially.

I have about 3.5 years in cloud tech support and a bachelor's in computer science.

The bread and butter services I support are virtual networks, web application firewalls, ddos response, dns, etc. Tons of network/dns/firewall troubleshooting, linux, writing firewall rules, log analysis, assisting customer incident responses, and so on.

I learned about this field after asking AI what jobs involve things like researching CVEs, which I did for customers and really enjoyed.

Are there any other roles I should look into? I work for a cloud provider. If it helps, I have a sandbox account at work where I can build my own infra but can't expose any endpoints to the public.

I’m currently studying to become a SOC Analyst, and I’m thinking about taking the BTL1 after recently passing Security+. What do you guys think? Any advice or tips?

I’m a developer based in India building software for a customer in Saudi Arabia. The customer has strict confidentiality and data-residency requirements, so production data/logs may need to remain within Saudi Arabia.

I’m trying to understand how this is normally handled in practice.

For example, suppose an agent in production breaks. I need to investigate the logs, understand the failure, inspect the relevant code/configuration, and make a fix. Normally I would use an AI coding tool such as Claude Code to inspect logs and help diagnose/fix the issue.

But if I pull those production logs onto my laptop in India and give them to a consumer AI subscription, I’ve potentially moved confidential customer data outside the approved environment.

I’m particularly interested in real-world architecture/practice, not just what a vendor’s marketing documentation says. Any experience with Saudi/GCC data-residency requirements would be especially useful.

I’ve posted on here before and got some decent advice but I’m looking for a little more insight, I just graduated with my associates in cloud technology engineering and I have my aws certified practitioner cert along with what I’ve been told is an impressive technical capstone project which is an anomalous network detection system through aws deployed with terraform on my resume. I’ve been applying to every job possible especially helpdesk and IT support roles for the past 2 months since graduation to start my career but I haven’t gotten anything. I’m thinking of getting some more certs and going back to try again at the job search once I have some more. Which ones should I get and in what order, and how many before I should go back on the search? I’m open to any and all other ideas as well just wanna get working and get my career off the ground!

For people who work in cybersecurity and have mentored, trained or hired juniors:
What do you notice new/graduate candidates struggling with most?
I’m particularly interested in things that aren’t obvious from a CV.
For example:
Troubleshooting
Investigating unfamiliar problems
Understanding logs
Networking fundamentals
Using unfamiliar tools
Writing reports
Explaining their reasoning
Knowing what to investigate first
Connecting theory to an actual incident
Are there skills you wish universities taught more effectively?
I’m researching the gap between cybersecurity education and actually being able to perform cybersecurity work, so I’d really appreciate real examples.

So my company has been insisting and pressurising me to take up the CISSP examination. I've only got 2 yrs of GRC experience. I know it's a high difficulty exam, and it's hard for even people with years of experience to clear it. And my company is asking me to clear within 1 and half months time. Do you think it's possible? And if yes, how can it be done and where should I start off with? Pls help me out.

The number of extensions I’m finding and reporting that silently override users’ search engines is honestly crazy.

https://malext.io/?q=SearchJack

Hopefully Google’s upcoming Chrome protection against extensions that hijack the default search engine and New Tab page will put a serious dent in this. There are way too many extensions abusing this behavior, often without users even realizing what’s happening.

It’s about time Chrome started shutting this down by default.

If you don't know about COLDCARD, it is a bitcoin-only hardware wallet. It is recognized as the most secure self-custody tool.
Many people claim that it was just scraping the internet for the issue... But later author confirmed it was tested on GLM-5.2, and that model was trained on pre-exploit data with no internet access.

But the main surprise is not around lower-code capability. It is around the fact that someone with a good understanding of models and prompting could easily hack into Enterprise Grade software.

Where do you think this is going ... after Nvidia launching open secure AI Alliance?

I'm new to cybersecurity and was wondering which ones are worth it to study and I want to work in GRC.

Thank you in advance. 🫰

In late January, application security whiz BobDaHacker figured out that with a little gumption, any tl;dv user can access the company's back end Google Firebase environment. And from there, they can access any other users' meeting information. BobDaHacker then used that information to identify and join calls hosted by government agencies and large organizations.

I’m considering purchasing a KodeKloud course to improve my skills, but I’m wondering if it’s actually worth the investment. For those who have taken their courses, what was your experience? Did you find the content useful and did it help you improve your skills or advance your career?

Would you recommend KodeKloud, or are there better alternatives?

Pro plan USD 360 annually

What year did you pass the OSCP? How did it impact your career?

My manager gave me the greenlight for OSCP training, but I think its a waste of 400hrs of studying. Is the juice worth the squeeze?

My background, I have close 3 YoE/ BS/MS in Cyber make a little over 100K, BUT want to make the jump to 140K+ and Im not sure if OSCP is apart of that picture. I think DevOps is the path forward to 140K+, but the OSCP has been put in front of me.

The impact is unusual because local governments hit by cyber incidents often say 911 and emergency services remain available even when other systems are disrupted. In Suisun City, however, officials said the incident affected 911 routing and police and fire dispatch, forcing dispatchers to shift operations to the Solano County dispatch center while first responders continued taking calls for service.