BeyondTrust warns of critical flaws in remote access software

BeyondTrust warned customers to patch two critical security flaws in its Remote Support (RS) and Privileged Remote Access ...
GitHub

Splunk SOC Investigation: Suspicious Login and PowerShell Activity

This project simulates a Tier 1 SOC investigation using Splunk. The investigation focuses on a high-severity alert involving suspicious login activity, obfuscated PowerShell execution, and outbound ...
GitHub

Powershell script to block IP addresses after multiple failed logon attempts.

The main script is Update-FirewallRule.ps1. It checks for Event ID 4625 entries in Windows Security logs and adds a blocking rule in Windows Firewall for every IP address with 10 or more failed logons ...