Two sentences summarize the shift from pre-trained AI-SOC to continuously learning, analyst-driven AI that evolves with local context. The article outlines how feedback loops, transparency, usability, and measurable metrics transform SOCs into adaptive, explainable systems that reduce false positives and improve detection and response.
#ShaharBenHador #RadiantSecurity
This article explains how simple file upload features can turn into dangerous vulnerabilities, leading to complete server takeovers. It highlights common mistakes in validation mechanisms, real-world exploitation scenarios, and the importance of understanding server behavior and bypassing techniques. #WebShells #PathTraversal
This article describes a comprehensive two-week network penetration testing challenge involving multiple exploitation techniques to retrieve four flags from target hosts. It covers methods including SMB share access, web application vulnerabilities, SSH pivoting, port knocking, and privilege escalation leveraging CVE-2025-32463. #SilentFootprint #WebRCE #SMBShare #CVECVE-2025-32463
The article describes exploiting SQL injection vulnerabilities in a database application called Light by injecting payloads through the username field. It illustrates the process of bypassing filtering mechanisms and successfully retrieving database information using UNION-based attacks. #SQLInjection #LightDatabase
This article covers the importance of reconnaissance, vulnerability assessment, and patch management in cybersecurity. It emphasizes the role of tools like Nmap and Metasploit in discovering and exploiting vulnerabilities such as EternalBlue, along with effective patching strategies to mitigate risks. #EternalBlue #MS17-010
This article explores the critical importance of detecting lateral movement within internal networks after initial intrusion, focusing on internal devices like routers, printers, and IoT devices. It emphasizes monitoring for suspicious connections to high-risk countries and internal endpoints to prevent escalation and exfiltration activities. #CyberThreatHunting #InternalNetworkSecurity
GrapheneOS is a security-focused operating system that enhances privacy by isolating apps and controlling permissions. Proper setup of privacy and security features is essential to create a safe digital environment on your device. #GrapheneOS #PrivacyProtection
This article highlights the features and installation process of GrapheneOS, a privacy-focused operating system for Pixel devices, emphasizing enhanced security and user control. It details step-by-step instructions to install GrapheneOS, reinforcing the importance of privacy in today’s digital world. #GrapheneOS #PixelDevices
This article highlights the malicious use of the Windows utility auditpol.exe by attackers to disable and hide security audits and forensic traces. Monitoring and detecting unauthorized execution of auditpol can serve as a crucial early warning for security threats. #AuditpolMisuse #SecurityAuditing
This article provides an in-depth analysis of Wmiexec-Pro, a sophisticated WMI/DCOM-based post-exploitation tool that avoids traditional process creation methods. It highlights detection opportunities and technical modules, emphasizing WMI-centric telemetry and registry monitoring techniques. #WmiexecPro #WMIThreats
AI-SOC platforms automate triage, correlation, and enrichment to handle large alert volumes, enabling machine-speed operations and a sustainable hybrid SOC with human oversight. The article argues for a co-managed transition where AI handles scale and speed while humans provide context, accountability, and ROI-focused paths for MSSPs and MDRs. #RadiantSecurity #AI_SOC #MSSP #MDR #PagerDuty
Browser security has become essential as the browser handles proprietary data, credentials, and workflows in modern enterprise environments. Legacy tools like firewalls and EDR are no longer sufficient to defend the new browser-centric attack surface.
OAuth is a widely used standard for authentication and authorization but remains vulnerable due to misconfigurations and clever exploitation in real-world scenarios. Attackers often leverage redirect URI manipulation, rogue applications, token leakage, and session misuse to bypass MFA and gain long-term access. #AzureActiveDirectory #OAuthExploits
This article explains how WMI event subscriptions are used by attackers for stealthy persistence on Windows systems. It provides techniques to simulate, detect, and hunt for malicious WMI artifacts using tools like Sysmon, ELK stack, and Osquery. #WMIeventSubscriptions #AtomicRedTeam
This article discusses NetExec (NXC), a versatile file transfer tool that consolidates multiple protocols like SSH, FTP, NFS, and MS-SQL to facilitate lateral movement and data exfiltration during pentests and cyber operations. It highlights how misconfigurations of these services can pose significant security risks and emphasizes the importance of proper security measures and monitoring. #NetExec #FileTransfer #Pentesting #NFS #MS-SQL #SSH #FTP