r/netsecstudents

So this is another case study, where I break down actual detections/alerts which I investigate as a Threat Analyst.

The event started with Event 4769: TGS request, but the timestamp looked off. Source was a host I didn't recognize(unmanaged in XDR), and it was asking for tickets on service accounts nobody should be doing so.

Now this attack would help you understand why Kerberos is both good and bad at the same time.

The flow for the attack is that attacker enumerates service accounts using GetUserSPNs or SharpHound. Then gets the SPNs. Then requests TGS tickets for those accounts without needing admin access. Events 4769 shows up as RC4 encryption (Event Code 0x17). If you miss this, it looks like normal Kerberos traffic. But...It's not.

Then attackers can take those tickets offline and crack the password. Once they have the service account password, they can logon (Event 4624) with explicit credentials (Event 4648, typing username/pass manually). This is where I caught mine. New service account logon from a source that had no usage being there, this was not a normal behaviour.

But thing is that by the time I found that, stuff got bad and attacker already escalated to a privileged account (4672), dumped credentials with Mimikatz, and now I was checking for lateral movement. I found process creation events (4688) for PowerView. They were enumerating shares. Then came the DCSync attempts (4662).

That's when I knew the domain was probably already theirs. And its time to take response actions fast.

I isolated the host, disabled the compromised accounts, reset service account passwords, and started hunting more afterwards. Turns out they'd already set up persistence with a golden ticket. The KRBTGT needed to be reset twice.

The reason I'm posting this is that most writeups show you the attack flow and the queries. They don't show you what it actually feels like when you're running these queries in real time, when you know something is wrong but you're not sure how deep it goes yet.

If you're studying for SOC or breaking into security, you need to see this happen live. Not in a lab. In real events, real queries, real pressure.

P.S: Thank you for loving my last case study on GTA 6. Appreciate your love!

I'm just finishing up a lab simulating an Enterprise network in Packet Tracer with basic CCNA topics such as STP, HSRP, EtherChannel, OSPF, Layer 2 Edge Port Security, etc.

In my current job in Help Desk, I get to configure SonicWall ACLs, set up VLANs, and maintain firewalls using SonicWall's NSM. Our setup is very rough though as we don't have a Syslog server and the MSP doesn't care too much about network security.

I want to focus heavily on Network Security for my next lab, but I know it'll be near impossible to use enterprise-grade devices in GNS3/EVE-NG as they require licenses and I'm broke. Are there strong and fairly similar alternatives I could use?

I know LeetCode is the go-to platform for coding practice, but what's the cybersecurity equivalent?

I'm looking for something where I can consistently practice and improve my skills through hands-on challenges—not just learn theory. Ideally, I'd like a platform that helps build real-world problem-solving skills, similar to how LeetCode does for programming.

What platforms do you recommend, and why?

Hi everyone,

I’m a Computer Engineering student from Italy. I’m really fascinated by cybersecurity and my goal is to pursue a Master’s Degree in Cybersecurity after completing my bachelor's.

Right now, the field feels so massive that I’m facing severe "analysis paralysis." I honestly don't know where to practically start putting my hands on things without getting lost. Also, since my current university exams are demanding, I am looking for something I can do as a side activity—practical, manageable micro-goals that won't interfere with or hurt my current college workload.

Here is my background so far:

• Through my engineering studies, I have a solid understanding of computer science fundamentals.
• I have already read some books/guides regarding Linux basics for hackers.
• I recently discovered platforms like TryHackMe and checked out resources like CTFtime and TJnull's OSCP preparation guide.

Given my background and my goal of not burning out before the Master's degree, what are the best immediate, practical next steps? Should I just slowly grind the Pre-Security path on TryHackMe during my free time, or is there a better route for someone in my position?

Thanks in advance for any advice!

Hi everyone,

I'm a recent Computer Science graduate and I'm interested in building a career in cybersecurity. After doing some research, I've narrowed my interests down to two areas: Penetration Testing and Digital Forensics & Incident Response (DFIR).

I'm having trouble deciding which path to focus on, so I'd appreciate advice from people working in these fields.

Here are my questions:

• Which field is more realistic for a fresher to break into?
• Which has better long-term career growth?
• What skills should I focus on learning first?
• Which certifications are actually valuable for beginners?
• If you were starting your cybersecurity career today, which path would you choose and why?

I'd really appreciate any advice or personal experiences. Thank you!

Hi everyone,

Wazuh, Sysmon, and alert analysis . I received an alert that I'm trying to understand better and would appreciate guidance on how an analyst would investigate it.

The Wazuh rule triggered:

Rule ID: 92213
Description: "Executable file dropped in folder commonly used by malware (Lowered Severity)"
MITRE: T1105 – Ingress Tool Transfer

Important details:

• Process: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
• File created: C:\Users\someone\AppData\Local\Temp\__PSScriptPolicyTest_cebr0opm.pas.ps1
• Sysmon Event ID: 11 (File Create)

What confuses me is the filename:

__PSScriptPolicyTest_*.ps1

I found some information suggesting PowerShell can create temporary files while checking execution policies, but I’m not sure whether this should be considered suspicious behavior or expected activity.

My questions:

1. Would you classify this as a true positive or false positive?
2. What would be your first investigation steps?
3. Which additional logs or Sysmon events would you pivot to?
4. Does the MITRE mapping make sense here, or could this be a generic detection generating noise?

I'm trying to learn the investigation methodology and analyst thought process rather than just getting the answer.

Thanks!

I'm looking for an actual useful project for a soc analyst role, I got into the filed 6 months ago, started with pen testing it was fun but I prefer programming defensive tools in general, I'm familiar with every concept pretty much, I'm heavily specialized in network security ( proxies , firewalls, bridges, rule configuration...etc) , and web-client , web- sever, I really enjoy forensics too with volatility and autopsy,

I consider myself an amateur, I've been doing this as a side thing for some time since I'm a computer science student in my second year , since it's summer break I decided to hone my cyber security skills even further.

I'd be absolutely delighted to hear your suggestions, I'm willing to have a good CV for my masters degree ( that's how it works in France 😄)

Thanks for reading this far , have a wonderful day:)

Hi everyone,

I'm a self-taught learner aiming for a cybersecurity internship, preferably in low-level security, AppSec, or security research. I've been learning on my own for several months, but I'm not sure if I'm focusing on the right things.

So far I've learned:

Skills

• C Programming
• Memory Management
• Linux
• Debugging
• Fuzzing
• Crash Triage & Root Cause Analysis
• Reverse Engineering (Basic)
• Binary Analysis (Basic)
• Secure Coding
• Git

Tools

• GDB
• Ghidra
• AddressSanitizer (ASan)
• Valgrind
• AFL++
• libFuzzer
• GCC/Clang
• Make/CMake

I've spent most of my time building small projects, writing fuzzing harnesses, analyzing crashes, and trying to understand memory corruption bugs. Everything I've learned has been through documentation, open-source code, and hands-on practice.

My biggest problem is that I don't have much to prove my skills. I don't have internship experience, CVEs, CTF rankings, or significant open-source contributions yet.

If you were in my position, what would you do next?

• Which internship roles should I target with my current skills?
• What skills or projects would make the biggest difference to employers?
• Should I spend my time on CTFs, finding real bugs, open-source contributions, technical blogs, or something else?
• What would make you think, "I'd interview this person"?

I'm looking for honest feedback. If you think I'm missing something important or going in the wrong direction, I'd really appreciate hearing it.

Thanks!

Beginner's Cybersecurity Learning Journey

Starting Cybersecurity and Future Aspirations

• I just completed my first TryHackMe certificate (Pre Security), and I'm really happy to have taken the first step into cybersecurity.

• I'm still a complete beginner and want to build a strong foundation.

• My goal is to eventually get into ethical hacking/penetration testing, but I'm not sure what the best next step is.

Exploring Next Learning Steps

• Should I:

• Continue with another TryHackMe learning path?

• Focus more on Linux and networking first?

• Start doing CTFs?

• Learn Python alongside TryHackMe?

Seeking Guidance for a Solid Foundation

• I'd really appreciate any roadmap or advice from people who've been in the same position.

• I want to learn the right way instead of rushing through certificates.

• Thanks in advance! 😊

https://preview.redd.it/j6pmwtoc79ah1.png?width=1080&format=png&auto=webp&s=a7ccfed86ad2b299c2304b3af162d142ab95f052

You learn this stuff by doing. Reading slideshows and memorizing flashcards is only half the struggle.

This site has 100 labs that are guided and graded as you go. All in one place ready to go instantly. Like a hyperbolic chamber for networking.

Imagine if Boson or PT had a baby with duolingo/tryhackme

It’s completely free right now. We’re just trying to get honest feedback from the networking community.

Please enjoy! Switchlab.dev

Cyber Apocalypse 2026 is coming up soon. We already have a core team, but we could use a few more people. To be clear: we don't care about your HTB rank. Some of our best guys don't have high ranks at all but they absolutely crush challenges. We only care that you actually have some experience and can solve stuff. Spots are limited, but we can take about ~10 more people. If you think you can deliver and want to join, hit me up!

now enough of college life. they are teaching me to write about kerberos authentication system.

Why is such outdated tech being taught in colleges and universities? What can we do about it? btw, I need to learn it fast. What do you recommend as supplement materials? Stallings book?