Day 43 of Becoming a SOC Analyst | CVE-2023-29357 SharePoint Auth Bypass — Did I Catch It? скачать в хорошем качестве

Day 43 of Becoming a SOC Analyst | CVE-2023-29357 SharePoint Auth Bypass — Did I Catch It?

Day 43 of Becoming a SOC Analyst — CVE-2023-29357 SharePoint Privilege Escalation (True Positive) Critical alert — CVSS 9.8. An external IP geolocated to China sent crafted HTTP requests to a SharePoint REST API endpoint using a python-requests user agent, bypassing authentication and successfully interacting with the SharePoint API. Walked through traffic direction analysis, exploitation confirmation via HTTP 200 response, MITRE mapping (T1190 & T1068), escalation decision, and full containment response including server isolation and forensic handoff. Scenario sourced from LetsDefend.io — one of the best hands-on SOC analyst training platforms out there. Highly recommend if you're on the same path. I'm documenting every day of my journey to landing a Level 1 SOC Analyst role — the wins, the grinds, and everything in between. 🔵 What I Cover Threat Detection · Alert Triage · SIEM Analysis · PCAP Review · Incident Response · Blue Team Tools 🚨 Open to Work — Seeking a Level 1 SOC Analyst role in Melbourne or Remote (AU) 📂 Portfolio → inksec.io 💼 LinkedIn → linkedin.com/in/tate-pannam-8b64b23a3 If you chose the red pill... 0x74617465.sh Tags: #SOCAnalyst #BlueTeam #Cybersecurity #SharePoint #CVE20230357 #PrivilegeEscalation #IncidentResponse #SIEM #Day44 #CyberSecurityJourney #Melbourne #LetsDefend #LetsDefendSOC