Let’s define Cyber Threat Hunting. It is the proactive process of searching for and identifying malicious activity within a network or system. It is a continuous process that involves using a variety of techniques to detect and respond to threats that may not be known or detected by traditional security solutions. Traditional security solutions are firewalls, SIEMS, Anti-Virus, etc. In this training, we were introduced to the AC Hunter platform and shown its uses in threat hunting and how to go about changing the mindset that seems to be ingrained in security.  If you attend the Simply Cyber Daily Threat Briefs or have conversations around GRC you have probably heard the phrase: “Left and Right of Boom”, meaning before and after and incident, the Boom. Typically, the mindset of security is focused on taking some precautions and preventive steps to secure assets but then that’s where it stops. Threat hunting takes the sensibilities of a Blue Teamer and marries it with the inquisitiveness of a Red Teamer. That means in order to protect something from harm you have to take an active stance and seek out what could/would do you (your data) harm.

Cyber threat hunting is important because it can help organizations to identify and respond to threats before they cause damage. It can also help organizations to improve their overall security posture by identifying vulnerabilities and weaknesses in their systems and networks. There are a variety of different cyber threat hunting techniques that can be used. Some common techniques include:

• Network traffic analysis: This involves analyzing network traffic to identify patterns and anomalies that may be indicative of malicious activity.

• Log analysis: This involves analyzing system and security logs to identify suspicious activity.

• Endpoint detection and response (EDR):  This involves using EDR tools to monitor and respond to threats on endpoints, such as laptops and servers.

• Threat intelligence:  This involves using threat intelligence feeds to identify known threats and vulnerabilities.

Here are some examples of cyber threats that cyber threat hunting can help to detect: 

• Malware:  Malware is malicious software that is designed to damage or disrupt computer systems. Malware can include viruses, worms, Trojans, and ransomware.

• Advanced persistent threats (APTs):  APTs are sophisticated attacks that are designed to gain long-term access to a target system. APTs are often carried out by organized crime groups or nation-states.

• Zero-day attacks: Zero-day attacks are attacks that exploit vulnerabilities in software that are not yet known to the software vendor. Zero-day attacks are often very difficult to detect and defend against.

I’m going to give you a summary of what the AC-Hunter platform is and what it can do, the training is very much worth your time so I will not be giving away too much of the information from within the training but if you are interested in finding out more I will include links to find/sign up for the next training on December 1st 2023 (https://www.activecountermeasures.com/hunt-training/).

AC-Hunter is a network threat hunting platform from Active Countermeasures. It is designed to help organizations identify and respond to threats that may not be detected by traditional security solutions. AC-Hunter works by continuously analyzing network traffic to identify patterns and anomalies that may be indicative of malicious activity.

AC-Hunter uses a variety of techniques to detect threats, including:

• Beacon detection: AC-Hunter can detect C2 beacons, which are signals sent by compromised devices to their C2 servers.

• Connection behavior analysis: AC-Hunter can identify anomalous connection behavior, such as unusual patterns of traffic or connections to known malicious IP addresses.

• Encrypted traffic analysis: AC-Hunter can inspect encrypted traffic for suspicious activity without compromising data privacy or integrity. I’m going to give you a summary of what the AC-Hunter platform is and what it can do, the training is very much worth your time so I will not be giving away too much of the information from within the training but if you are interested in finding out more I will include links to find/sign up for the next training on December 1st 2023 (https://www.activecountermeasures.com/hunt-training/). going to give you a summary of what the AC-Hunter platform is and what it can do, the training is very much worth your time so I will not be giving away too much of the information from within the training but if you are interested in finding out more I will include links to find/sign up for the next training on December 1st 2023 (https://www.activecountermeasures.com/hunt-training/).

AC-Hunter is a powerful tool that can help organizations to improve their security posture and reduce the risk of cyber-attacks. It is easy to use and can be deployed on a variety of platforms, including on-premises, cloud, and hybrid environments. The team at AC has put in a lot of work to make this product pretty easy to use, and remove some of the initial barriers of threat hunting. I will say that through the training I did learn something in Linux that I hadn’t know about before, I didn’t know you could highlight results while using the less command to make searching through results easier, also I knew that you could “pipe” results of commands to each other but hadn’t done so with more than 2 commands ex. <command> | <command> | <command> |

If you are interested in checking out the VM’s, labs, or previous training recordings visit https://www.activecountermeasures.com/hunt-training and also build up your threat hunting skills with the Malware of the Day Blog (https://www.activecountermeasures.com/?s=malware+of+the+day) to continue sharpening your threat hunting skills, I know that I will be taking on that challenge.

As always, I want to continue to encourage everyone to continue seeking growth and improvement in whatever they desire. I am still striving for that 1% improvement everyday so if you need inspiration, advice, or a sounding board to bounce ideas off, start the conversation on LinkedIn (https://www.linkedin.com/in/shaun-washington-8a428240/) or Discord (cybershinigami81) 

As the date for registration for my CWCT classes approaches swiftly, I now am tasked with maintaining my motivation/hunger. With all the things I need and want to do start to pile up I need to manage my time better and also cut back where necessary.

With my work schedule getting ready to rotate into 3rd shifts and classes beginning soon after, I have to maintain a productive mindset as to not burn myself out, lessen my desire, and also keep myself accountable.  I will be using my “downtime” during my wake & working hours to read/study and complete assignments. This is a balancing act that I have had to do before when I was going to school fulltime, working fulltime plus overtime, and trying to be there with my family.

It is also imperative that I start/restart an exercise regimen. My job covers cost of membership for me to join a gym but knowing myself and how I’ve become more and more sedentary, I don’t see that as the best option for me to start out with. I think since I still have my Beachbody workouts P90X and T25 that will be the start to my physical health journey.  I truly miss having a team to workout with and keep me motivated and to push me during my workouts, but I will have to find alternative ways to keep myself moving toward my health goals without a gym buddy. Also choosing the best time to do the workouts will also need to be considered.

I am still working on my 2nd brain or Obsidian Vault, and I want to focus on more of my CySA+ related notes as well as notes for the upcoming classes I will be taking based on digital forensics. My plan is to finish my first play through of the Certify Breakfast playlist and on the second go round start incorporating the information in the videos into my Obsidian Vault to help with me preparation and absorption of the materials.

I have noticed that I haven’t been posting to my LinkedIn as much due to my shifting focus. I have the career that I set out on this #CyberGrowthAndLearningGrind and now I need to maintain and expand on what I have started to build. The TLDR is that I will continue to network and make posts (I probably need to just go ahead and schedule some posts ahead of time). That part of my grind is going to be put on the back burner while I am cooking up the main meal of gaining more cybersecurity knowledge, making meaningful connections, and contributing where I can in my sphere of influence.

Lastly, I want to continue to encourage everyone to continue seeking growth and improvement in whatever they desire. I am still striving for that 1% improvement everyday so if you need inspiration, advice, or a sounding board to bounce ideas off of start the conversation on LinkedIn (https://www.linkedin.com/in/shaun-washington-8a428240/) or Discord (cybershinigami81).

First, let me give an update on my current study and training regimen/routine:

• CompTIA CySA+ study group on Monday, Wednesday, and Friday on the DRJJBMJ Discord server.

• Self-guided study in TryHackMe

• CompTIA CySA+ study app (https://play.google.com/store/apps/details?id=com.abc.comptiacysa)

• Certify Breakfast – CompaTIA CySA+ YouTube playlist (https://youtu.be/IGihuL5clDs?si=CxU24TPwb4Sbzj-u)

• World of Haiku (working through with my son)

• Simply Cyber Daily Threat Brief (https://www.youtube.com/@SimplyCyber)

• Building my 2nd Brain in Obsidian (https://obsidian.md/)

That list is constantly shifting, and I am working on maintaining my consistency hitting all of them either daily or weekly. I know that I will be using THM a lot more since adding my premium subscription and supplementing my downtime with exposure to information and tools from rooms such as the RedLine and Phishing Email analysis rooms.

Second, I want to bring my “calendar” up to date:

• Cybersecurity Workforce Certification Training first session runs from October 23rd – December 17th

• CompTIA CySA+ Exam date scheduled for December 1st (will adjust depending on how confident I feel with my studies)

• Simply Cyber Con on November 8th https://www.simplycybercon.org

All Things Open 2023 October 15th -17th (hoping to be able to attend) https://2023.allthingsopen.org.

Last, but definitely not least, volunteering making myself available to others.  Time is always at a premium but I have made some wonderful connections through my journey and desire to give back as much as possible. What this will look like is unclear at this moment but I do know that I will be making every effort to:

• Continue my blogging with the other members of Team CC here at Cybersecurity Central

• Participate in Alyson Van Stone’s Mentorship Monday group

• Lend support and continue to be a mentor/gateway for programs such as Jesse Johnsons Slay Security+

• Work with Travis Corpening and the Young Mogul Development Group

That sums up the work side of life and I even with this on my plate I will be available to my Friends and Family (Lord Willin and the creek don’t rise.) Keep the conversation going by sending me a message and/or sharing with your network your #CyberGrowthAndLearningGrind journey, just make improvements everyday even if it’s only by 1.

Second XQL, where the “X” can be filled in by any specific language model, the query languages all are used to work in databases. The majority of the syntax in the QL’s are the same as SQL (Structured Query Language) but are further built upon to suite the needs of the database so that could mean read & write capabilities or just read capabilities (SQL vs KQL). Each of the security platforms has their own flavor of QL, learn the fundamentals of how to build your query and just remember white papers and Google are your friend.

Third EDR, Endpoint Detection and Response, are used to detect anomalous behavior and can also include Antivirus & Ransomware solutions. There are a plethora of options from various vendors, but finding the right one for you is going to depend on your “Stack” or compilation of security devices, or the offerings of the platform. Security in depth is a key concept to consider in building your infrastructure but here are a few of the EDR options:

• ConnectWise EDR

• Sophos EDR

• Crowdstrike Falcon

• SentinelOne

• VMware Carbon Black

• Trellix (FireEye)

• Huntress

• Heimdal EDR

Fourth, I will combine the last 3 bullet points from my introduction into my #CyberGrowthAndLearingGrind mentality and procedures. Studying for my overall knowledge and learning the aspects of my new job. The basics or fundamentals are the best place to start in any endeavor you pursue, knowing basic networking is a prerequisite for Security Operations, that is all tied into the analysis of traffic, emails, and network appliances. During my CySA+ study group I was shown a program that I felt would help me organize, build a knowledge repository, and also teach me about markdown languages, it is called Obsidian. Since then I have been sharing this program with my colleagues and building my 2nd Brain to reference what I am taking notes of. I have also been shown and/or shared with several browser plug-ins that can make my role easier. These plugins are new to me and if you are interested in what they do give them a try or ask me a question:

• Hack-Tools

• Salesforce Queue Refresher

• Feedbro

• Mitaka

Last but not least is staying up-to-date on the latest stories/vulnerabilities in the industry. You should all know by now about the wonders of the Cybersecurity Central and Simply Cyber communities, these are my favorite spaces to network, learn, and share with others. I know that there are numerous other places/groups/communities, and we can and do learn from one another, so start the conversation in the DM’s, join the community in Discord, and get your fix for actionable intel with the Daily Cyber Threat Brief. 

Come and make yourself better each day and pay it forward to those around you.

My time at the JDC began to accrue so fast that I couldn’t take enough time off (at least I thought I couldn’t) to not end up over the max vacation hours at the end of the year which would then roll over into Sick time. Rinse and repeat that for 12 years with compounding interest. I wish I could save money the way I saved PTO... Anyway, the major factor in me going back to school pursing IT and Cybersecurity was my work / life balance or lack thereof. I missed way too many holidays, weekend trips, family functions, you name it all due to my mindset on work and being a good employee. My track record as an employee was impeccable but my record as a family man was suffering to say the least.

Fast forward to my transition to multiple firsts:

• First time taking time off between jobs (not stopping on a Friday and starting that next Monday)

• First time not having to think about work keeping me from seeing friends and family

• First time with a remote position

• First welcome gift I have received from an employer

• First time my schedule has not completely dictated everything in my life

The toll that was being exacted on my physical and mental health couldn’t truly be quantified, without me being introspective (never really had time to do that) and finding new ways to be accountable for my wellbeing.  I know how to keep my eye on the prize and power through to my goals, but it has been a long time since I have achieved a big milestone and had the opportunity to reflect and refocus. So to make myself accountable to the others on this #cybergrowthandlearninggrind I will lay it all out before you:

• Set my goals for the first 90 days in my new position as SOC Analyst with One Source Communications.

• Plan my time for work, study, family, etc.

  • Get accustomed to my work schedule

  • Start back on an exercise plan

  • Be available to my family for more than emergencies

  • Be available to my friends who I have neglected due to my work first mindset

• Continue my pursuit of Cybersecurity knowledge through training, networking, and hands on experiences

• Lastly acquire my CompTIA CySA+ and CHFI, and whichever other certifications/trainings that will make me a better Cybersecurity Professional

In closing, don’t take your life for granted, work is necessary but it isn’t the only thing that matters. I missed out on so many events and times to make memories that I have a huge amount of regret or FOWIHM (Fear Of What I Have Missed). I can’t let myself do that again, this doesn’t mean that I will be any less of a committed employee, I will just make sure to use all of what is provided to me to make sure that my family thrives as much as my career. I look forward to family trips and vacations, also to conventions and conferences. If any of you are in the same boat as me, please let me know how you made the change or how you plan to change. 

Connect with me on LinkedIn: https://www.linkedin.com/in/shaun-washington-8a428240 

My #CyberGrowthAndLearningGrind is still in full effect, the job is secured but the hunt and pursuit of knowledge will never stop. I will take the time and savor this win, there is a huge weight lifted from my shoulders, however this is just the beginning of my cyber story. My goals are constantly being updated

·         Upon receiving my voucher I will set my exam date for the CySA+ exam

·         Get CySA+ certified before the end of the year

·         Start the CWCT Program in October

·         Prepre for the CHFI

I’ve been participating in study groups and mentorship meetings with other members of the Simply Cyber community, and I am making a concerted effort to invite and introduce others to the people and resources that helped me get to where I am currently. The next win to celebrate will be when I can help the next person take their first or next steps in the industry.

Come join me and the community as we keep learning and growing together.

Connect with me on LinkedIn: https://www.linkedin.com/in/shaun-washington-8a428240 

I have previously talked about my decision to “niche” down and focus on IAM currently due to the crossover between that area of cybersecurity and my current work duties. I have been exposed to quite a few things due to my hunger for knowledge and volunteering but without the practical on the job experience I felt as though I came up short when trying to get a System Administrator position. The final decision hasn’t been made yet, but after the research I did on Sys Admin Interview questions was not as successful as the research I had done on SOC Analyst questions, I saw and experienced the gap in my knowledge due to lack of exposure and opportunities. I truly hate not being prepared but at the same time there was such a wide variety of topics covered that it would have been impossible to know what was going to be asked unless I had done a similar interview.

My only suggestion for myself and anyone who is reading this is to specialize, niche down, and focus on your specific areas. My CySA+ studies introduced me to Rumsfeld’s matrix of Knowns and Unknowns:

The Known Knowns are the cybersecurity principles I have been studying and the IAM and duties of my job, the Known Unknowns are the specifics of what hardware/software that are in use and that I would be responsible for, Unknown Knowns are the basic duties and processes of troubleshooting and maintain a network, and lastly the Unknown Unknowns the questions and topics that would be brought up during the interview/conversations.  We cannot prepare for the Unknown Unknowns but through proper “loadout” preparation I can make sure that the tools and skills I have can be used with the utmost effectiveness until new skills, experiences, and job duties are acquired and put into rotation.

It feels like a loss and a win at the same time, I will use this experience to make myself more prepared for whatever comes in the future. As always, let's continue the conversation on my LinkedIn and I will see you all on the #cybergrowthandlearninggrind.

I had quite a slump, not completely out of the hole but I’m not at the bottom of the pit of despair I was wallowing in. Again, I want to say thank you to all of those in my network that I have met through my participation with Simply Cyber and Cybersecurity Central. Without the constant encouragement I have been receiving in open conversations and DM’s I am able to continue on this path. I make the pledge to myself and anyone reading this that I will remain transparent in my interactions and conversations in my blog posts and my LinkedIn profile. I have been reminded that other draw strength from my experience and sharing of this experience in a public forum.

I am currently trying to make enough time to get in my posts while working, taking the CySA+ course, trying to find work fulltime and/or part-time, and still be available to my family. I can say that the experience has made me cynical or more cautious in my interactions and passed on an opportunity for a parttime position that seemed just a little to good to be true after seeing the red flags of (no interview, asking for account information before having any real interaction, and a slight hint of desperation to get me to fill out the google form with that information). I almost let my desperation for income set me further back and I may never know if the position was truly legitimate, but I know that I can’t get ripped off if I don’t participate in the scam.

Last thing I want to talk about is the content that I see always being brought up in posts for people in my position that are trying to make the transition in a different field and don’t have “documented” experience. I would love to start a conversation up about how to convey that on your resume as I am still trying to figure this out myself. I know the skills that I can translate from my previous experience but I don’t know how to bring this across without embellishment or creating metrics that I don’t have or know. I can explain/show my experience managing people and tough/difficult situations from dealing with parents, juvenile, and staff in crisis situations ranging from suicidal ideations/attempts to dealing with a riot. How do you quantify this and add it to a resume with the x, y, z format and also make it apply to cybersecurity/IT? Working in the justice system has made it evident that you can’t save everyone, you can only help those that want it, and you can only change things directly in your sphere of influence (especially with support from supervisors .

Let’s start the conversation so that this information can be shared to improve our community as a whole. Remember, try to improve everyday even if by just 1% on your #cybergrowthandlearninggrind.

Connect with me on LinkedIn: https://www.linkedin.com/in/shaun-washington-8a428240 

I have heard from many other professionals on LinkedIn like @Henri Davis and @Kristi Kennebrew about transferable skills. I found myself preaching that gospel, while still on the path myself. Like everything else in life, perfection is not attainable but we can constantly strive for it, so I gave my caveat that “Im not where I want to be yet but this is what has been taught to me” and then the conversation went from there. Being but a fledgling in cybersecurity, with no official title to call myself a “cybersecurity professional,” I gave the knowledge I did have and what I have learned from my experience so far. Does that make me a mentor, I feel that is debatable, but I know I am ahead of where some of my connections are and I have to remind myself that even a mentee can and will be a mentor to someone else at any given moment. I will continue to do my best to show a path forward on my #CyberGrowthAndLearningGrind and will do my best to help someone the way that I would want someone to help me.

Keep striving for improvement, 1% better is enough, don’t let yourself become stagnant in your victories or defeats. Feel free to shoot me a message on LinkedIn to continue the conversation or to start a new one 

I try to maintain positivity, but I also know my limits and I wasn’t physically tired but mentally I was “DONE” and the spiral of agitation, aggravation, and irritation was making its way into my interactions with the family. I haven’t been this close to this level of “anger” and frustration since I was Supervisor at the Juvenile detention center, working overtime, still working as Youth Counselor Technician, giving up my holiday/vacation time, restraining juveniles on a near daily basis, all while putting on the face of strength for my coworkers and family. I had only been in a lower state once before and that was dealing with my mothers death and subsequent estate.

I say all of that to say this, we all need to learn to take time for ourselves on our #CyberGrowthAndLearningGrind. I found my energy reserves drained and it was hard to focus on my daily enrichment and studies. I have an undertaking of the CompTIA CySA+ course and exam coming up shortly and need to remember having moments of weakness is normal, what is not normal is ignoring our needs despite the signs and the writing on the wall.

We always have our responsibilities and obligations just remember you can’t do for anyone if you are not able to do for yourself. Listen to some of your favorite jams, watch a TV show or movie, play a game, just do something that will allow you to recharge your battery before you burn yourself out completely. This is a never-ending battle and we all could use some support, allow yourself the grace and time to get back to yourself.

My pre A.I. resume is getting most of the votes, but I am unsure what the issue is with it that is keeping me from getting past ATS and making it to at least a 1st interview. I will keep seeking assistance with getting this formula right to try and make this transition into Cybersecurity. If you haven’t already voted there are a few days left and the comments/conversation has been nonexistent.

I have had quite a few new connections that have asked me for tips and ideas on making it into the field, my imposter syndrome is getting quite confused because I know that I haven’t “made it” yet but for some people I am ahead, and they want to catch up to where I am. I can only be authentic and real with them when I say that I have not arrived on the cybersecurity scene just yet but here is what I have done so far to get where I am right now. Insert courses/resources that I have posted/shared, push Networking, Networking, Networking, and building your LinkedIn presence/profile/brand. I am not an expert in Canva or design, but I know how to express “my” interests/personality in what I do. I implore everyone that is reading this to take an introspective look at what is unique about you, bring that and your experiences into how you display yourself. What I have learned about branding on LinkedIn was from 2 main sources that I have shared on multiple occasions: Gerald Auger’s Definitive GRC Masterclass and Ken Underhill’s Cybersecurity Personal Branding course. They are worth the money and time to complete and are available at SimplyCyber.io, TCM Security, and Udemy.com

As I look toward the future, I will be seeking advice and implementing advice that I have come across to move my career forward and I will share what I learn with you, either through this blog, my LinkedIn posts, or DM. Please tear my resume to shreds if you know what is missing or what I could be doing better, I am always looking to improve on my #CyberGrowthAndLearningGrind. Keeping my eyes on the prize and not stopping until I have crossed the line and passed the baton to the next person.

Lets continue the conversation on my LinkedIn or feel free to message me.

I have to say that the communities on LinkedIn that I am a participant in (Simply Cyber, Cybersecurity Central) and the rest of the Cybersecurity professionals I have connected with have been more than supportive in helping me focus on the end goal, listening to my rants, showing me new viewpoints, and so much more. I am truly amazed and grateful, and I will try to make myself available to support others in the same way I have been supported (Pay it Forward).

I have not done the best for myself recently with selfcare, but I know my limits due to having hit just about rock bottom emotionally before, so fortunately and unfortunately, I know when I truly need to stop and step away. Jax Scott made a post about selfcare and consciously I felt guilty, because I know I should be doing better for myself, but at the same time I can’t afford to rest at this point until I get to the next step and put myself and my family in a better position.

The TLDR is make sure you take care of yourselves to the best of your ability and check on your friends and family as well. Everyone is struggling with something and could use a friendly ear or shoulder to lean on.

Lets continue the conversation on my LinkedIn or feel free to message me.

Let’s not forget block and streaming cyphers, I am going to enlist everyone’s favorite AI chat bot to give a simplified explanation (its hard to make this lighthearted).

“Block ciphers are like chocolate bars that you want to keep safe from sneaky snack thieves. You break the chocolate into equal-sized blocks, and then you wrap each block in a special secret foil that only you and your trusted friends can unwrap. That way, if a thief gets their hands on the chocolate, they can only steal one block at a time, and they can't read the message on the foil because it's encrypted.

On the other hand, streaming ciphers are like squirting a water gun at your annoying little sibling. You keep squirting water at them until they're soaked, and they can't figure out where the water is coming from. In the same way, streaming ciphers encrypt data one "stream" at a time, making it difficult for anyone trying to intercept the data to figure out where the data is coming from."

SOOO, yeah, the explanation was pretty good but I’m just going to set this to the side for now. If you have some way to help you remember this information, please feel free to message me or make a post on LinkedIn and add me to it. Still on this #CyberGrowthAndLearningGrind 16 days 'til it’s go time.

Please send me a message on LinkedIn to continue this conversation.