Turning raw findings into a threat intelligence report doesn't have to be intimidating. This post walks through mapping a Mirai botnet to MITRE ATT&CK — and explains every tag in plain English, so you can speak the language every SOC team uses.

Part 2 of the Zeek threat hunt: using SQL to detect C2 beaconing on a fixed cadence, internal reconnaissance across 771 hosts, and a confirmed SSH intrusion — plus the timeline that showed the network was compromised before the attacker I could see ever logged in.

I spent years reading atmospheric data for the anomaly that didn't belong. Finishing TryHackMe's Intro to Log Analysis room, I found the same instinct waiting in an Apache access log, just a different kind of storm. Here's what the room taught me about command-line triage, regex, attack signatures, and reading the story a log is telling.

Small utilities have operated under a comforting assumption for years: 'We're too small for anyone to target.' The data says otherwise. Attackers don't need to know who you are — they just need your IP address to show up in an automated scan.

Technology evolves. Threats adapt. But together—through awareness, vigilance, and resilience—we stay stronger. DataSec Chronicles on why physical tactics are breaking digital walls.

Started with a raw Zeek log — no SIEM, no alerts. Uncovered a Mirai botnet within hours: one internal host behind 500K+ failed Telnet/SSH scans, confirmed by its port signature. A complete threat profile from raw data alone.