The sheets
Twenty-six references · updated as I use them
LogName='Security'; Id=4688 }
# process creation, last 24h
PowerShell
Host triage, event-log hunting, the IDs worth memorizing, and the Microsoft 365 / Entra ID checks for BEC — inbox rules, forwarding, OAuth grants, sign-ins.
--sort=start_time
# parent PID + full command line
Bash
Linux host triage from a shell: what's running, who's talking to what, persistence in cron and systemd, file carving, and remote evidence collection over SSH.
END { for(k in c) print c[k],k }'
# top 4xx/5xx sources
awk
The language in one screen, then the log-analysis one-liners — counting with arrays, brute-force detection, per-hour bucketing, and two-file IOC matching.
| [.user,.ip] | @csv'
# carve JSON → CSV
jq
The JSON processor — the awk for Graph / Entra exports, cloud logs, and the enrichment APIs. Access and filter with select(), reshape, count with group_by, and export to CSV, plus M365 / IOC one-liners.
2. user & permissions?
# 12 questions → ticket note
Alert Triage
The questions to answer before you call an alert — scope, severity, MITRE, containment, host behavior, OSINT. Fill it in and copy a ready-made triage note.
→ evade → creds → lateral → C2 → impact
# kill chain + M365 + tells
Attack Patterns
How intrusions unfold — the 14 ATT&CK tactics, the endpoint kill chain, and the M365 / Entra identity attacks, each pattern with its tell and a link to the sheet that confirms it. The map the other sheets dig into.
2>/dev/null | grep deleted
# fileless processes still running
Linux Compromise
Compromise assessment on a Linux host — the Big Five (processes, directories, files, users, logs) from Sandfly's cheat sheet, plus network, persistence, and rootkit checks.
404 Not Found 429 502
# every code, grouped by class
HTTP Status Codes
The full set, color-coded by class, with log-triage notes on the codes that flag scanning, brute force, and abuse in access logs.
UNION SELECT · ${jndi: · 169.254.169.254
# payloads & log tells
Web Attack Signatures
SQLi, XSS, command injection, path traversal / LFI, SSRF, XXE and more — the payload pattern you'd see in a request, the log/WAF tell, and the grep/awk to find it, plus the encoding tricks attackers hide behind.
3 Net · 2 Link · 1 Phys
# OSI ↔ TCP/IP, per-layer examples
Network Layers
The OSI seven-layer stack mapped to TCP/IP, with the protocols, devices, and the attacks and tooling that live at each layer.
53 DNS 4444 Meterpreter
# grouped by service, abused flagged
Port Numbers
The ports you see every shift, grouped by service with a SOC note on each — plus a flagged list of the ports attackers favor.
4104 script 7045 service 1102 cleared
# grouped by category, log source
Windows Event IDs
The IDs you hunt through, grouped by what they tell you — logon, account changes, process, PowerShell, persistence, log tampering, Sysmon — with the log each lives in.
13 reg 8 inject 25 tamper 19-21 wmi
# host telemetry, grouped
Sysmon Event IDs
Every Sysmon event grouped by what it catches — process, network, image/driver, file, registry, pipes, WMI, tampering — with the field that matters, the high-signal IDs flagged, and the config notes behind what you actually see.
epl · gl /e:false · cl → 1102
# event logs from the CLI + XPath
wevtutil
The event-log command line — list logs, query with XPath, export evidence (.evtx), and read config — with an XPath filter cheat, the log-tampering moves (clear, disable, resize), and the 1102 / 104 detection notes.
→ attachment → context → defend
# 8-phase phishing procedure
Phishing SOP
The standard operating procedure for working a reported phish — purpose, roles, a severity guide, and the eight-phase procedure with actions and exit criteria.
Received · DKIM · SPF · DMARC
# key headers + RFC links
Email Headers
The headers to read on a suspected phish — identity, routing, and SPF/DKIM/DMARC — with normal-vs-suspicious notes, a red-flags list, and links to each RFC and the IANA registry.
'not port 22' -w cap.pcap
# capture, BPF filters, hunting
tcpdump
Packet capture and filtering from the command line — capture basics, BPF filter expressions, TCP-flag and byte-offset tricks, and SOC hunting one-liners.
net group "Domain Admins" /domain
# users, groups, sessions, recon
net Command
The built-in Windows net command as a defender's reference — users, groups, sessions and shares, host/network recon, and the recon and lateral-movement patterns to detect.
svchost.exe ← services.exe -k
# know normal, find evil
Core Processes
Know normal, find evil — the legit Windows processes with their expected path, parent, user, and count, plus the masquerade red flags that give a fake away.
tasklist /v /fi "imagename eq lsass.exe"
# list, filter, services, DLLs
tasklist
The built-in process lister — basic listing, /fi filters, service and DLL mapping, remote hosts, and hunting one-liners for reading a box against known-normal.
amsi.dll → evasion · ws2_32 → net
# capability by loaded module
DLLs in Malware
Read a process by the libraries it loads — common DLLs grouped by capability (C2, injection, credential access, ransomware, evasion) with what each means, plus DLL side-loading tells.
ExecutablePath,CommandLine
# + PowerShell equivalents
wmic
The WMI command-line for triage — process ancestry, services, startup, system and disk, patches, shares — each paired with its PowerShell CIM replacement, since wmic is deprecated.
sc create · config binPath= · stop
# services: triage & persistence
sc (Service Control)
The built-in service control command — query and inspect, start/stop, create, config, and delete — with the service-based persistence and lateral-movement patterns to detect, plus the 7045 / 4697 detection notes.
/create /tr · /change · 4698
# scheduled tasks: persistence
schtasks
The scheduled-tasks command — query, create, change, run, delete, and remote — with the on-disk and registry artifacts, the hidden-task trick, the task-based persistence patterns, and the 4698-family detection notes.
Services · Winlogon · ShimCache
# persistence & execution artifacts
Windows Registry
The hives and structure, the autostart and stealthier persistence keys, the execution and user-activity artifacts, and the reg.exe / PowerShell to read them — with SOC hunting one-liners.
sysmon · psexec · handle · strings
# + direct MS download links
Sysinternals
The whole toolkit grouped for SOC work — process triage, Sysmon, network, PsTools, security, disk, registry — with the dual-use tools flagged and a direct Microsoft download link on every tool.
Analyst tools
External · opens in a new tab
Email headers
Links & URLs
Typosquatting & look-alikes
Reputation & enrichment
Sandbox & reference
Payloads & offensive reference
%27 is ' and %3C is <.
w3schools.com