Jason Hill, 8-bit style

visitor@thefish.nz:~$ home

Jason Hill

CYBER SECURITY · OSINT · DIGITAL INVESTIGATIONS

Security operations by trade. OSINT by curiosity, persistence, and an inability to leave an interesting clue alone.

View latest post LinkedIn

// latest posts

Recent Posts

Windows Event Logs for SOC Analysts: What an Event ID Actually Proves

socwindowswindows-event-logsinvestigationdfirdetectionfield-guide
Read post →

Threat Hunting for SOC Analysts: Turning a Suspicion Into a Searchable Hypothesis

socthreat-huntinginvestigationdetection-engineeringsiemsplunkkqldfirfield-guide
Read post →

SPF, DKIM and DMARC: What They Actually Prove (and What They Don't)

email-securityphishingspfdkimdmarcsocdfirfield-guide
Read post →

Ransomware Before the Ransomware: What the SOC Should See Before Encryption Starts

socransomwareincident-responseinvestigationdetection-engineeringthreat-actorsqilindfirfield-guide
Read post →

PowerShell Is Not the Alert: Investigating Living-off-the-Land Activity

socpowershelllolbinswindowsinvestigationdetection-engineeringdfirfield-guide
Read post →

The IP Isn't the Attacker: A SOC Analyst's Guide to NAT, VPNs and Proxies

socblue-teamnetworkingfield-guideskills
Read post →

Identity Attacks for SOC Analysts: Sessions, Tokens, MFA and Account Compromise

socidentityentra-idmicrosoft-365account-compromiseauthenticationincident-responseinvestigationfield-guide
Read post →

How to Think Like a SOC Analyst in an Interview

socinvestigationinterviewincident-responseanalyst-methodologyfield-guidecareer
Read post →

From Header to Host: Investigating Phishing in the SOC

socphishingemail-securityinvestigationidentityincident-responsedfirfield-guide
Read post →

See all posts →

$ connect --linkedin

Get in touch

Questions about OSINT, security operations, or an interesting rabbit hole to share? LinkedIn is the best place to reach me.

Connect on LinkedIn Email
Other places: @OscarThePhish GitHub