How I set up Active Directory using Server Core (No GUI) 1. Installed Windows Server Core on a VM (no GUI, only command line) 2. Used sconfig to configure: -Server name -Network settings -Remote access 3. Assigned a static IP (192.168.1.1) 4. configured DNS which is very important for Domain controller 5. Installed Active Directory using PowerShell: Command: Install-WindowsFeature AD-Domain-Services 6. Promoted server to Domain Controller: ICommand: nstall-ADDSForest 7. Created structure: -OUs (HR, IT, Admin) - Users & Groups lesson: 👉 DNS is EVERYTHING in Active Directory If DNS fails, the domain becomes unreachable This setup reflects real enterprise environments where GUI is minimal and control is done via CLI Next: Joining client machines + applying GPOs #100DaysOfCode #CyberSecurity #WindowsServer #ActiveDirectory

Day 122–123/182 of Ethical Hacking Internship at ICDFA I started my second practical lab in CIP-A107: SOC Level 2: Threat Hunting & Incident Response with Wazuh During the lab, I encountered a connectivity issue that prevented my Windows Wazuh agent from communicating with the Wazuh manager. Rather than reinstalling everything, I took a systematic troubleshooting approach: 1. Reviewed the Wazuh agent logs to identify why the agent could not connect to the manager. 2. Tested network connectivity between my Windows endpoint and the Ubuntu Wazuh server. Using PowerShell, I ran Test-NetConnection 192.168.1.189 -Port 1514 and confirmed that TCP connectivity to port 1514 was successful. 3. Investigated the agent configuration and discovered a leading space before the manager IP address, 192.168.1.189, which caused the agent to fail to resolve the hostname correctly. 4. Corrected the configuration in ossec.conf, ensuring the manager address was entered without leading or trailing spaces. I also checked the enrollment configuration and manager address. 5. Restarted the Wazuh agent service and reviewed the latest logs to verify the result. The issue was resolved, and my Wazuh agent successfully connected to the manager. And I start my threat hunting which I will be continuing tommorow Every challenge is another opportunity to learn. @_DeejustDee @ireteeh @segoslavia @Ahmed___khaan @theXSSrat

21 Days as an IAM Intern: Learning, Reviewing, and Applying the Principle of Least Privilege Over the past 21 days, my team and I have been working on an E-Campus Role and Permission Least-Privilege Review, alongside recommending appropriate access for interns assigned to approved offices. During the first week, I focused on understanding the existing access control structure, including 11 roles and 218 direct permissions. I studied the descriptions and purposes of each permission to understand how they support different responsibilities within the system. After building that foundation, I moved into the review phase, where I began assessing permissions, documenting findings, identifying potential risks, and providing recommendations and proposed dispositions. This experience has helped me better understand the practical application of Identity and Access Management (IAM), particularly the importance of ensuring that users have only the access necessary to perform their assigned duties. Key areas of my work include: 1- Reviewing roles and direct permissions. 2- Applying the Principle of Least Privilege. 3- Identifying potential access control risks. 4- Documenting findings, risks, recommendations, and proposed dispositions. 5- Supporting appropriate role assignments for interns across approved offices. The review is still ongoing, and I am working toward completing it before the end-of-month deadline. This assignment has reinforced an important lesson: effective access management is not just about granting permissions; it is about ensuring that every permission is justified, appropriate, and aligned with business needs. I look forward to completing the review and learning more through the process. #Cybersecurity #IAM #IdentityAndAccessManagement

Days 116–121/182 of Ethical Hacking at ICDFA My First SOC Lab Completed! I spent the past six days battling Wazuh issues instead of posting updates. First, my Windows agent wouldn't connect. Then the dashboard stopped loading. After days of troubleshooting, I finally: ✅ Restored the dashboard ✅ Connected my Windows endpoint ✅ Implemented File Integrity Monitoring ✅ Generated and investigated test events ✅ Documented and submitted my lab 💡 My biggest lesson? Sometimes, you learn more when solving a problem than when everything works perfectly. The struggle was part of the training. Alhamdulillah @ireteeh @_DeejustDee @segoslavia @theXSSrat @Ahmed___khaan

Day 115/183 of Ethical Hacking Internship at ICDFA Starting My SOC Journey with Wazuh Today, I continued working on Lab 1 of my SOC course: focusing on setting up Wazuh and connecting a Windows endpoint for security monitoring. Today's progress: 1- Launched the Wazuh Dashboard. 2- Created a new agent for my Windows system. 3- Retrieved the agent authentication key. 4- Started the agent to begin monitoring the Windows endpoint. 5- Encountered a connection issue that prevented the agent from connecting successfully to the Wazuh manager. I spent time troubleshooting the issue, but I haven't resolved it yet. I'll continue investigating tomorrow. @_DeejustDee @ireteeh @segoslavia @Ahmed___khaan @theXSSrat

Day 114/182 of Ethical Hacking Internship at ICDFA Today, I started a new course: CIP-A107 – SOC: Security Operations Center. I completed my installation and lab setup, and my Wazuh environment is now ready! Tomorrow, I'll begin my first lab, where the real practical learning starts. I'm excited to build on my previous experience in Linux, networking, offensive security, and malware analysis as I continue developing my skills in Security Operations Center (SOC). @_DeejustDee @ireteeh @segoslavia @jay_hunts @Ahmed___khaan

Day 112–113/182 of Ethical Hacking Internship at ICDFA As we await Our Next Course, I continued developing my cybersecurity skills by working on an Identity and Access Management (IAM) task focused on Role-Based Access Control (RBAC) and the Principle of Least Privilege. My assignment was to review existing roles and permissions across Finance, HR, and External Relations, identify potentially excessive access, and recommend appropriate intern roles where needed. My focus was on understanding how to: 🔹 Review existing roles and their assigned permissions. 🔹 Apply the Principle of Least Privilege (PoLP) by ensuring users receive only the access necessary for their responsibilities. 🔹 Identify permissions that may introduce unnecessary risks, particularly around financial operations, administrative functions, and approval workflows. 🔹 Document findings, justify recommendations, and maintain an IAM role and permission review register. 🔹 Propose restricted intern roles that support business operations without granting unnecessary privileges. One important lesson from this task is that having a permission does not automatically mean a user needs it. Access should be justified by business responsibilities, validated against actual permission capabilities, and reviewed regularly. I'm also learning that effective IAM is not simply about granting or removing access. It requires careful analysis, documentation, risk assessment, and collaboration with the relevant role owners before changes are implemented. Every task continues to strengthen my understanding of how cybersecurity controls work in real-world environments. @_DeejustDee @ireteeh @segoslavia @theXSSrat @Ahmed___khaan

Day 112/182 | Malware Analysis Results Are In! Today is RESULT DAY! Alhamdulillah! My four Malware Analysis labs at ICDFA have been graded, marking another important milestone in my ethical hacking journey. Here are my results: - Lab 1: 10% — I missed the deadline while troubleshooting my FLARE-VM installation and setting up my malware analysis environment. - Lab 2: 85% - Lab 3: 90% - Lab 4: 90% My first result was disappointing, especially knowing that the installation and troubleshooting challenges affected my submission. However, this experience taught me an important lesson about time management, preparing lab environments early, and handling technical setbacks without losing sight of deadlines. I'm proud of the progress I made in the subsequent labs, from investigating malware samples to using tools such as PEStudio, Ghidra, x32dbg, and other analysis utilities. Beyond the scores, I gained practical experience in malware analysis, static analysis, reverse engineering, and controlled debugging. @_DeejustDee @ireteeh @segoslavia @Ahmed___khaan @theXSSrat

It's today don't miss it

Day 111/182 of Ethical Hacking Internship at ICDFA Today was resting and reflecting day as we await to unlock the next course. And also work on different IAM projects @_DeejustDee @ireteeh @segoslavia @Ahmed___khaan @cyberjeremiah

Days 108–110/182 of Ethical Hacking Internship at ICDFA Over the past three days, I’ve been working on Lab 4: LokiBot Trojan Decompilation and Controlled Debug Analysis, the final lab of my Malware Analysis course at ICDFA. This lab has given me an opportunity to apply practical malware analysis and reverse-engineering techniques using several specialized tools. What I worked on: 1. PEStudio: Examined the executable’s file information, identified indicators of interest, and recorded its hash. 2. Exe2Aut: Decompiled the executable to examine its available code and structure. 3. Ghidra: Performed static analysis to investigate the executable’s internal structure and code. 4. x32dbg: Used controlled debugging to investigate anti-analysis techniques. 5. Process Hacker: Identified and recorded the process ID (PID) and gathered process-related evidence during the analysis. Each tool provided a different perspective, helping me understand how malware analysts combine static analysis, decompilation, and controlled debugging to investigate suspicious executables. This lab has reinforced an important lesson: effective malware analysis requires patience, multiple tools, careful observation, and proper evidence documentation. As this is the final lab in the Malware Analysis course, I’m looking forward to completing the remaining analysis and documenting my findings. Three days of investigation, troubleshooting, and learning. Alhamdulillah! 🤲🏽🔐 @_DeejustDee @ireteeh @segoslavia @Ahmed___khaan @cyberjeremiah @jay_hunts @Cyberhijabitech @AishaBelloB @Cyber_GRC

Days 106–107/182 Ethical Hacking Internship at ICDFA Sunday was a rest day a chance to step back, recharge, and prepare for the week ahead. Yesterday, I successfully submitted Lab 3: TeslaCrypt Ransomware Unpacking and Memory Analysis. The lab gave me practical experience with malware analysis, including static analysis, PEStudio, hashing and controlled execution. Today, the journey continues. I’m now preparing to start the last lab of the course, which marks another important step in my ICDFA Ethical Hacking Internship journey. @_DeejustDee @ireteeh @segoslavia

Day 105/182 of Ethical Hacking Internship at ICDFA Today, I continued with my third Malware Analysis Lab: TeslaCrypt Ransomware Unpacking and Memory Analysis. Before executing the malware sample, I focused on establishing a proper analysis baseline and performing static analysis in a controlled environment. Today’s progress included: 1. Recorded the baseline state of the analysis environment 2. Confirmed the baseline isolation 3. Calculated and verified the sample's SHA-256 hash 4. Started the initial static analysis using PEStudio 5. Reviewed the file overview and indicators 6. Analyzed the PE sections and headers 7. Reviewed the flags and other suspicious indicators The goal at this stage is to understand the malware before execution, establish what the sample contains, and identify indicators that can guide the next phase of analysis. This lab is teaching me that malware analysis isn't simply about running a suspicious file and watching what happens. Preparation, isolation, hashing, and static analysis are critical before dynamic execution. @_DeejustDee @ireteeh @segoslavia @Ahmed___khaan @cyberjeremiah @Cyberhijabitech

Days 102–104/182 of Ethical Hacking Internship at ICDFA The past three days have not been easy. I’ve been battling with Flare-VM setup, controlled dynamic malware analysis, and poor network connectivity. After several attempts, troubleshooting, and a lot of patience, I finally managed to successfully complete my Flare-VM installation and move forward with the malware analysis lab. During the analysis, I was able to: 1. Successfully set up my Flare-VM environment 2. Work with a malware sample in a controlled lab environment 3. Verify that the sample was UPX-packed 4. Execute the sample in the controlled environment 5. Perform dynamic analysis and observe its behavior 6. Document my observations and findings This experience reminded me that cybersecurity labs don't always go as planned. Sometimes the biggest challenge isn't the analysis itself — it's getting the environment working properly. But after three days of troubleshooting, I finally got it working. @_DeejustDee @ireteeh @segoslavia @Ahmed___khaan @cyberjeremiah

Day 101/182 of Ethical Hacking Internship at ICDFA Sometimes the Biggest Lesson Is Finding the Mistake Today was one of those days where the lab itself became the lesson. I spent almost the entire day trying to install FLARE-VM on my virtual machine. From the morning until around 12:30 AM night, I was troubleshooting without success. Eventually, I discovered the mistake I had made with my Windows security configuration. I had misunderstood the relationship between Windows Defender, Real-time Protection, and the Group Policy settings required for the FLARE-VM setup. Instead of configuring the required settings correctly, I had disabled/changed the wrong options. The important lesson: In cybersecurity, small configuration details can make the difference between a working environment and hours of troubleshooting. I haven't completed the FLARE-VM installation yet, but now I understand where I went wrong and what I need to correct. Sometimes progress looks like solving the problem. Other times, it looks like finally discovering what the problem was. Back at it tomorrow. @_DeejustDee @ireteeh @Ahmed___khaan @segoslavia