Vedran DojčinovićDetection engineering, Active Directory security, and pentest research notes.https://vedrandojcinovic.com/What the SOC Analyst path actually taught me — running my own SIEM alongside ithttps://vedrandojcinovic.com/blog/soc-analyst-path-htb/https://vedrandojcinovic.com/blog/soc-analyst-path-htb/Going through HTB's SOC Analyst path while running a purple team lab changed what stuck. The detections aren't the point. Seeing where they break is.Fri, 25 Sep 2026 00:00:00 GMTsocdetection-engineeringblue-teamwazuhsplunkhack-the-boxcdsaDetecting Kerberoasting with Wazuhhttps://vedrandojcinovic.com/blog/detecting-kerberoasting-with-wazuh/https://vedrandojcinovic.com/blog/detecting-kerberoasting-with-wazuh/The rule is six lines of XML. The part that actually mattered was a query I ran before writing any of it.Tue, 15 Sep 2026 00:00:00 GMTwazuhdetection-engineeringactive-directorykerberosblue-teammitre-attack