https://bertpractice.nl/Notes from the SOC on detection, threat hunting and incident response.enThu, 05 Nov 2026 00:50:00 +0100https://bertpractice.nl/posts/restarting-fridges-shelves-and-php/Thu, 05 Nov 2026 00:50:00 +0100https://bertpractice.nl/posts/restarting-fridges-shelves-and-php/Why I moved my writing off Medium, and three incidents from the last few weeks that stuck with me: hacked supermarket fridges, the Albert Heijn outage and PHP2Shell.https://bertpractice.nl/posts/anxaiity-keep-calm-and-carry-a-layered-defense/Thu, 23 Jul 2026 12:34:24 +0000https://bertpractice.nl/posts/anxaiity-keep-calm-and-carry-a-layered-defense/Staying calm about AI-driven threats by relying on layered defence rather than on any single control.https://bertpractice.nl/posts/using-a-yubikey-as-multi-factor-authentication-for-macos/Thu, 02 Feb 2023 17:36:32 +0000https://bertpractice.nl/posts/using-a-yubikey-as-multi-factor-authentication-for-macos/Archived guide: using a YubiKey as second factor for macOS login on unmanaged devices. Deprecated since July 2023.https://bertpractice.nl/posts/how-to-detect-remote-desktop-protocol-tunneling-over-ssh/Wed, 03 Aug 2022 09:18:20 +0000https://bertpractice.nl/posts/how-to-detect-remote-desktop-protocol-tunneling-over-ssh/How RDP tunnelled over SSH shows up in logs and network traffic, and how to detect it.https://bertpractice.nl/posts/how-purple-teaming-made-me-a-better-blue-teamer/Thu, 14 Jul 2022 11:09:24 +0000https://bertpractice.nl/posts/how-purple-teaming-made-me-a-better-blue-teamer/What years on the blue side and a stint in purple teaming changed about how I defend.https://bertpractice.nl/posts/threat-hunting-toolset-and-operational-security-considerations/Tue, 19 Oct 2021 13:26:17 +0000https://bertpractice.nl/posts/threat-hunting-toolset-and-operational-security-considerations/Building an open source threat hunting toolset, and the opsec that keeps the adversary from noticing you are hunting.https://bertpractice.nl/posts/dealing-with-advanced-windows-defender-bypass-attempts/Thu, 01 Jul 2021 12:45:57 +0000https://bertpractice.nl/posts/dealing-with-advanced-windows-defender-bypass-attempts/Detecting C2 traffic and fileless malware when Defender is bypassed, and what to harden on the endpoint and in PowerShell.https://bertpractice.nl/posts/analysing-a-security-alert-101/Tue, 22 Jun 2021 14:32:29 +0000https://bertpractice.nl/posts/analysing-a-security-alert-101/How I work through a security alert: what to check first, what context to pull in, and when to escalate.https://bertpractice.nl/posts/an-introduction-to-security-monitoring-with-open-source-software/Thu, 03 Jun 2021 12:26:29 +0000https://bertpractice.nl/posts/an-introduction-to-security-monitoring-with-open-source-software/Security monitoring does not need a SOC contract or a commercial SIEM. What open source software gets you when you start from zero visibility.