- 9
- Episodes
- 1
- Ratings
- 2025
- First episode
About Detection Opportunities
Detection Opportunities is a podcast for security professionals who care about building resilient detection and response systems. Each episode explores real-world attacks, breaks down how signals become insights, and dives into the engineering mindset behind effective threat detection, investigation, and defense. Grounded in frontline experience across SIEM development, security operations, incident response, and threat hunting, this show brings a practical, systems-level lens to modern security engineering.
- Publisher
- CYBERWOX
- Category
- technology
- Language
- en
- Explicit
- No
- First episode
- 29 Apr 2025
- Latest episode
- 6 Jun 2025
Latest episodes
9 episodes in the feed.

6 Jun 2025
Detection-as-Code & CI/CD in Detection Engineering with Dennis Chow | EP. 9
Dennis Chow, detection engineering specialist, discusses Detection as Code and CI/CD pipelines, offering insights into scalable, accountable, and reliable detection engineering in this interview.

29 Apr 2025
Applying AI, LLMs & Prompt Engineering for Threat Detection with Dylan Williams | EP. 8
Visit my sponsor (https://snhu.edu/cyberwox) to view the current average annual salary for a Cybersecurity degree and learn how to get started. I had the pleasure of hosting Dylan Williams and we explored how AI can be applied in cybersecurity, focusing on threat detection. We also examined how his project, D.I.A.N.A., turns threat intelligence reports into actual detections. Connect with Dylan (https://www.linkedin.com/in/dylan-williams-a2927599/) Dylan's Resource on Applying LLMs & GenAI to Cybersecurity (https://start.me/p/9oJvxx/applying-llms-genai-to-cyber-security) Dylan's Medium (https://medium.com/@dylanhwilliams) D.I.A.N.A Project (https://github.com/dwillowtree/diana) DI.A.N.A App (https://dianast.streamlit.app/) _____________ TIMESTAMPS 00:00 Intro 01:39 Dylan's Background 02:40 How Dylan started exploring AI 03:07 SNHU 04:36 Dylan's ChatGPT Moment 06:22 Training LLMs for Cybersecurity 09:53 Updating LLMs 14:27 D.I.A.N.A - Detection and Intelligence Analysis for New Alerts 17:07 Going from Threat Intelligence to Threat Detection 32:02 Getting started with LLMs & Gen AI for Cybersecurity 33:55 Connect with Dylan 35:12 Outro _____________ ⚡️JOIN 6,000+ CWX MEMBERS ON DISCORD (https://discord.gg/cyberwoxacademy) 📰 SUBSCRIBE TO THE CYBERWOX UNPLUGGED NEWSLETTER (https://cyberwoxunplugged.com) 🥶 CYBERWOX MERCH (https://store.cyberwox.com) _____________ 🧬 CYBERWOX RESOURCES 🔹 Cyberwox Cybersecurity Notion Templates for planning your career (https://daycyberwox.gumroad.com/l/cyberlearningframework) 🔹 Cyberwox Best Entry-Level Cybersecurity Resume Template (https://daycyberwox.gumroad.com/l/cybersecurityresume) 🔹 Learn AWS Threat Detection with my LinkedIn Learning Course (https://www.linkedin.com/learning/introduction-to-aws-threat-detection/) _____________ 📱 LET'S CONNECT → IG (https://www.instagram.com/daycyberwox) → Threads (https://www.threads.net/@daycyberwox) → Substack (https://substack.com/@cyberwox) → Twitter (https://twitter.com/DayCyberwox) → Linkedin (https://www.linkedin.com/in/dayspringjohnson/) → Tiktok (https://www.tiktok.com/@cyberwox) Email: day@cyberwox.com _____________ ⚠️DISCLAIMER This description has some affiliate links, and I may receive a small commission for purchases made through these links. I appreciate your support!

29 Apr 2025
Get-RoleGroup - Detecting Attacker Enumeration in Microsoft 365 Exchange with Purav Desai | EP. 7
Visit my sponsor (https://snhu.edu/cyberwox) to view the current average annual salary for a Cybersecurity degree and learn how to get started. Purav's LinkedIn ( https://www.linkedin.com/in/purav-da346393/) Deciphering UAL (https://github.com/PuravsPoint/DecipheringUAL) Exchange Admin Audit Logging (https://learn.microsoft.com/en-us/purview/audit-log-activities#exchange-admin-activities) Office365 Management Activity API (https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#enum-auditlogrecordtype---type-edmint32) Connect-IPPSSession (https://learn.microsoft.com/en-us/powershell/module/exchange/connect-ippssession?view=exchange-ps) _____________ TIMESTAMPS: 00:00 Intro 00:36 Get-RoleGroup Operation 01:37 Enumeration is not logged?? 05:53 SNHU 07:22 Using the Security Compliance Center EOPCmdlet 08:54 Abusing Purview Compliance & E-Discovery 10:21 Useful Log Fields & Key Fields of note 12:48 Attack Demo 14:45 Fields to Decipher 15:51 How To Detect/Analyse 17:59 Get-RoleGroupMember 19:39 Useful Log Fields 20:30 Attack Demo 23:01 Segmentation Of Behaviors 23:57 Connect-IPPSSession 26:07 Final Thoughts 27:40 Outro _____________ ⚡️JOIN 6,000+ CWX MEMBERS ON DISCORD (https://discord.gg/cyberwoxacademy) 📰 SUBSCRIBE TO THE CYBERWOX UNPLUGGED NEWSLETTER (https://cyberwoxunplugged.com) 🥶 CYBERWOX MERCH (https://store.cyberwox.com) _____________ 🧬 CYBERWOX RESOURCES 🔹 Cyberwox Cybersecurity Notion Templates for planning your career (https://daycyberwox.gumroad.com/l/cyberlearningframework)🔹 Cyberwox Best Entry-Level Cybersecurity Resume Template (https://daycyberwox.gumroad.com/l/cybersecurityresume) 🔹 Learn AWS Threat Detection with my LinkedIn Learning Course (https://www.linkedin.com/learning/introduction-to-aws-threat-detection/) _____________ 📱 LET'S CONNECT → IG (https://www.instagram.com/daycyberwox) → Threads (https://www.threads.net/@daycyberwox) → Substack (https://substack.com/@cyberwox) → Twitter (https://twitter.com/DayCyberwox) → Linkedin (https://www.linkedin.com/in/dayspringjohnson/) → Tiktok (https://www.tiktok.com/@cyberwox) Email: day@cyberwox.com _____________ ⚠️DISCLAIMER This description has some affiliate links, and I may receive a small commission for purchases made through these links. I appreciate your support!

29 Apr 2025
Add-RoleGroupMember - Detecting Persistence in Microsoft 365 Exchange with Purav Desai | EP. 6
Learn how to decipher the Microsoft Unified Audit Log (UAL) from a Digital Forensics & Incident Response (DFIR) perspective with Purav Desai, an experienced M365/Azure Incident Responder. In today's episode, we explore the Add-RoleGroupMember operation in Exchange Online. Purav's LinkedIn ( https://www.linkedin.com/in/purav-da346393/) Deciphering UAL (https://github.com/PuravsPoint/DecipheringUAL) Microsoft Application IDs (https://learn.microsoft.com/en-us/troubleshoot/azure/entra/entra-id/governance/verify-first-party-apps-sign-in) Permission Alert Policy (https://learn.microsoft.com/en-us/purview/alert-policies#permissions-alert-policies) _____________ TIMESTAMPS: 00:00 Intro 00:48 Add-RoleGroupMember Overview 03:22 The Result Status 04:53 The Application IDs 08:59 Key Fields of Note 10:39 Fields to Decipher 20:14 Detection - Permission Alert Policies 23:18 Custom Alerting 24:32 Final Thoughts 25:39 Outro _____________ ⚡️JOIN 6,000+ CWX MEMBERS ON DISCORD (https://discord.gg/cyberwoxacademy) 📰 SUBSCRIBE TO THE CYBERWOX UNPLUGGED NEWSLETTER (https://cyberwoxunplugged.com) 🥶 CYBERWOX MERCH (https://store.cyberwox.com) _____________ 🧬 CYBERWOX RESOURCES 🔹 Cyberwox Cybersecurity Notion Templates for planning your career (https://daycyberwox.gumroad.com/l/cyberlearningframework)🔹 Cyberwox Best Entry-Level Cybersecurity Resume Template (https://daycyberwox.gumroad.com/l/cybersecurityresume) 🔹 Learn AWS Threat Detection with my LinkedIn Learning Course (https://www.linkedin.com/learning/introduction-to-aws-threat-detection/) _____________ 📱 LET'S CONNECT → IG (https://www.instagram.com/daycyberwox) → Threads (https://www.threads.net/@daycyberwox) → Substack (https://substack.com/@cyberwox) → Twitter (https://twitter.com/DayCyberwox) → Linkedin (https://www.linkedin.com/in/dayspringjohnson/) → Tiktok (https://www.tiktok.com/@cyberwox) Email: day@cyberwox.com _____________ ⚠️DISCLAIMER This description has some affiliate links, and I may receive a small commission for purchases made through these links. I appreciate your support!

29 Apr 2025
New-RoleGroup - Detecting Privilege Escalation in Microsoft 365 with Purav Desai | EP. 5
Learn how to decipher the Microsoft Unified Audit Log (UAL) from a Digital Forensics & Incident Response (DFIR) perspective with Purav Desai, an experienced M365/Azure Incident Responder. Purav's LinkedIn (https://www.linkedin.com/in/purav-da346393/) Deciphering UAL (https://github.com/PuravsPoint/DecipheringUAL) Learn about auditing solutions in Microsoft Purview (https://learn.microsoft.com/en-us/purview/audit-solutions-overview) _____________ TIMESTAMPS 00:00 Intro 00:20 Deciphering New-RoleGroup 09:06 Key Fields 10:11 Deciphering with Exchange Online PowerShell 13:42 Detection Opportunities 16:16 SIEM & Attacker Tactics 21:43 Outro _____________ ⚡️JOIN 6,000+ CWX MEMBERS ON DISCORD (https://discord.gg/cyberwoxacademy) 📰 SUBSCRIBE TO THE CYBERWOX UNPLUGGED NEWSLETTER (https://cyberwoxunplugged.com) 🥶 CYBERWOX MERCH (https://store.cyberwox.com) _____________ 🧬 CYBERWOX RESOURCES 🔹 Cyberwox Cybersecurity Notion Templates for planning your career (https://daycyberwox.gumroad.com/l/cyberlearningframework)🔹 Cyberwox Best Entry-Level Cybersecurity Resume Template (https://daycyberwox.gumroad.com/l/cybersecurityresume) 🔹 Learn AWS Threat Detection with my LinkedIn Learning Course (https://www.linkedin.com/learning/introduction-to-aws-threat-detection/) _____________ 📱 LET'S CONNECT → IG (https://www.instagram.com/daycyberwox) → Threads (https://www.threads.net/@daycyberwox) → Substack (https://substack.com/@cyberwox) → Twitter (https://twitter.com/DayCyberwox) → Linkedin (https://www.linkedin.com/in/dayspringjohnson/) → Tiktok (https://www.tiktok.com/@cyberwox) Email: day@cyberwox.com _____________ ⚠️DISCLAIMER This description has some affiliate links, and I may receive a small commission for purchases made through these links. I appreciate your support! Email: day@cyberwox.com

29 Apr 2025
Microsoft 365 Forensics & Incident Response with Purav Desai | EP. 4
Learn how to decipher the Microsoft Unified Audit Log (UAL) from a Digital Forensics & Incident Response (DFIR) perspective with Purav Desai, an experienced M365/Azure Incident Responder. Purav's LinkedIn (https://www.linkedin.com/in/purav-da346393/) Deciphering UAL (https://github.com/PuravsPoint/DecipheringUAL) Learn about auditing solutions in Microsoft Purview (https://learn.microsoft.com/en-us/purview/audit-solutions-overview) _____________ TIMESTAMPS 00:00 Intro 00:49 Microsoft 365 Auditing 04:43 The Deciphering UAL Project 07:55 Accessing Purview Audit 17:41 Outro _____________ ⚡️JOIN 6,000+ CWX MEMBERS ON DISCORD (https://discord.gg/cyberwoxacademy) 📰 SUBSCRIBE TO THE CYBERWOX UNPLUGGED NEWSLETTER (https://cyberwoxunplugged.com) 🥶 CYBERWOX MERCH (https://store.cyberwox.com) _____________ 🧬 CYBERWOX RESOURCES 🔹 Cyberwox Cybersecurity Notion Templates for planning your career (https://daycyberwox.gumroad.com/l/cyberlearningframework) 🔹 Cyberwox Best Entry-Level Cybersecurity Resume Template (https://daycyberwox.gumroad.com/l/cybersecurityresume) 🔹 Learn AWS Threat Detection with my LinkedIn Learning Course (https://www.linkedin.com/learning/introduction-to-aws-threat-detection/) _____________ 📱 LET'S CONNECT → IG (https://www.instagram.com/daycyberwox) → Threads (https://www.threads.net/@daycyberwox) → Substack (https://substack.com/@cyberwox) → Twitter (https://twitter.com/DayCyberwox) → Linkedin (https://www.linkedin.com/in/dayspringjohnson/) → Tiktok (https://www.tiktok.com/@cyberwox) Email: day@cyberwox.com _____________ ⚠️DISCLAIMER This description has some affiliate links, and I may receive a small commission for purchases made through these links. I appreciate your support! Email: day@cyberwox.com

29 Apr 2025
Attack & Detection of a Cloud Security Breach with 0xd4y | EP. 3
This episode covers an attack scenario very similar to the one that led to the breach of US Bank Capital One. @0xd4y (https://studio.youtube.com/channel/UCSumP9z5Rzquqih-jpusTOQ) goes over the attack scenario using CloudGoat by Rhino Security Labs, and I detect his activities using AWS CloudTrail Lake. _____________ 🧬 VIDEO RESOURCES 🔹 Segev's YouTube Channel: @0xd4y (https://studio.youtube.com/channel/UCSumP9z5Rzquqih-jpusTOQ) 🔹 Segev's walkthrough (https://www.youtube.com/watch?v=1MS0GPwmVMI&t=77s) 🔹 Former AWS engineer convicted over hack that cost Capital One $270m (https://techmonitor.ai/technology/cybersecurity/capital-one-hack-aws-paige-thompson) 🔹 CloudGoat (https://github.com/RhinoSecurityLabs/cloudgoat) 🔹 Instance Metadata (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html) 🔹 Sneaky Endpoints (https://github.com/Frichetten/SneakyEndpoints) 🔹 AWSealion (https://github.com/0xd4y/AWSealion) 🔹 GuardDuty Findings (https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_findings.html) 🔹 CloudTrail Lake (https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-lake.html) _____________ ⏰ TIMESTAMPS 00:00 Intro 00:34 Attack Scenario 00:51 Key Terminology 01:41 Cloud Attack Walkthrough - CloudGoat 10:06 Attack Detection Walkthrough - CloudTrail Lake 13:44 Remediation & Final Thoughts _____________ ⚡️JOIN 6,000+ CWX MEMBERS ON DISCORD (https://discord.gg/cyberwoxacademy) 📰 SUBSCRIBE TO THE CYBERWOX UNPLUGGED NEWSLETTER (https://cyberwoxunplugged.com) 🥶 CYBERWOX MERCH (https://store.cyberwox.com) _____________ 🧬 CYBERWOX RESOURCES 🔹 Cyberwox Cybersecurity Notion Templates for planning your career (https://daycyberwox.gumroad.com/l/cyberlearningframework) 🔹 Cyberwox Best Entry-Level Cybersecurity Resume Template (https://daycyberwox.gumroad.com/l/cybersecurityresume) 🔹 Learn AWS Threat Detection with my LinkedIn Learning Course (https://www.linkedin.com/learning/introduction-to-aws-threat-detection/) _____________ 📱 LET'S CONNECT → IG (https://www.instagram.com/daycyberwox) → Threads (https://www.threads.net/@daycyberwox) → Substack (https://substack.com/@cyberwox) → Twitter (https://twitter.com/DayCyberwox) → Linkedin (https://www.linkedin.com/in/dayspringjohnson/) → Tiktok (https://www.tiktok.com/@cyberwox) Email: day@cyberwox.com _____________ ⚠️DISCLAIMER This description has some affiliate links, and I may receive a small commission for purchases made through these links. I appreciate your support! Email: day@cyberwox.com

29 Apr 2025
The Anatomy of a Google Cloud (GCP) Cryptomining Attack | EP. 2
GCP Service Accounts are interesting cloud identities. Let's review how they contributed to a Cryptocurrency Mining Attack in this Case. _____________ 🧬 EPISODE RESOURCES 🔹How A Compromised AWS Lambda Function Led to a Phishing Attack (https://open.spotify.com/episode/7dMtbuN3wtRjQpMNcuIvEA?si=b5n4tlE4T_qD7rE029XWHg) 🔹GCP Lateral Movement & PrivEsc (https://www.youtube.com/watch?v=Ml09R38jpok) 🔹GCP Service Accounts (https://cloud.google.com/compute/docs/access/service-accounts) 🔹 DEFCON 30 Cloud Village - Weather Proofing GCP Defaults (https://www.youtube.com/watch?v=7t29F8nIAt8) 🔹GCP IAM basic and predefined roles reference (https://cloud.google.com/iam/docs/understanding-roles) _____________ ⏰ TIMESTAMPS 00:00 How GCP Service Accounts Work 02:12 Initial Access - Stolen Service Account Credentials 02:52 Attack Flow 03:33 Privilege Escalation - Permission Upgrades 03:50 Detection Opportunity 1 04:04 Defense Evasion - Firewall Rule Modification 05:19 Detection Opportunity 2 05:38 1,600 VMs created during attack 05:51 Persistence - New Token Creations 06:16 Final Thoughts _____________ ⚡️JOIN 6,000+ CWX MEMBERS ON DISCORD (https://discord.gg/cyberwoxacademy) 📰 SUBSCRIBE TO THE CYBERWOX UNPLUGGED NEWSLETTER (https://cyberwoxunplugged.com) 🥶 CYBERWOX MERCH (https://store.cyberwox.com) _____________ 🧬 CYBERWOX RESOURCES 🔹 Cyberwox Cybersecurity Notion Templates for planning your career (https://daycyberwox.gumroad.com/l/cyberlearningframework) 🔹 Cyberwox Best Entry-Level Cybersecurity Resume Template (https://daycyberwox.gumroad.com/l/cybersecurityresume) 🔹 Learn AWS Threat Detection with my LinkedIn Learning Course (https://www.linkedin.com/learning/introduction-to-aws-threat-detection/) _____________ 📱 LET'S CONNECT → IG (https://www.instagram.com/daycyberwox) → Threads (https://www.threads.net/@daycyberwox) → Substack (https://substack.com/@cyberwox) → Twitter (https://twitter.com/DayCyberwox) → Linkedin (https://www.linkedin.com/in/dayspringjohnson/) → Tiktok (https://www.tiktok.com/@cyberwox) Email: day@cyberwox.com _____________ ⚠️DISCLAIMER This description has some affiliate links, and I may receive a small commission for purchases made through these links. I appreciate your support! Email: day@cyberwox.com

29 Apr 2025
How A Compromised AWS Lambda Function Led to a Phishing Attack | EP. 1
In this video, I’ll be going over detection opportunities at various stages of cloud security attacks. Compromised Cloud Compute Credentials: Case Studies From the Wild (https://unit42.paloaltonetworks.com/compromised-cloud-compute-credentials/#post-125981-_kdq0vw6banab) _____________ TIMESTAMPS 00:00 Intro 00:40 The Attack Case 02:12 The Attack Graph 02:44 The Attack Flow 03:06 Detection Opportunity 1: Enumeration/Reconnaissance/Discovery - Cloud Infrastructure Discovery 05:27 Detection Opportunity 2: Persistence - Create Cloud Account 08:19 Detection Opportunity 3: Impact - Resource Hijacking 09:54 Detection Opportunity 4: Defense Evasion - Indicator Removal 10:23 Detection Opportunity 5: Credential Access - Stealing an application access token 12:04: Conclusion _____________ ⚡️JOIN 6,000+ CWX MEMBERS ON DISCORD (https://discord.gg/cyberwoxacademy) 📰 SUBSCRIBE TO THE CYBERWOX UNPLUGGED NEWSLETTER (https://cyberwoxunplugged.com) 🥶 CYBERWOX MERCH (https://store.cyberwox.com) _____________ 🧬 CYBERWOX RESOURCES 🔹 Cyberwox Cybersecurity Notion Templates for planning your career (https://daycyberwox.gumroad.com/l/cyberlearningframework) 🔹 Cyberwox Best Entry-Level Cybersecurity Resume Template (https://daycyberwox.gumroad.com/l/cybersecurityresume) 🔹 Learn AWS Threat Detection with my LinkedIn Learning Course (https://www.linkedin.com/learning/introduction-to-aws-threat-detection/) _____________ 📱 LET'S CONNECT → IG (https://www.instagram.com/daycyberwox) → Threads (https://www.threads.net/@daycyberwox) → Substack (https://substack.com/@cyberwox) → Twitter (https://twitter.com/DayCyberwox) → Linkedin (https://www.linkedin.com/in/dayspringjohnson/) → Tiktok (https://www.tiktok.com/@cyberwox) Email: day@cyberwox.com _____________ ⚠️DISCLAIMER This description has some affiliate links, and I may receive a small commission for purchases made through these links. I appreciate your support! Email: day@cyberwox.com
Reach and audience
Public platform figures. Ratings count people who left a rating, not total listeners.
- Apple Podcasts (US)
- 5.0 / 5
- 1 ratings
Podcast Authority Score: 40 / 100
A composite of feed quality, social presence, YouTube performance and engagement. Read the methodology.
- Quality
- 60
- Social presence
- 100
- YouTube
- 0
- Engagement
- 0
Contact Detection Opportunities
- Guest appearances
- Books guests
Based on episode analysis; this does not confirm that the show is currently accepting guests.
Host of Detection Opportunities?
Claim your podcast to manage its listing and keep your show details accurate.
Pod Engine is an independent podcast discovery and analytics service and is not affiliated with or endorsed by this podcast. Artwork and show content belong to their owners. Full legal notice.
Explore this show
Podcast research with Pod Engine