[Write-up title]
Summary
[Two or three sentences a recruiter can read in ten seconds: what the task was, what you did, what you found.]
1. Objective & scope
[What were you asked to investigate or compromise? What was in scope? What evidence or access did you start with?]
2. Environment & tools
- [Tool and version] – [what you used it for]
- [Tool and version] – [what you used it for]
3. Methodology
[Walk through your steps in order. Explain why you took each step, not only what you typed. That reasoning is what employers look for.]
# Example command or query
index=main sourcetype=WinEventLog EventCode=4625
| stats count by src_ip, user
| where count > 10[Explain what the output showed and what you did next.]
4. Findings
| # | Finding | Evidence | MITRE ATT&CK |
|---|---|---|---|
| 1 | [What you found] | [Log line, artefact, timestamp] | [e.g. T1110 Brute Force] |
| 2 | [What you found] | [Log line, artefact, timestamp] | [Technique ID] |
5. Indicators of compromise
- [IP / domain / hash, defanged, e.g. 10.10.10[.]5 or hxxp://example[.]com]
6. Remediation & recommendations
- [What should the organisation do to fix or detect this?]
7. Lessons learned
[What did you get stuck on? What would you do differently? What will you practise next?]