Letsdefend

Personal Experience Passing HTB CJCA: What to Know Before the Junior Cybersecurity Analyst Exam

A cybersecurity professional who recently transitioned careers shares a detailed account of completing the Hack The Box Certified Junior Cybersecurity Analyst certification. The exam combines practical red team and blue team tasks in a lab environment rather than multiple-choice questions. Preparation involved completing the full Junior Cybersecurity Analyst path in HTB Academy, practicing on Easy and Medium machines, and following the SOC Analyst Path on LetsDefend. The five-day exam requires separate passing scores in both offensive and defensive sections, with strong emphasis on professional reporting using SysReptor. Key lessons include maintaining organized notes per host, documenting findings with MITRE ATT&CK mappings, and preparing thoroughly for the second phase of alert triage and incident handling.

SOC Incident Analysis Exposes Active Exploitation of CVE-2025-53770 SharePoint ToolShell Auth Bypass and RCE

A detailed walkthrough of Letsdefend SOC342 demonstrates how analysts detected and confirmed exploitation of CVE-2025-53770 targeting SharePoint servers. The alert was triggered by a suspicious unauthenticated POST request to ToolPane.aspx carrying an unusually large payload and a spoofed referer. Investigation revealed that the vulnerable server accepted the request, after which PowerShell commands extracted ASP.NET cryptographic keys, enabling ViewState forgery and remote code execution. Attackers then compiled and dropped additional payloads using csc.exe and created a malicious spinstall0.aspx page that leveraged WScript.Shell to download further malware. Network indicators included the malicious IP 107.191.58.76 flagged by CISA and multiple VirusTotal detections. The server was isolated, files removed, and cryptographic keys rotated to contain the breach.