Saljook Haider · BlogCyber Security Analyst · Security Operations · Incident Responsehttps://saljookhaider.com/When hackers turned supermarket freezers into ovens: Europe's refrigeration attacks explainedhttps://saljookhaider.com/blog/2026-11-02-supermarket-refrigeration-cyberattacks-europe/https://saljookhaider.com/blog/2026-11-02-supermarket-refrigeration-cyberattacks-europe/Two waves of attacks heated supermarket fridges to 50°C in France, then in Belgium, Luxembourg, Sweden, Estonia and Ireland. What happened, how internet-exposed refrigeration controllers were abused, and what SOC and OT teams should do now.Mon, 02 Nov 2026 18:00:00 GMTSysmon Event ID 13: catching registry persistence before it survives a reboothttps://saljookhaider.com/blog/2026-11-02-sysmon-event-id-13-registry-persistence/https://saljookhaider.com/blog/2026-11-02-sysmon-event-id-13-registry-persistence/What Sysmon Event ID 13 records, which registry keys attackers use to persist on Windows, and the Splunk searches I use to find them without drowning in noise.Mon, 02 Nov 2026 16:00:00 GMTAnalysing a phishing email with CyberChef: recipes that save timehttps://saljookhaider.com/blog/2026-11-02-phishing-analysis-with-cyberchef/https://saljookhaider.com/blog/2026-11-02-phishing-analysis-with-cyberchef/A practical walkthrough of phishing triage with CyberChef: extracting and defanging URLs, decoding Base64 and quoted-printable bodies, unpacking encoded PowerShell, and hashing attachments safely.Mon, 02 Nov 2026 15:00:00 GMTMapping an incident to MITRE ATT&CK: a practical guide for SOC analystshttps://saljookhaider.com/blog/2026-11-02-mapping-incidents-to-mitre-attack/https://saljookhaider.com/blog/2026-11-02-mapping-incidents-to-mitre-attack/How to turn raw investigation notes into an accurate MITRE ATT&CK mapping, with a worked example from phishing email to ransomware staging, common mistakes, and how to use the result for detection gaps.Mon, 02 Nov 2026 14:00:00 GMTAutomating IOC enrichment with Python and the VirusTotal APIhttps://saljookhaider.com/blog/2026-11-02-automating-ioc-enrichment-with-python/https://saljookhaider.com/blog/2026-11-02-automating-ioc-enrichment-with-python/A small, production-minded Python script that takes a list of hashes, domains and IPs, looks them up in VirusTotal, respects rate limits and writes a CSV you can attach to a ticket.Mon, 02 Nov 2026 13:00:00 GMTWindows logon types every SOC analyst should know (Event IDs 4624 and 4625)https://saljookhaider.com/blog/2026-11-02-windows-logon-types-for-soc-analysts/https://saljookhaider.com/blog/2026-11-02-windows-logon-types-for-soc-analysts/A field guide to Windows logon types 2 to 11: what each one means, which ones point to RDP, lateral movement or brute force, and Splunk searches to hunt with them.Mon, 02 Nov 2026 12:00:00 GMTHello, worldhttps://saljookhaider.com/blog/2026-11-02-hello-world/https://saljookhaider.com/blog/2026-11-02-hello-world/New domain, new site, and a terminal that actually works.Mon, 02 Nov 2026 09:00:00 GMT