Cyber Security Operations Center (CSOC) - SOC Analyst

Centralize and normalize logs from diverse sources into a single center to enable meaningful analysis and correlation using siem, syslog, and agents. Align time zones to ensure correlation between sources.

Explore the Microsoft Windows Event Viewer, categorize and access Windows logs, including application, system, forward events, and security logs, and practice auditing with group policy.

Enable and monitor group policy audit changes by configuring audit policy in local security policy, enabling process creation logging for success and failure to detect attacks and anomalies.

Explore syslog, syslog-ng, and how logs from IIS and Apache are centralized for SOC monitoring, with secure transmission, encryption, and MD5/SHA-1 integrity to prevent man in the middle attacks.

Explore Linux logging systems and Apache logs, including var/log locations and key log sources. Analyze authentication, boot, cron activity, and Apache access and error logs to support security monitoring.

Enable IIS logging in IIS Manager, customize log fields and the W3C format, and review raw logs for get requests, post bodies, and status codes.

Discover Sysmon, a Windows endpoint tool that expands logging with process, file, and hash data beyond event logs. See how event IDs, command lines, and image paths reveal suspicious activity.

Explore how IDS and IPS detect intrusions using pattern matching, anomaly, policy-based, and stateful protocol analysis; see how Snort logs trigger alerts and inline actions like drop, reset, and sinkhole.

Learn how endpoint protection logs integrate anti-malware, firewall, and IDS/IPS features in CrowdStrike and Symantec, and analyze IOCs, event names, and detections to identify suspicious activity.

Explore how IBM Qradar SIEM collects and displays logs, including IIS and DNS data, and how fields like date, source IP, cs-uri-stem, cs-uri-query, user agent, and payload influence detection.

Explore how denial of service (DoS) and distributed denial of service (DDoS) attacks overwhelm networks, often via botnets, and disable services for e-commerce sites during peak periods.

Phishing uses fake, trustworthy messages to steal personal or financial information by directing victims to fake websites; avoid untrusted links and use security software to block these attacks.

Spear phishing targets specific individuals or groups with personalized messages built from information about the victim. Unlike broad phishing, attackers tailor content using names, titles, and internal details.

Explore how a man-in-the-middle attack places an attacker between two parties to monitor or alter traffic, especially on open wifi, and how https, ssl, tls protect against mitm attacks.

A virus is a type of malicious software designed to damage systems and exfiltrate data, replicating by infecting files and spreading via email attachments, downloaded files, or USB drives.

Learn how worm malware replicates and spreads by exploiting vulnerabilities, impacts performance and network traffic, and how to defend with updates, firewalls, email hygiene, strong passwords, backups, and user education.

Learn what spyware is, how it quietly monitors activity and collects information such as keyboard input and browser history, and how to protect yourself with anti-spyware software and up-to-date systems.

Identify adware as a malware type bundled with freeware and protect devices by reviewing software sources, enabling pop-up blockers, using up-to-date anti-malware, and choosing custom installation options.

Explore how Trojan malware stealthily infiltrates systems to steal data, disguising itself as harmless content. Implement antivirus scans, cautious emails, updates, training, and network protections to defend against it.

Discover how botnets form when malware infects devices, connects to a control server, and coordinates DDoS attacks; protect systems with strong passwords, software updates, antivirus, email caution, firewalls, and backups.

Explore ransomware and malware, where attackers encrypt files or systems and demand a ransom for decryption. Use regular backups, updated software, antivirus scans, and avoid suspicious emails and downloads.

Explore the cyber kill chain model developed by Lockheed Martin, detailing stages from reconnaissance to actions on objectives and how each stage enables detection and prevention.

Mitre attack framework as a knowledge base of tactics, techniques, and procedures to classify attacks and build defense strategies across enterprise, mobile, and ICS environments.

Explore how tactics, techniques and procedures shape defense strategies, identifying attacker objectives, describing actions under tactics, and applying techniques such as spearfishing and scheduled tasks for persistence.

Analyze initial access techniques in the Mitre attack framework, focusing on exploit of public facing applications and spearphishing, and review mitigations like network segmentation, updates, and vulnerability scanning.

Explore the execution tactic, including malware and script execution, and how command and scripting interpreters like PowerShell, Python, and bash enable remote access and attacks.

Explore persistence techniques attackers use to gain long-term access, including scheduled tasks, Windows services, startup folders, and registry keys, with defense implications.

Explore how attackers escalate from low to high privileges by exploiting vulnerabilities or misconfigurations, and use process injection to gain and maintain privileged access.

Explore defense evasion techniques to bypass detection, including masquerading, impaired defenses, and disabling or modifying tools, event logging, and sensor telemetry used by APT groups.

Examine the credential access tactic, including os credential dumping from lsass memory, brute force attacks, and unsecured credentials, and learn how attackers gain authorization and propagate through a network.

Explore the discovery phase, where attackers gather data on network topology, configurations, and user accounts. Examine network sniffing and file and directory discovery to access sensitive information.

Examine lateral movement as attackers roam networks using remote services and pass the hash, exploiting remote access tools like RDP, SSH, SMB, and VNC.

Explains the collection tactic attackers use to gather sensitive data, including archive data and email collection, and outlines monitoring, data classification, encryption, and access controls to prevent theft.

Explore command and control tactics used by attackers, including application layer protocols, data obfuscation, and non-standard ports, to conceal communications with compromised systems.

Exfiltration tactics cover size-limited transfers, fragmentation, and encryption to avoid detection, including exfiltration via C2 channels. The impact tactic causes data loss and disruption, defended by access control and backups.

Explore how APT-developed malware uses a dropper and downloader to install and update malicious payloads, evade detection, and enable remote access through Banduk malware, shellcode, and code injection.

Detect suspicious processes by examining unknown names, camouflage, unsigned or misaligned signatures, and atypical parent-child relationships; assess registry, file system, startup, and network interactions to guide remediation.

Compare IOC and IOA to distinguish traces from attacker goals. See how IOC detects post-attack indicators like IPs, hashes, and domains, while IOA tracks active attacker behavior.

Analyze the Exodus xor ddos linux trojan, including infiltration via ssh brute force, curl downloads, persistence through cron and autostart, and xor-encrypted data exfiltration and ddos actions.

Explore Wireshark, a network analysis tool that captures and analyzes packets, using display filters, TCP follow streams, and protocol-based views to identify HTTP vs HTTPS traffic and attack signatures.

Analyze Emotet malware traffic from a pcap using Wireshark, enable DNS resolution, filter HTTP on ports 8443 and 8080, inspect 200 responses, and download the DLL for analysis.

Monitor Windows event ID 4625 failed logins to detect anomalies, applying rules for 5+ attempts in two minutes and 10+ logins from different usernames from the same source.

Detect anomaly in login activities by analyzing event id 4624, focusing on successful remote logins, non-subnet sources, rapid logins from multiple IPs, and failed login attempts to trigger automated alerts.

Analyze event ID 5143, which logs network share object modifications and sed values, records old and new permissions, aiding detection of suspicious permission changes and potential attacks.

Detect Windows registry key changes that attackers use for persistence by examining event id 4657, reg add activity, and suspicious processes like Mimikatz in the Sysmon logs.

Learn to detect scheduled task anomalies using event IDs 4698–4702, logon events, and process creations to identify persistence and unauthorized task changes for system security.

Detect process masquerading by spotting malicious processes that imitate legitimate ones and OS tools using abnormal paths. Use signature- and behavior-based detection with whitelisting and EDR/IPS for a multi-layered defense.

Detect unusual parent-child process relationships to spot early security threats, and build anomaly rules and Siam alerts using a reference table of expected parent and child process names.

Analyze firewall logs with anomaly detection to stop local-to-remote, remote-to-local, and local-to-local threats. Leverage threat intelligence, unusual-port detection, geo-blocked IPs, and traffic rules to raise alarms and isolate infected hosts.

Detect anomalies in proxy logs to identify phishing, data exfiltration, and malware by analyzing fields such as destination host, user agent, request method, and domain category.

Analyze DNS logs to detect anomalies by examining client IP address, query name, query type, response code, and DNS server, then flag malicious domains and DGA activity via threat intelligence.