Practical SOC Analyst T1/T2 Preparation Course

Set up a safe sandboxed, isolated home lab for malware analysis using VirtualBox with two VMs: Linux Remnux and Windows 10, configured in NAT with optional guest additions.

Configure an isolated internal network for the lab using VirtualBox, assigning 10.0.0.x addresses and enabling VM-to-VM ping while blocking internet access to protect malware analysis.

Identify command and control (C2) channels attackers use to command compromised systems and signal active compromises through C2 indicators such as IPs, domains, and unusual traffic.

Learn how IOCs drive detection and investigation by tracing alerts across logs, emails, endpoints, and networks. Block IOCs and support threat intelligence sharing to prevent future attacks.

Discover how reputation checkers enrich raw iocs with threat intelligence to determine whether an observable is malicious, suspicious, or benign, reducing false positives and guiding escalation.

Explore IOCs from daily feeds to practice threat analysis, using abuse.ch and GitHub sources to access categorized URL and other IOC types, and learn how to analyze them.

Identify and compare phishing types such as email, spear, whaling, smishing, vishing, and quishing to classify methods and recognize attacker techniques.

Detect phishing by recognizing urgency, channel changes, spoofing, impersonation, unusual senders, suspicious links or attachments, and out-of-context requests, plus business email compromise patterns.

Email headers reveal how messages travel, helping analysts trace origin and verify authenticity with SPF, DKIM, and DMARC, while examining from, subject, reply-to, and X-originating IP to detect spoofing.

Explore SPF, DKIM, and DMARC for SOC analysts to verify email legitimacy, with SPF matching sender IP to DNS and DMARC decides accept, quarantine, or reject.

Defending against phishing relies on layered defenses: email filtering and anti-phishing tools, user awareness training, account configurations with MFA and least privilege, and SOC monitoring to detect and contain threats.

Discover how IP addresses serve as logical identifiers to route data across internet and home networks, while MAC addresses provide fixed local identifiers to deliver data locally.

Explore the basics of IP addresses, focusing on IPv4, private and public IP addresses, and class a, b, and c ranges (10.x) for local networks and internet resources.

Explore the OSI model and its seven layers from application to physical, and see how encapsulation adds headers and decapsulation removes them for data delivery.

Learn how TCP provides reliable error-checked transmission through a connection-oriented three-way handshake, and how UDP is faster and connectionless, used when occasional packet loss is acceptable, as in video calls.

Learn key network protocols that enable device communication, including http/https, ftp/sftp, smtp, imap, pop3, dns, ssh, telnet, smb, and ldap, with their typical ports and encryption notes.

Analyze http and https from a soc analyst perspective to distinguish normal from abnormal web traffic and detect data exfiltration and web exploitation via http requests, methods, and status codes.

Analyze network traffic with Wireshark using PCAP samples and observe HTTP traffic in plain text. Inspect the TCP three-way handshake, HTTP requests, and server details for forensic insights.

Analyze a Telnet capture in Wireshark showing a TCP three-way handshake, login attempt on OpenBSD, ping connectivity, and an ls -a listing before session termination with fin and ack.

Explore how Windows uses processes and memory space, with unique PIDs and parent processes, to form a process tree that reveals malware behavior for stock analysts.

Explore Windows services via services.msc and sc.exe to create, start, and remove a mock malware service using fakehost.exe; test persistence across reboots and verify service cleanup.

Explore how Windows Task Scheduler automates execution on boot, logon, or recurring schedules, and how attackers abuse it for persistence, privilege escalation, and defense evasion, including triggers and actions.

Explore how scheduled tasks work in Flare VM, preview task details, define a PowerShell action and trigger, register a demo task, and manage tasks with get and unregister commands.

Investigate Windows Management Instrumentation and its role in system management and querying information. Learn how attackers abuse WMI event consumers for execution, persistence, and defense evasion with stealthy artifacts.

Learn how Windows event IDs power SOC investigations by mapping authentication, account management, and execution events across security, system, application, and setup logs for faster triage and threat hunting.

Investigate Windows event IDs by simulating login attempts and analyzing security logs in Event Viewer, focusing on 4625, 4624, and 4672 events, and logon types 2, 3, and 10.

Discover how sysmon provides detailed telemetry beyond Windows event logs for SOC analysts, highlighting process creation, network connections, and DNS queries.

Finish the malware analysis section and analyze malwares to observe how they use legitimate Windows components and modify them to perform malicious actions, then redo labs.

Explore essential linux paths for a soc analyst, including etc/passwd, etc/shadow, etc/group, sudoers, cron, authlog, syslog, lastlog, var/log, var/www, and the temp folder.

Learn linux network investigation: inspect interfaces with ip a and ifconfig, monitor connections with netstat and ss, and simulate beaconing with netcat on port 9999.

Simulate a live Linux host investigation; analyze /var/log, syslog, and authlog to detect an intruder, identify a new user with sudo privileges, and uncover a malicious script and cron persistence.

practice linux incident response by using Atomic Red Team or Caldera to simulate attacks, or have an AI generate a scenario, then perform analysis of Remnux logs and cron jobs.

Define malware as malicious software designed to harm systems, data, users, or organizations. Show how malware types and behaviors drive detection, investigation, persistence, and eradication for SOC analysts.

Explore static and dynamic analysis to understand malware without and with execution, identifying hashes, strings, obfuscation, and behavior like processes, registry changes, and network activity in a sandbox.

Configure inet sim in a malware analysis lab by setting static IPs on Flare VM and Remnux to log network traffic, enable DNS, and verify logs.

Explore malware sample acquisition from abuse.ch, Malware Bazaar, and virusshare.com, create and verify accounts, download and analyze binaries, and review analyses on any that run for hands-on practice.

Download Splunk Enterprise from splunk.com, start the 60-day free trial, unpack the files, set ownership, start Splunk, accept the license, create an administrator account, and log in at localhost:8000.

Analyze a Splunk-driven SOC alert from IP 40.80.148.42, revealing http traffic, suricata alerts, and a 3791.exe upload to imreallynotbatman.com, indicating a web shell and password attempts, prompting incident response.

Explore a Splunk-based investigation of a ransomware outbreak, tracing lateral movement, domain generation algorithm indicators, and cscript/vbs artifacts across Windows security logs and Fortigate network data.

Configure a Splunk universal forwarder on Windows and Flare VM to ship Windows event logs to a Splunk server over port 9997, using inputs.conf and deployment client settings.

Learn to create real-time Splunk alerts for brute force detection by tracking failed logon events (4625) with substatus, thresholds, and alert actions.

Explore how to obtain more Splunk sample data from bots capture the flag editions and Splunk tutorial data, upload them to Splunk, and create alerts from searches.