SOC for Blue Teaming

The bad pyramid shows how build, attack, and defend unite yellow builders, red attackers, blue defenders, and green DevSecOps to learn from attacker knowledge and harden infrastructure.

Blue team members monitor and detect security events across networks and hosts, conduct incident response, and optimize tools, policies, asset inventory, and staging isolation.

Identify and analyze the top 15 cyber threats shaping the landscape, including malware, web-based and web application attacks, phishing, ransomware, data breaches, insider threats, botnets, and cryptojacking.

Explore the MITRE ATT&CK framework and atomic red team for mapping attack techniques to blue and red team defense. Learn reconnaissance, active and passive scanning, and defense evasion concepts.

Explore what malware is, how analysts use malware bazaar, traffic analysis, and GitHub to study live samples like TrickBot and redline stealer, and how banking trojans spread and drop ransomware.

Analyze malware with VirusTotal using dynamic and static analysis, examine DLL imports and IP-based command-and-control activity across China and India.

Perform static analysis by decompiling malware with IDA or Ghidra to inspect code and hardcoded indicators, then conduct dynamic analysis in isolated sandboxes to observe network and system activities.

Parse and visualize web server logs with Splunk by generating logs, ingesting access and error logs, and building dashboards to identify anomalies and malicious IP addresses.

Explore malware analysis with a TrickBot sample in a sandbox, map behaviors to the MITRE framework, and examine T1012 registry activity reading computer name and language.

Explore system information discovery (T1082) in the MITRE attack framework, illustrating how threat groups and TrickBot query registries and identify administrator privileges.

Leverage Sysinternals Procmon and Process Explorer to map parent and child processes, analyze TrickBot malware, decompile with Ida Pro (or Ghidra), and monitor network activity for command and control servers.

Demonstrate decompiling malware with Ida Pro for static analysis, including assembly and strings, and observe runtime behavior with VirusTotal and TLS 1.3 traffic.

Analyze TrickBot malware traffic by inspecting a pcap in Wireshark, export http objects, reconstruct a zip artifact, and trace exfiltration via http post requests and system information commands.