Create soc-analyst.md
This commit is contained in:
rpriven
GitHub
parent
338bc8b3a0
commit
ddbb1c0beb
1 changed files with 192 additions and 0 deletions
192
infosec/soc-analyst.md
Normal file
192
infosec/soc-analyst.md
Normal file
|
|
@ -0,0 +1,192 @@
|
|||
# Entry-Level SOC Analyst Cheatsheet
|
||||
|
||||
## Security Monitoring Fundamentals
|
||||
|
||||
| Concept | Description | Examples |
|
||||
|---------|-------------|----------|
|
||||
| **Security Incident** | Any event that potentially threatens security | Malware infection, unauthorized access, data breach |
|
||||
| **Alert Triage** | Process of evaluating and prioritizing alerts | Critical (1), High (2), Medium (3), Low (4) |
|
||||
| **False Positive** | Alert that incorrectly indicates malicious activity | Legitimate admin activity flagged as suspicious |
|
||||
| **False Negative** | Failure to detect actual malicious activity | Intrusion not generating alerts |
|
||||
| **IOC (Indicator of Compromise)** | Evidence of potential security breach | Malicious IP, hash, domain, unusual behavior |
|
||||
| **TTP (Tactics, Techniques, Procedures)** | Patterns of adversary behavior | MITRE ATT&CK framework behaviors |
|
||||
| **SIEM (Security Information and Event Management)** | Centralized log collection and analysis platform | Splunk, ELK Stack, QRadar, LogRhythm |
|
||||
| **Use Case** | Specific detection scenario with defined logic | Detect multiple failed logins across systems |
|
||||
| **Playbook** | Step-by-step response procedure | Malware containment playbook |
|
||||
|
||||
## Log Analysis Fundamentals
|
||||
|
||||
| Log Type | Key Information | Important Fields |
|
||||
|----------|-----------------|------------------|
|
||||
| **Windows Event Logs** | Windows system and security events | EventID, Account Name, Process ID, Logon Type |
|
||||
| **Authentication Logs** | Login attempts and session data | Username, Source IP, Timestamp, Success/Failure |
|
||||
| **Firewall Logs** | Network traffic allowed/blocked | Source/Destination IP, Port, Action, Protocol |
|
||||
| **Web Server Logs** | HTTP/HTTPS request details | Client IP, Request URL, Status Code, User-Agent |
|
||||
| **DNS Logs** | Domain resolution requests | Query Name, Query Type, Response, Client IP |
|
||||
| **Proxy Logs** | Web traffic details | URL, User, Category, Action, Bytes Transferred |
|
||||
| **VPN Logs** | Remote access connections | Username, Source IP, Connection Duration, Bytes |
|
||||
| **Email Logs** | Email transaction details | Sender, Recipient, Subject, Attachments, Headers |
|
||||
|
||||
## Critical Windows Event IDs
|
||||
|
||||
| Event ID | Description | Why It Matters |
|
||||
|----------|-------------|----------------|
|
||||
| 4624 | Successful logon | Establish access patterns & identify unusual logins |
|
||||
| 4625 | Failed logon | May indicate brute force attempts |
|
||||
| 4720 | User account created | Potential unauthorized account creation |
|
||||
| 4722 | User account enabled | Account status changes |
|
||||
| 4724 | Password reset attempt | Potential credential compromise |
|
||||
| 4728/4732/4756 | User added to security group | Privilege escalation |
|
||||
| 4776 | Successful/failed account authentication | Credential validation activity |
|
||||
| 7045 | Service installed | Potential persistence mechanism |
|
||||
| 4688 | Process creation | Command execution monitoring |
|
||||
| 4698 | Scheduled task created | Potential persistence technique |
|
||||
| 1102 | Audit log cleared | Potential evidence tampering |
|
||||
| 4672 | Special privileges assigned to new logon | Admin or sensitive privilege assignment |
|
||||
|
||||
## Linux Logs to Monitor
|
||||
|
||||
| Log File | Content | Suspicious Signs |
|
||||
|----------|---------|------------------|
|
||||
| `/var/log/auth.log` or `/var/log/secure` | Authentication attempts | Multiple failed logins, unusual login times |
|
||||
| `/var/log/syslog` | General system logs | Unexpected service restarts, errors |
|
||||
| `/var/log/messages` | General system messages | System errors, hardware failures |
|
||||
| `/var/log/apache2/access.log` | Web server access | Directory traversal, unusual user agents |
|
||||
| `/var/log/apache2/error.log` | Web server errors | SQL injection attempts, execution errors |
|
||||
| `/var/log/cron` | Scheduled task execution | Unauthorized cron jobs |
|
||||
| `/var/log/lastlog` | Last login information | Login from unusual locations |
|
||||
| `/var/log/wtmp` & `/var/log/btmp` | Login records & failed attempts | Multiple failed logins |
|
||||
| `~/.bash_history` | Command history | Suspicious commands, data exfiltration |
|
||||
|
||||
## SIEM Query Examples (Splunk SPL)
|
||||
|
||||
| Use Case | Example Query | Purpose |
|
||||
|----------|--------------|---------|
|
||||
| Failed Logins | `index=windows EventCode=4625 \| stats count by src_ip, user` | Detect potential brute force |
|
||||
| Suspicious PowerShell | `index=windows EventCode=4688 process="*powershell*" "-enc*" \| table Computer, user, process, CommandLine` | Find encoded PowerShell commands |
|
||||
| Account Creation | `index=windows EventCode=4720 \| table _time, user, Account_Name` | Monitor user creation |
|
||||
| Privilege Escalation | `index=windows (EventCode=4728 OR EventCode=4732 OR EventCode=4756) Group_Name="*admin*" \| table _time, user, Account_Name, Group_Name` | Detect admin group additions |
|
||||
| Lateral Movement | `index=windows EventCode=4624 Logon_Type=3 \| stats count by dest, src, user` | Identify network logons |
|
||||
| Suspicious DNS | `index=dns query_type=A \| stats count by query, answer \| where count < 5` | Find rare DNS queries |
|
||||
| Persistence | `index=windows (EventCode=4698 OR EventCode=7045) \| table _time, Computer, user, Service_Name, Service_File_Name` | Detect scheduled tasks or services |
|
||||
| C2 Traffic | `index=proxy method=POST \| stats sum(bytes_out) as outbound by url, src_ip \| where outbound > 1000000` | Find large data uploads |
|
||||
|
||||
## Common SOC Tools
|
||||
|
||||
| Tool Type | Examples | Use Cases |
|
||||
|-----------|----------|-----------|
|
||||
| **SIEM** | Splunk, ELK Stack, QRadar | Centralized log analysis, alert generation |
|
||||
| **EDR** | CrowdStrike, SentinelOne, Microsoft Defender for Endpoint | Endpoint protection and response |
|
||||
| **Network Monitoring** | Wireshark, Zeek, Suricata | Packet analysis, network IDS |
|
||||
| **Threat Intelligence** | VirusTotal, OTX, MISP | IOC lookup, threat data correlation |
|
||||
| **Sandbox** | Cuckoo, ANY.RUN, Hybrid Analysis | Malware analysis in isolated environment |
|
||||
| **Vulnerability Scanner** | Nessus, OpenVAS, Qualys | Identify system vulnerabilities |
|
||||
| **Case Management** | TheHive, RTIR, ServiceNow | Track and manage incidents |
|
||||
| **Phishing Analysis** | PhishTool, URL2PNG, Email Header Analyzer | Analyze suspicious emails |
|
||||
|
||||
## Incident Response Steps
|
||||
|
||||
| Phase | Actions | Documentation |
|
||||
|-------|---------|---------------|
|
||||
| **1. Preparation** | Develop IR plans, implement security controls | IR policy, playbooks, contact lists |
|
||||
| **2. Identification** | Detect and validate security incidents | Alert data, initial findings report |
|
||||
| **3. Containment** | Isolate affected systems to prevent spread | Containment actions report |
|
||||
| **4. Eradication** | Remove malware/compromise from systems | Cleanup procedures performed |
|
||||
| **5. Recovery** | Restore systems to normal operation | Recovery validation checklist |
|
||||
| **6. Lessons Learned** | Document findings and improve process | Post-incident report |
|
||||
|
||||
## Common Attack Vectors & Detection Methods
|
||||
|
||||
| Attack Type | Indicators | Detection Methods |
|
||||
|-------------|------------|-------------------|
|
||||
| **Phishing** | Suspicious emails, malicious links/attachments | Email filtering logs, user reports, URL analysis |
|
||||
| **Malware** | Unusual processes, network connections, file modifications | AV/EDR alerts, file hash analysis, behavioral analysis |
|
||||
| **Brute Force** | Multiple failed authentication attempts | Auth logs, threshold alerting, account lockouts |
|
||||
| **Credential Stuffing** | Successful logins from various locations/devices | Auth logs, impossible travel detection |
|
||||
| **Web Application Attacks** | SQL injection, XSS, path traversal in web logs | WAF logs, web server logs, error patterns |
|
||||
| **Privilege Escalation** | Unexpected admin actions, permission changes | User permission auditing, process monitoring |
|
||||
| **Data Exfiltration** | Large outbound transfers, unusual destinations | Proxy/firewall logs, DLP alerts, NetFlow analysis |
|
||||
| **Living Off The Land** | Abuse of legitimate tools (PowerShell, WMI, etc.) | Command-line logging, script block logging, behavioral analysis |
|
||||
|
||||
## Network Traffic Analysis Basics
|
||||
|
||||
| Protocol | Port | Suspicious Indicators |
|
||||
|----------|------|------------------------|
|
||||
| **HTTP/HTTPS** | 80/443 | Unusual user-agents, base64 in URLs, unusual domains/paths |
|
||||
| **DNS** | 53 | Domain generation algorithms, DNS tunneling, unusual TXT records |
|
||||
| **SMB** | 445 | Unauthorized access attempts, unusual file operations |
|
||||
| **RDP** | 3389 | Brute force attempts, unauthorized connections |
|
||||
| **SSH** | 22 | Brute force attempts, connections from unusual locations |
|
||||
| **FTP** | 21 | Anonymous access, unauthorized file transfers |
|
||||
| **SMTP/POP3/IMAP** | 25, 110, 143 | Unusual volume, unauthorized relay attempts |
|
||||
| **NetFlow Indicators** | N/A | Unusual data volume, beaconing, scan patterns |
|
||||
|
||||
## Malware Types & Characteristics
|
||||
|
||||
| Malware Type | Behavior | Common Indicators |
|
||||
|--------------|----------|-------------------|
|
||||
| **Virus** | Self-replicating, infects other files | Modified system files, integrity failures |
|
||||
| **Worm** | Self-propagating across networks | Unusual network traffic, port scanning |
|
||||
| **Trojan** | Disguised as legitimate software | Unexpected network connections, hidden processes |
|
||||
| **Ransomware** | Encrypts data for ransom | File encryption, ransom notes, destruction of backups |
|
||||
| **Rootkit** | Hides deep in system to avoid detection | Hidden processes, modified system calls |
|
||||
| **Backdoor** | Provides persistent remote access | Unexpected listening ports, unusual connections |
|
||||
| **Keylogger** | Records keystrokes | Unusual process access to input devices, suspicious files |
|
||||
| **Fileless Malware** | Operates in memory without files | PowerShell/WMI activity, unusual registry changes |
|
||||
| **Cryptominer** | Uses resources to mine cryptocurrency | High CPU usage, mining pool connections |
|
||||
|
||||
## Basic Threat Hunting Concepts
|
||||
|
||||
| Concept | Description | Example Implementation |
|
||||
|---------|-------------|------------------------|
|
||||
| **Threat Hunting Hypothesis** | Question-based approach to investigate potential compromise | "Are users running unsigned PowerShell scripts?" |
|
||||
| **IOC Searching** | Hunting for known indicators | Search for known malicious hashes or domains |
|
||||
| **TTP Hunting** | Hunting for attack techniques regardless of tools | Search for any evidence of credential dumping behavior |
|
||||
| **Baselining** | Establishing normal to find abnormal | Document normal authentication patterns to spot anomalies |
|
||||
| **Stacking** | Analyzing frequency distributions to find outliers | Stack process names to find rare processes |
|
||||
| **Clustering** | Grouping similar events to spot anomalies | Cluster login times to find unusual access patterns |
|
||||
|
||||
## MITRE ATT&CK Framework Fundamentals
|
||||
|
||||
| Tactic | Description | Example Techniques |
|
||||
|--------|-------------|-------------------|
|
||||
| **Initial Access** | How attackers get in | Phishing, exploitation of public-facing application |
|
||||
| **Execution** | Running malicious code | Command line interface, PowerShell, scripts |
|
||||
| **Persistence** | Maintaining access | Registry Run keys, scheduled tasks, startup items |
|
||||
| **Privilege Escalation** | Getting higher permissions | Access token manipulation, bypass UAC |
|
||||
| **Defense Evasion** | Avoiding detection | File deletion, clearing logs, obfuscation |
|
||||
| **Credential Access** | Stealing credentials | Credential dumping, keylogging, brute force |
|
||||
| **Discovery** | Learning the environment | Network/account/system discovery |
|
||||
| **Lateral Movement** | Moving through environment | Pass the hash, remote services |
|
||||
| **Collection** | Gathering data of interest | Input capture, screen capture, data from local system |
|
||||
| **Command and Control** | Communicating with victims | Encrypted communications, web protocols |
|
||||
| **Exfiltration** | Stealing data | Data compressed, encrypted, transferred |
|
||||
| **Impact** | Disrupting business/operations | Data encryption, system shutdown, defacement |
|
||||
|
||||
## Useful CLI Commands for Incident Response
|
||||
|
||||
| OS | Command | Purpose |
|
||||
|----|---------|---------|
|
||||
| **Windows** | `Get-Process \| Where-Object {$_.Company -eq $null}` | Find processes with no company name |
|
||||
| | `Get-WinEvent -FilterHashtable @{Logname='Security';ID=4624} -MaxEvents 10` | View recent successful logons |
|
||||
| | `netstat -ano \| findstr ESTABLISHED` | View established connections |
|
||||
| | `schtasks /query /fo LIST /v` | List all scheduled tasks with details |
|
||||
| | `wmic startup list full` | List all startup items |
|
||||
| | `wmic process get caption,commandline,processid` | List running processes with command lines |
|
||||
| **Linux** | `ps auxf` | Show process tree |
|
||||
| | `netstat -tulpn` | Show active connections and listening ports |
|
||||
| | `lsof -i` | List open files and network connections |
|
||||
| | `grep -i "failed password" /var/log/auth.log` | Find failed login attempts |
|
||||
| | `find / -mtime -1 -ls` | Find files modified in the last day |
|
||||
| | `cat /var/log/auth.log \| grep -E 'session opened\|session closed'` | Find user sessions |
|
||||
|
||||
## Cyber Threat Intelligence Resources
|
||||
|
||||
| Resource Type | Examples | Use Cases |
|
||||
|---------------|----------|-----------|
|
||||
| **Open Source Feeds** | AlienVault OTX, MISP, ThreatFox | Collect IOCs, research campaigns |
|
||||
| **Vendor Blogs** | Mandiant, CrowdStrike, Microsoft Security | Technical analysis of threats |
|
||||
| **Government Resources** | US-CERT, MS-ISAC, CISA Advisories | Vulnerability and threat alerts |
|
||||
| **Malware Databases** | VirusTotal, Hybrid Analysis, MalwareBazaar | File reputation, malware analysis |
|
||||
| **IP/Domain Reputation** | AbuseIPDB, Cisco Talos, URLhaus | Check for known malicious addresses |
|
||||
| **Sandbox Analysis** | ANY.RUN, Joe Sandbox, Cuckoo | Dynamic malware analysis |
|
||||
Loading…
Add table
Reference in a new issue