SOC Level 1

Agenda

Day 1

• Class Introduction
• Lab Access, Setup, and Configuration
• Understanding the SOC
• Understanding Phishing Attacks and Techniques
• Email Analysis
• URL Analysis
• Attachment Analysis
• MalDoc Analysis
• Phishing Defenses
• Ticket Challenge – Walkthrough and Break
• Understanding Packets and Flows
• Network Traffic Analysis with TCPDump
• Network Traffic Analysis with Wireshark
• Ticket Challenge

Day 2

• Understanding Endpoint Security
• Windows – Hunting Malicious Network Connections
• Windows – Hunting Malicious Processes
• Live IR with SysInternals and Autoruns
• Windows – Understanding Core Processes
• Windows – Hunting Persistence
• Ticket Challenge – Walkthrough and Break
• Linux – Hunting Malicious Network Connections
• Linux – Hunting Malicious Processes
• Linux – Understanding Core Processes
• Linux – Hunting Persistence
• Ticket Challenge – Walkthrough and Break
• Understanding the SIEM
• Common Attack Signatures
• Command Line Log Analysis
• Ticket Challenge

Day 3

• Splunk Introduction
• Search Processing Language
• Search Commands
• Reporting, Alerting, and Dashboards
• Investigating Intrusions with Splunk
• Deploying Forwarders
• Ticket Challenge – Walkthrough and Break
• Understanding Threat Intelligence
• Threat Intelligence Frameworks
• MITRE ATT&CK
• Ticket Challenge – Walkthrough and Break
• Detecting Malware with YARA
• Reading and Writing YARA Rules
• Ticket Challenge

Day 4

• Understanding Digital Forensics Investigations
• Disk Image Acquisition with FTK Imager
• Memory Acquisition with FTK Imager
• Ticket Challenge – Walkthrough and Break
• Windows Forensic Artifacts
• Forensic Image Analysis with Autopsy
• Memory Analysis with Volatility
• Ticket Challenge – Walkthrough and Break
• The Incident Response Process
• Training Wrap-Up