Complete notes, lab writeups, and SOC alert investigations for the LetsDefend SOC Analyst certification path
This repository documents my completion of the LetsDefend SOC Analyst Learning Path - a hands-on curriculum that trains analysts to operate inside a live SOC environment, investigate real SIEM alerts, triage malware, analyze phishing emails, detect web attacks, and close cases with proper documentation.
Every folder contains real course notes, SOC alert investigations, lab walkthroughs, and challenge writeups with annotated screenshots. The notes go beyond summaries - they capture the exact methodology used during each investigation, the tools that surfaced the evidence, and the reasoning behind each true positive or false positive determination.
If you are preparing for a Tier 1 or Tier 2 SOC Analyst role, studying for the LetsDefend SOC Analyst certification, or building your blue team portfolio, this repository covers the practical workflow you will use on the job from day one.
| Domain | What You Build |
|---|---|
| SOC Operations | How a SOC works, analyst tiers, SIEM/EDR/SOAR tooling, alert ownership and escalation |
| Cyber Kill Chain | Mapping attacker behavior across 7 stages - from reconnaissance to actions on objectives |
| MITRE ATT&CK | Using the Enterprise Matrix to classify TTPs, map detections, and write structured reports |
| Phishing Analysis | Email header analysis, sender spoofing detection, URL and attachment triage, VirusTotal correlation |
| Web Attack Detection | SQLi, XSS, Command Injection, IDOR, LFI, Directory Traversal, Open Redirect, XXE - detection via log analysis |
| SIEM Alert Investigation | Full playbook-driven alert investigation - ownership, evidence collection, containment, case closure |
| Malware Analysis | Static and dynamic analysis, sandbox detonation (any.run), IOC extraction, ransomware triage |
| Malicious Document Analysis | olevba, oleid, olemeta, strings - VBA macro analysis and Excel 4.0 macro detection |
| Security Solutions | IDS/IPS, WAF, EDR, SOAR, DLP, PAM, NAC - how each fits into the defense stack |
| Network Log Analysis | NetFlow, firewall logs, proxy logs, IDS/IPS log correlation |
| SIEM 101 | Log collection, normalization, correlation rules, alert tuning |
| Splunk | SPL queries, index management, dashboards, alert creation |
| Cyber Threat Intelligence | IOC types, TTP mapping, threat feeds, intelligence-driven SOC operations |
| VirusTotal | File, hash, URL, domain, and IP analysis - reading detections and graph relationships |
| Incident Management | Case lifecycle, TheHive, LetsDefend case management, DFIR Iris |
| Brute Force Detection | Online vs offline attacks, credential stuffing, detection via log pattern analysis |
| IT Security Basics | Asset inventory, patching, access control, network segmentation, backup strategy |
| Building a Malware Lab | FLARE-VM + REMnux isolated analysis environment setup |
| Building a Home SOC Lab | pfSense + Windows Server AD + Sysmon + CrowdSec architecture |
| Job Hunting as a SOC Analyst | Tier 1/2/3 responsibilities, interview prep, what hiring managers look for |
LetsDefend/Security_Analyst/
├── notes/ # Course notes - one file per lesson
│ ├── 01-soc-fundamentals.md
│ ├── 02-cyber-kill-chain.md
│ ├── 03-mitre-attack-framework.md
│ ├── 04-phishing-email-analysis.md
│ ├── 05-detecting-web-attacks.md
│ ├── 05-detecting-web-attacks-2.md
│ ├── 07-siem-alert-investigation.md
│ ├── 08-malware-analysis-fundamentals.md
│ ├── 09-dynamic-malware-analysis.md
│ ├── 11-malicious-document-analysis.md
│ ├── 12-security-solutions.md
│ ├── 13-network-log-analysis.md
│ ├── 14-siem-101.md
│ ├── 15-incident-management-101.md
│ ├── 16-splunk.md
│ ├── 17-cyber-threat-intelligence.md
│ ├── 18-virustotal-for-soc-analysts.md
│ ├── 19-it-security-basics.md
│ ├── 20-detecting-brute-force.md
│ ├── 21-building-malware-analysis-lab.md
│ ├── 22-building-home-soc-lab.md
│ └── 23-job-hunting.md
└── labs/
├── challenges/ # Standalone CTF-style challenges
├── malware-analysis/ # SOC alert writeups - malware category
├── phishing/ # Phishing email analysis labs
├── threat-intel/ # Threat intelligence lab writeups
└── web-attacks/ # Web attack detection labs and SOC alerts
| # | Lesson | Topics Covered |
|---|---|---|
| 01 | SOC Fundamentals | SOC types and models, People/Process/Technology triad, SOC analyst tiers and responsibilities, SIEM, EDR, SOAR, threat intelligence feeds, log management |
| 02 | Cyber Kill Chain | Lockheed Martin Kill Chain framework, 7 stages from Reconnaissance to Actions on Objectives, adversary vs defender actions at each stage, Kill Chain-based detection strategies |
| 03 | MITRE ATT&CK Framework | ATT&CK Enterprise Matrix, tactics vs techniques vs sub-techniques, ATT&CK Navigator, mapping detected activity to ATT&CK IDs, structured incident reporting |
| 04 | Phishing Email Analysis | Phishing as initial access, email header analysis (From, Reply-To, Return-Path, X-Originating-IP), sender spoofing detection, SPF/DKIM/DMARC, URL defanging, attachment triage, VirusTotal correlation |
| 05 | Detecting Web Attacks | OWASP Top 10, HTTP fundamentals, detecting SQL Injection via Apache access logs, detecting XSS, Command Injection, IDOR - log patterns and analyst methodology |
| 05 | Detecting Web Attacks 2 | Open Redirect detection, Directory Traversal detection, Brute Force detection via log analysis, XXE injection detection and impact |
| 07 | Investigating SIEM Alerts | Full playbook-driven alert investigation methodology, alert ownership, case creation, network and log analysis, threat intelligence validation, endpoint analysis, containment, case closure - based on a live SOC282 phishing alert investigation |
| 08 | Malware Analysis Fundamentals | Malware types (RAT, trojan, ransomware, wiper, rootkit, keylogger, adware, botnet), static vs dynamic analysis, when to use each approach, sandbox tools, IOC extraction |
| 09 | Dynamic Malware Analysis | Sandbox analysis methodology, monitoring process activity, network connections, file system changes, registry modifications, C2 communication identification, any.run report interpretation |
| 11 | Malicious Document Analysis | strings, olemeta, oleid, olevba - VBA macro extraction and analysis, suspicious keywords, auto-execution triggers, embedded executables, SANS Malicious Docs Cheat Sheet |
| 12 | Security Solutions | IDS/IPS (signature vs anomaly vs hybrid), WAF, Next-Gen Firewall, EDR vs antivirus, DLP, PAM, NAC, SOAR - purpose, interaction, and logs generated by each |
| 13 | Network Log Analysis | NetFlow analysis, firewall log analysis, proxy log analysis, IDS/IPS log analysis, identifying lateral movement and C2 in network logs |
| 14 | SIEM 101 | SIEM architecture (collection, normalization, correlation, alerting), use cases, correlation rules, alert tuning, reducing false positives, SIEM in the SOC workflow |
| 15 | Incident Management 101 | Event vs alert vs incident, incident lifecycle, case management platforms (TheHive, LetsDefend, DFIR Iris), escalation criteria, documentation standards, post-incident review |
| 16 | Splunk | Splunk architecture (Indexer, Search Head, Universal Forwarder), SPL (Search Processing Language), index and sourcetype management, building dashboards, creating alerts, threat hunting with Splunk |
| 17 | Cyber Threat Intelligence | CTI definition and goals, IOC types (IP, domain, URL, hash, C2), TTP-based intelligence, threat feeds, intelligence-driven SOC operations, converting raw data to actionable intelligence |
| 18 | VirusTotal for SOC Analysts | File and hash analysis, URL and domain reputation, IP analysis, graph relationships, reading detection ratios, VT API for automation, upload policy for sensitive files |
| 19 | IT Security Basics for Corporates | Asset inventory, backup strategy, phishing protection, secure browsing, patch management, access control, risk management, network segmentation, incident response basics |
| 20 | Detecting Brute Force Attacks | Online vs offline brute force, passive online (MITM, sniffing), active online (dictionary, credential stuffing, password spray), log-based detection patterns, thresholds and alert tuning |
| 21 | Building a Malware Analysis Lab | FLARE-VM setup (Windows malware workstation), REMnux setup (Linux malware workstation), network isolation, snapshot strategy, safe detonation workflow |
| 22 | Building a Home SOC Lab | pfSense firewall configuration, Windows Server 2022 Active Directory setup, Windows 10 workstation, Sysmon deployment, CrowdSec installation, full lab network architecture |
| 23 | Job Hunting as a SOC Analyst | Tier 1/2/3 responsibilities breakdown, what hiring managers look for, resume tips, interview prep, career progression from monitoring to incident response |
| Challenge | What It Covers |
|---|---|
| Disclose The Agent | User-agent string analysis - identifying the tool or browser behind a suspicious HTTP request, extracting attacker fingerprint from web server logs |
| Malicious Doc | Triaging a malicious Office document - oleid and olevba analysis, VBA macro extraction, identifying auto-execution triggers and embedded IOCs |
| Malicious VBA | Deep VBA macro analysis - deobfuscating encoded payloads, identifying C2 communication, extracting dropped file paths and registry persistence |
| No Signal | Network connectivity and C2 beacon analysis - identifying beaconing patterns, distinguishing legitimate vs malicious outbound traffic |
| Port Scan Activity | Detecting port scanning in network logs - scan type identification (SYN, UDP, full connect), source attribution, scoping reconnaissance |
| Remote Working | Investigating suspicious remote access - VPN and RDP log analysis, identifying unauthorized access, correlating authentication events with anomalous activity |
| Shellshock Attack | Detecting CVE-2014-6271 Shellshock exploitation in web server logs - identifying the malicious User-Agent payload, determining if RCE was achieved |
| Lab / Alert | What It Covers |
|---|---|
| SOC-104 - Malware Detected | Endpoint malware alert triage - hash reputation check, sandbox detonation, process tree analysis, true positive determination and containment recommendation |
| SOC-105 - Requested Threat Intel URL | Threat intelligence URL investigation - VirusTotal URL scan, WHOIS analysis, passive DNS, determining scope of exposure |
| SOC-109 - Emotet Malware Detected | Emotet banking trojan investigation - dropper mechanism, C2 communication patterns, lateral movement indicators, full containment playbook |
| SOC-117 - Suspicious Registry File | Registry-based persistence investigation - analyzing a suspicious .reg file, identifying the persistence key and payload, correlating with endpoint telemetry |
| SOC-130 - Event Log Cleared | Detecting Event Log clearing (Event ID 1102 / 104) - identifying who cleared the logs, correlating timestamp with surrounding activity, anti-forensics investigation |
| SOC-138 - Suspicious XLS File Detected | Malicious Excel investigation - static analysis with oleid and olevba, Excel 4.0 macro detection, sandbox detonation, IOC extraction |
| SOC-145 - Ransomware Detected | Ransomware incident investigation - identifying the family, determining patient zero, scoping encrypted systems, containment and recovery recommendations |
| Static Malicious Document Analysis | End-to-end static analysis - strings extraction, olemeta metadata, oleid risk assessment, olevba macro deep-dive, IOC documentation |
| Dynamic Malware Analysis 2 | Advanced dynamic analysis - any.run sandbox report, process tree analysis, network connection mapping, dropped file identification, MITRE ATT&CK TTP mapping |
| Challenge: Excel 4.0 Macros | Analyzing legacy XLM macros - a technique used to evade modern macro controls; identifying auto-open cells, obfuscated formulas, payload download logic |
| Challenge: Malicious Doc | Challenge-format document triage - full static analysis workflow under time pressure, IOC extraction and final verdict |
| Challenge: Malicious VBA | Challenge-format VBA analysis - deobfuscating a multi-layer encoded macro, identifying the final payload and C2 |
| Challenge: MSHTML | CVE-2021-40444 MSHTML RCE analysis - Office documents exploiting the MSHTML rendering engine, cab file and INF-based payload delivery |
| Lab | What It Covers |
|---|---|
| Challenge: Mail Analysis | Full phishing email investigation - sender spoofing, header hop analysis, URL extraction and VirusTotal scan, attachment triage, true positive determination |
| Challenge: Header Analysis | Deep email header forensics - tracing originating IP through received headers, SPF/DKIM failure identification, Message-ID analysis, Reply-To mismatch detection |
| Lab | What It Covers |
|---|---|
| SOC-105 - Requested Threat Intel URL | Threat intelligence-driven URL investigation - VirusTotal, URLScan.io, WHOIS, and passive DNS to determine if a requested URL represents an active threat |
Each lab includes the raw Apache access log and full detection methodology.
| Lab / Alert | What It Covers |
|---|---|
| SQL Injection | Detecting SQLi in Apache logs - UNION-based, error-based, and blind injection patterns, determining if data extraction was successful |
| XSS | Cross-site scripting detection - reflected vs stored XSS log patterns, script injection payload identification, impact assessment |
| Command Injection | OS command injection detection - shell metacharacters in HTTP parameters, chained command patterns, determining if RCE was achieved |
| IDOR | Insecure Direct Object Reference detection - sequential ID enumeration in access logs, identifying unauthorized data access |
| LFI | Local File Inclusion detection - ../ traversal sequences, /etc/passwd and /proc/self access attempts, log poisoning indicators |
| Directory Traversal | Directory traversal detection - encoded and double-encoded traversal sequences, distinguishing reconnaissance from successful access |
| Open Redirect | Open redirect detection - abused redirect parameters, assessing phishing and malware distribution potential |
| Brute Force | Web brute force detection - rapid sequential login attempts, credential stuffing vs password spray patterns, lockout bypass techniques |
| XML External Entity | XXE injection detection - malicious DOCTYPE declarations in HTTP bodies, SSRF via XXE, out-of-band exfiltration indicators |
| SOC-165 - SQL Injection Payload Detected | Live SIEM alert - SQLi payload in URL, log correlation, true positive determination, containment and case closure |
| SOC-166 - JavaScript Code in URL | XSS SIEM alert - JavaScript payload in requested URL, reflected XSS assessment, impact determination |
| SOC-167 - LS Command in URL | Command injection SIEM alert - ls in URL parameter, determining if the application was vulnerable and if RCE was achieved |
| SOC-168 - Whoami in Request Body | POST body command injection - whoami in request body, confirming exploitation, scoping lateral movement |
| SOC-169 - Possible IDOR Attack | IDOR SIEM alert - sequential object ID enumeration, determining what data was accessed and by whom |
| SOC-170 - Passwd Found in URL (LFI) | LFI SIEM alert - /etc/passwd string in URL, log analysis to determine successful file read, containment |
| SOC-175 - PowerShell in URL | PowerShell execution via web request - encoded PowerShell in URL parameters, determining if a web shell was present |
| SOC-282 - Phishing Alert: Deceptive Mail Detected | Full phishing SIEM alert investigation - header analysis, URL triage, attachment analysis, endpoint correlation, true positive determination, case closure with full documentation |
| Challenge: Investigate Web Attacks | Multi-vector web attack challenge - identifying attack type from raw logs, attacker IP, targeted parameters, and whether the attack succeeded |
| Tool / Platform | Purpose |
|---|---|
| Splunk | SIEM - log ingestion, SPL queries, correlation rules, dashboards, alerting |
| VirusTotal | File, hash, URL, domain, and IP reputation analysis |
| any.run | Interactive malware sandbox - dynamic analysis and IOC extraction |
| olevba | VBA macro extraction and analysis from malicious Office documents |
| oleid | Office document risk assessment - macro presence, encryption, embedded objects |
| olemeta | Office document metadata extraction |
| strings | ASCII/Unicode string extraction from binaries and documents |
| MITRE ATT&CK Navigator | TTP mapping and detection coverage visualization |
| TheHive / DFIR Iris | Case management and incident tracking |
| URLScan.io | URL scanning and screenshot capture for phishing analysis |
| MXToolbox | Email header analysis, MX record lookup, SPF/DKIM/DMARC validation |
| FLARE-VM | Windows-based malware analysis workstation |
| REMnux | Linux-based malware analysis workstation |
| pfSense | Firewall for home SOC lab network segmentation |
| Sysmon | Windows system monitoring for endpoint telemetry |
| CrowdSec | Collaborative threat detection for home SOC lab |
SOC analyst · SIEM · SOAR · EDR · phishing analysis · email header analysis · SPF · DKIM · DMARC · sender spoofing · Cyber Kill Chain · MITRE ATT&CK · TTPs · IOC · threat intelligence · malware analysis · static analysis · dynamic analysis · sandbox · any.run · VirusTotal · VBA macros · olevba · oleid · Excel 4.0 macros · MSHTML CVE-2021-40444 · Emotet · ransomware · event log cleared · Event ID 1102 · registry persistence · SQL injection · XSS · command injection · IDOR · LFI · directory traversal · open redirect · XXE · brute force · credential stuffing · password spray · Shellshock CVE-2014-6271 · web attack detection · Apache access logs · log analysis · NetFlow · network log analysis · Splunk SPL · correlation rules · alert tuning · true positive · false positive · incident management · TheHive · DFIR Iris · case management · playbook · FLARE-VM · REMnux · pfSense · Sysmon · CrowdSec · home SOC lab · malware analysis lab · blue team · SOC tier 1 · SOC tier 2 · threat hunting · cyber threat intelligence · CTI · IOC enrichment · port scan detection · C2 beacon · lateral movement · containment · IDS · IPS · WAF · DLP · PAM · NAC · defense in depth · letsdefend · writeups · cybersecurity
The LetsDefend SOC Analyst Learning Path trains analysts to operate inside a live, simulated SOC environment. Unlike purely theoretical courses, LetsDefend puts analysts inside a real SIEM and case management platform - alert ownership, investigation methodology, containment decisions, and case closure are all hands-on.
Completing this path builds the practical skills for:
- SOC Analyst (Tier 1 / Tier 2)
- Security Operations Engineer
- Threat Intelligence Analyst
- Blue Team Operator
- Junior DFIR Analyst
Prince Lassey - GitHub | LinkedIn | Medium
All writeups are based on authorized LetsDefend lab and alert environments. No real systems were targeted.