SOC Level 2

Detection engineering, threat hunting, log analysis and incident response for analysts moving past triage.

63 rooms, about 7 hours of reading

Start at room 1 Slingshot: Retracing a Web-Server Breach in ELK
  1. 1 Slingshot: Retracing a Web-Server Breach in ELK Walkthrough of TryHackMe Slingshot: use Kibana and KQL to rebuild a web-server kill chain from Apache and ModSecurity logs, with … 4 min
  2. 2 Tactical Detection: IOCs, Sigma, and Tripwires Walkthrough of TryHackMe Tactical Detection: turn unique and public IOCs into Sigma rules, translate them with Uncoder, and set … 5 min
  3. 3 Threat Intelligence for SOC: IOC Hunting in Kibana Walkthrough of TryHackMe Threat Intelligence for SOC: hunt an IOC list in Kibana to find a compromised host, sinkhole domains, and … 4 min
  4. 4 Sigma: Detecting AnyDesk, Tasks, and Ransomware Walkthrough of TryHackMe Sigma: write Sigma rules, convert them with sigmac, and hunt an AnyDesk install, a rogue scheduled task, … 4 min
  5. 5 SigHunt: Nine Sigma Rules for a Ransomware Chain Walkthrough of TryHackMe SigHunt: tune nine Sigma detection rules in the Sigma Validator to catch each stage of a ransomware … 3 min
  6. 6 Aurora EDR: Sigma Detections in the Event Log Walkthrough of TryHackMe Aurora EDR: how the Sigma-based agent uses ETW, its presets and response actions, and reading its … 4 min
  7. 7 Introduction to SOAR: Playbooks and Automation Walkthrough of TryHackMe Introduction to SOAR: the SOC challenges it solves, its orchestration and automation, and building … 3 min
  8. 8 Threat Hunting Introduction: Approaches, Targets, and APT-Serpent Walkthrough of TryHackMe Threat Hunting Introduction: dwell time, the three hunting approaches and targets, the four hunting … 8 min
  9. 9 Threat Hunting Foothold: Hunt an Intrusion in Elastic Walkthrough of TryHackMe Threat Hunting Foothold: reconstructing an intrusion across filebeat, winlogbeat, and packetbeat in the … 4 min
  10. 10 Threat Hunting Pivoting: Chasing an AD Intrusion Walkthrough of TryHackMe Threat Hunting Pivoting: hunting discovery, service-based privilege escalation, DCSync, and Pass-the-Hash … 3 min
  11. 11 Threat Hunting Endgame: Collection to Impact in Elastic Walkthrough of TryHackMe Threat Hunting Endgame: hunting collection, ICMP exfiltration, and shadow-copy impact across custom case … 3 min
  12. 12 Hunt Me I Payment Collectors: Phish to DNS Exfil Walkthrough of TryHackMe Hunt Me I Payment Collectors: tracing a phish from an LNK lure through a powercat shell, PowerView recon, … 3 min
  13. 13 Hunt Me II Typo Squatters: One MSI to Domain Admin Walkthrough of TryHackMe Hunt Me II Typo Squatters: tracing a typosquatted 7-Zip MSI through LSASS dumping, DCSync, and ransomware … 3 min
  14. 14 Intro to Threat Emulation: Emulate FIN7 and APT37 Walkthrough of TryHackMe Intro to Threat Emulation: emulation vs simulation, TIBER-EU and Atomic Red Team, the five-step process, … 3 min
  15. 15 Atomic Red Team: Emulate ATT&CK, One Test at a Time Walkthrough of TryHackMe Atomic Red Team: driving Invoke-AtomicRedTeam, reading atomic YAMLs, and turning ATT&CK tests into Sysmon … 7 min
  16. 16 Atomic Bird Goes Purple #1: Execute, Investigate, Detect Walkthrough of TryHackMe Atomic Bird Goes Purple #1: running custom atomic tests and investigating the Sysmon and Aurora EDR … 5 min
  17. 17 Atomic Bird Goes Purple #2: Discover, Hide, Deface, Persist Walkthrough of TryHackMe Atomic Bird Goes Purple #2: credential search, decoy accounts, rogue services, defacement, and … 4 min
  18. 18 Preparation: The First Phase of Incident Response Walkthrough of TryHackMe Preparation: the IR lifecycle, building a CSIRT, chain of custody and jump bags, and configuring Sysmon, … 4 min
  19. 19 Identification & Scoping: Working a Phishing Incident Walkthrough of TryHackMe Identification & Scoping: triaging phishing tickets, using the Asset Inventory and Spreadsheet of Doom, … 4 min
  20. 20 Threat Intel & Containment: Buying Time on the Adversary Walkthrough of TryHackMe Threat Intel & Containment: pre-containment IOCs, controlled vs entire isolation, building threat … 5 min
  21. 21 Senior Security Analyst Intro: The L2 Role Walkthrough of TryHackMe Senior Security Analyst Intro: what a SOC Level 2 analyst actually does, the L1 to L2 mindset shift, and … 5 min
  22. 22 SOC L2 Alert Triage: The Senior Workflow Walkthrough of TryHackMe SOC L2 Alert Triage: the L1 vs L2 workflow, log analysis and the threat hunting loop, threat response, … 6 min
  23. 23 Report Writing for SOC L2 Walkthrough Walkthrough of TryHackMe Report Writing for SOC L2: writing for C-level, MSSP customers, and DFIR teams, plus the two … 6 min
  24. 24 Defensive Security Trends: Keeping Up as an L2 Walkthrough of TryHackMe Defensive Security Trends: faster and complex attacks, valid accounts, supply chain, AI impact, and the … 8 min
  25. 25 Elastic: Setting up a SOC Lab Walkthrough Walkthrough of TryHackMe Elastic: Setting up a SOC Lab with Elasticsearch, Kibana and Fleet, ingesting Apache and custom VPN logs … 8 min
  26. 26 Elastic: Using Elastic Defend Walkthrough Walkthrough of TryHackMe Elastic: Using Elastic Defend: configure the integration, explore endpoint telemetry, and triage EDR … 6 min
  27. 27 Monitoring Active Directory Walkthrough Walkthrough of TryHackMe Monitoring Active Directory: AD event IDs, stack counting for baselines, audit policy, and the … 8 min
  28. 28 Detecting AD Initial Access Walkthrough Walkthrough of TryHackMe Detecting AD Initial Access: IIS web shell hunting via w3wp.exe process chains, OWA brute-force … 9 min
  29. 29 Detecting AD Credential Attacks Walkthrough Walkthrough of TryHackMe Detecting AD Credential Attacks: Kerberoasting via RC4 service tickets, AS-REP roasting, LSASS dumping … 8 min
  30. 30 Detecting AD Lateral Movement Walkthrough Walkthrough of TryHackMe Detecting AD Lateral Movement: SMB and ADMIN$ access, PsExec service installation, RDP hop chains, and … 8 min
  31. 31 Detecting AD Post-Exploitation Walkthrough Walkthrough of TryHackMe Detecting AD Post-Exploitation: rogue Domain Admin persistence, VSS shadow copy and event log deletion, … 7 min
  32. 32 M365 Monitoring Basics Walkthrough Walkthrough of TryHackMe M365 Monitoring Basics: Entra ID sign-in and audit logs, M365 unified audit logs, and one account … 6 min
  33. 33 Entra ID Monitoring Walkthrough Walkthrough of TryHackMe Entra ID Monitoring: password spraying vs throttled brute force, Identity Protection risk detections, … 7 min
  34. 34 Exchange Online Monitoring Walkthrough Walkthrough of TryHackMe Exchange Online Monitoring: malicious inbox rules, mailbox forwarding to external addresses, message … 6 min
  35. 35 SharePoint Online Monitoring Walkthrough Walkthrough of TryHackMe SharePoint Online Monitoring: external sharing links, FileDownloaded exfiltration, OneNote phishing and a … 6 min
  36. 36 Microsoft Intune Monitoring Walkthrough Walkthrough of TryHackMe Microsoft Intune Monitoring: tracing a remote device wipe through the Intune audit log, PowerShell … 9 min
  37. 37 Cloud Security Pitfalls Walkthrough Walkthrough of TryHackMe Cloud Security Pitfalls: IaaS/PaaS/SaaS, the Shared Responsibility Model, why cloud logging is the real … 7 min
  38. 38 AWS Security Logging Walkthrough Walkthrough of TryHackMe AWS Security Logging: CloudTrail console logins and bucket creation, three GuardDuty findings ending in … 8 min
  39. 39 Monitoring AWS Logins Walkthrough Walkthrough of TryHackMe Monitoring AWS Logins: console logins and MFAUsed, AKIA vs ASIA access keys, an S3 data-extortion attack, … 7 min
  40. 40 Monitoring AWS Services Walkthrough Walkthrough of TryHackMe Monitoring AWS Services: a public S3 bucket policy and the filename brute force that followed, SSH open … 8 min
  41. 41 Monitoring AWS Workloads Walkthrough Walkthrough of TryHackMe Monitoring AWS Workloads: Falco syscall telemetry on EC2 and inside containers, a command injection to … 8 min
  42. 42 Intro to Detection Engineering Walkthrough Walkthrough of TryHackMe Intro to Detection Engineering: the DE life cycle, precision vs recall, detection library decay, and all … 7 min
  43. 43 AI & Automation in Detection Engineering Walkthrough Walkthrough of TryHackMe AI & Automation in Detection Engineering: a full Detection-as-Code pull request review in TryGitMe, the … 11 min
  44. 44 Sigma Language: Write Once, Convert Everywhere, Tune the Rest Walkthrough of TryHackMe Sigma Language: rule anatomy on a real SigmaHQ rule, writing a recon detection from scratch, converting … 8 min
  45. 45 DetectMare: Five Broken Detections and a Red Team That Attacks Your Filters Walkthrough of TryHackMe DetectMare: tuning five Sigma detections through a Detection-as-Code pipeline whose red-team check … 8 min
  46. 46 Detection and Analysis: Scoping a Nexus Financial Account Compromise Walkthrough of TryHackMe Detection and Analysis: validating an L1 escalation in Splunk, tracing an M365 account compromise from … 10 min
  47. 47 Post-Incident Activity: Turning an Incident Into Detection Rules Walkthrough of TryHackMe Post-Incident Activity: reconstructing the full Nexus Financial attack timeline across three M365 … 10 min
  48. 48 Network Monitoring with Zeek: One uid, Five Logs, One Intrusion Walkthrough of TryHackMe Network Monitoring with Zeek: reading conn.log, dns.log, http.log, ssl.log and files.log with zeek-cut to … 10 min
  49. 49 Advanced Packet Analysis: What the Logs Could Not Tell You Walkthrough of TryHackMe Advanced Packet Analysis: triaging a SYN scan with TShark, decoding base64 C2 tasking, pulling cleartext … 7 min
  50. 50 The Silent Transfer: A Capstone Hunt From One Snort Alert Walkthrough of TryHackMe The Silent Transfer: the Advanced Traffic Analysis capstone, pivoting from a single Snort Cobalt Strike … 6 min
  51. 51 Volt Typhoon: Retracing an APT Through Three Log Sources Walkthrough of TryHackMe Volt Typhoon: reconstructing a full living-off-the-land intrusion in Splunk from ADSelfService Plus, wmic … 14 min
  52. 52 Response and Recovery: Containing an M365 Compromise From the Audit Log Walkthrough of TryHackMe Response and Recovery: scoping attacker post-compromise activity in the Nexus Financial M365 tenant … 8 min
  53. 53 Traffic Analysis Pitfalls: When the Wire Stops Talking Walkthrough of TryHackMe Traffic Analysis Pitfalls: ASN enrichment over CDN traffic, finding 6,946 QUIC sessions a TCP rule never … 12 min
  54. 54 Basic Static Analysis: Six Samples, No Execution Walkthrough of TryHackMe Basic Static Analysis: FLOSS recovering a Dbgview.exe stackstring that strings.exe cannot see, imphash … 11 min
  55. 55 Threat Hunting With YARA: Four Modifiers and a Self-Match Walkthrough of TryHackMe Threat Hunting With YARA: hunting ROOTSAW and WINELOADER with Mandiant's own rules, the wide/base64/xor … 10 min
  56. 56 Script Static Analysis: Four Scripts, One PowerShell Prompt TryHackMe Script Static Analysis walkthrough: a Node.js dropper among 253 decoys, shellcode gzipped before the XOR, a … 9 min
  57. 57 MalDoc Static Analysis: PDF, Office and OneNote TryHackMe MalDoc Static Analysis walkthrough: hex-encoded PDF JavaScript, a macro split across 15 concatenations, and a OneNote … 7 min
  58. 58 MalBuster: Four Binaries, No Hand-Holding TryHackMe MalBuster walkthrough: triaging four unknown PE binaries on REMnux with pefile, capa and hash OSINT, and two … 7 min
  59. 59 Servidae: Tracing a Compromised Workstation in ELK TryHackMe Servidae walkthrough: tracing a compromised workstation through Elastic, from a PDF lure to AlwaysInstallElevated, a … 7 min
  60. 60 Building Wazuh Rules: Decoders and CDB Alerts TryHackMe Building Wazuh Rules walkthrough: writing decoders and rules, matching a CDB threat-intel list, and reading frequency … 10 min
  61. 61 Monday Monitor: Reading Sysmon in Wazuh TryHackMe Monday Monitor walkthrough: tracing an Atomic Red Team chain through Sysmon in Wazuh, from a renamed .xlsm download to … 7 min
  62. 62 Conti: ProxyShell to Ransomware in Splunk TryHackMe Conti walkthrough: tracing a ProxyShell Exchange compromise to ransomware in Splunk, from an attrib.exe web shell to … 7 min
  63. 63 IronShade: Linux honeypot compromise investigation TryHackMe IronShade walkthrough: investigating a compromised Linux honeypot for backdoor accounts, hidden processes, cron and … 4 min