Effective Threat Investigation for SOC Analysts

Table of Contents

1. Investigating Email Threats
2. Email Flow and Header Analysis
3. Introduction to Windows Event Logs
4. Tracking Accounts Login and Management
5. Investigating Suspicious Process Execution Using Windows Event Logs
6. Investigating PowerShell Event Logs
7. Investigating Persistence and Lateral Movement Using Windows Event Logs
8. Network Firewall Logs Analysis
9. Investigating Cyber Threats by Using the Firewall Logs
10. Web Proxy Logs Analysis
11. Investigating Suspicious Outbound Communications (C&C Communications) by Using Proxy Logs
12. Investigating External Threats
13. Investigating Network Flows and Security Solutions Alerts
14. Threat Intelligence in a SOC Analyst's Day
15. Malware Sandboxing – Building a Malware Sandbox