Preface

As we continue to rely more on technology, we are exposed to cyber threats that pose a significant risk to our security and privacy. In recent years, cyber-attacks have become increasingly sophisticated, making it more difficult for security professionals to identify and investigate them. This is particularly true for Security Operations Center (SOC) analysts who are responsible for detecting and responding to cyber threats.

Effective Threat Investigation for SOC Analysts is a comprehensive guide to help SOC analysts understand the techniques used by threat actors to achieve their objectives, including initial access, execution, persistence, lateral movement, Command and Control (C&C), and exfiltration. This book also explains how to detect and investigate cyber threats by analyzing most of the possible solutions and system logs that you may receive in your organization’s Security Information and Event Management (SIEM) solution, including email security logs, Windows event logs, proxy logs, firewall logs, security solution alerts, Web Application Firewall (WAF) logs, and more. By using this book, SOC analysts can gain the knowledge and skills they need to be better prepared to detect and investigate cyber threats in their organizations.

The book covers a range of topics, starting with an in-depth analysis of email-based cyber threats and the importance of email header analysis. It also delves into the specifics of Windows account login and management tracking, the investigation of suspicious Windows process executions, PowerShell attacks, and persistence and lateral movement techniques in the Windows environment by analyzing the various Windows logs.

The book provides valuable insights into how to detect and investigate security incidents using firewall logs, proxy logs, and analyzing suspicious outbound communications, including C&C communications. It also covers the importance of WAF and application logs in detecting and investigating external threats, including various types of web attacks and suspicious external access to remote services.

In addition, the book guides SOC analysts in detecting and investigating cyber threats using network flows, Intrusion Prevention Systems (IPS)/Intrusion Detection Systems (IDS) alerts, network antivirus, and sandbox alerts; also, it teaches the SOC analyst how to investigate Endpoint Detection and Response (EDR) and antivirus alerts. The book provides an overview of threat intelligence and its importance in investigating cyber threats. It covers several tools and platforms for investigating threats, including VirusTotal, IBM-XForce, AbuseIPDB, and Google.

Finally, the book provides a comprehensive practical guide for SOC analysts on building a malware sandbox environment to investigate suspicious files using static and dynamic malware analysis techniques.

We hope this book will be a valuable resource for SOC analysts and security professionals who are committed to protecting our digital world.

Who this book is for

This book is written for SOC analysts, incident responders, incident handlers, cybersecurity analysts, cybersecurity professionals, and anyone interested in investigating cyber threats. You should have a basic understanding of cybersecurity concepts, IT infrastructure, and network protocols.

What this book covers

Chapter 1, Investigating Email Threats, provides an in-depth analysis of email-based cyber threats and the techniques used by threat actors to gain initial access. This chapter provides a comprehensive overview of the anatomy of secure email gateway logs and how to use them to investigate suspicious emails.

Chapter 2, Email Flow and Header Analysis, provides an in-depth analysis of email flow and the importance of email header analysis for investigating email-based cyber threats. It then explores the different email authentication techniques, such as SPF, DKIM, and DMARC, and the investigation of email headers of spoofed messages.

Chapter 3, Introduction to Windows Event Logs, discusses the different types of Windows event logs. It then provides an overview of the various tools and techniques that SOC analysts can use to analyze Windows event logs effectively.

Chapter 4, Tracking Accounts Login and Management, explores the critical role of account and login event tracking in detecting and investigating security incidents. It then delves into the specifics of account and group management tracking and the types of events that should be monitored for security purposes.

Chapter 5, Investigating Suspicious Process Execution Using Windows Event Logs, provides a comprehensive overview of Windows processes and different types of processes, and a solid understanding of how to investigate suspicious process executions by using the Windows event logs.

Chapter 6, Investigating PowerShell Event Logs, provides an overview of PowerShell, and how it could be used by attackers to carry out malicious activity on a system. It then delves into the specifics of PowerShell execution tracking events and how they can be used to identify suspicious activity.

Chapter 7, Investigating Persistence and Lateral Movement Using Windows Event Logs, explores attackers’ persistence and lateral movement techniques to maintain access to a compromised system and move laterally across a network and explains how these techniques can be detected and investigated using Windows event logs.

Chapter 8, Network Firewall Logs Analysis, delves into the anatomy of firewall logs and provides a solid understanding of their structure and how to effectively use them to detect and investigate security incidents.

Chapter 9, Investigating Cyber Threats by Using Firewall Logs, covers how to use firewall logs for detecting and investigating security incidents, including four major types of attacks: reconnaissance, lateral movement, C&C, and Denial of Service (DoS).

Chapter 10, Web Proxy Log Analysis, delves into the value of proxy logs in detecting and investigating security incidents. It provides an overview of the anatomy of proxy logs and the various types of information provided in them.

Chapter 11, Investigating Suspicious Outbound Communications (C&C Communications) by Using Proxy Logs, focuses on the key attributes and techniques of suspicious outbound communications, including C&C communications, and provides valuable insights into investigating such activities by analyzing web proxy logs.

Chapter 12, Investigating External Threats, provides insights into various types of web attacks and suspicious external access to remote services. It also covers WAF and application logs and their value in detecting and investigating such attacks.

Chapter 13, Investigating Network Flows and Security Solutions Alerts, guides SOC analysts in investigating cyber threats using network flows, IPS/IDS alerts, network antivirus, and sandbox alerts. Furthermore, the chapter explores the techniques to investigate alerts generated by EDR and antivirus solutions.

Chapter 14, Threat Intelligence in an SOC Analyst’s Day, provides an overview of threat intelligence and its importance in investigating cyber threats. It also covers several tools and platforms for investigating threats, including VirusTotal, IBM-XForce, AbuseIPDB, and Google.

Chapter 15, Malware Sandboxing – Building a Malware Sandbox, provides a comprehensive practical guide for SOC analysts on developing an on-premises sandbox environment to investigate suspicious files using static and dynamic malware analysis techniques. It covers the required tools for analysis, the preparation of guest VMs, various analysis tools in action, and a demo lab for better understanding.

To get the most out of this book

It is essential to have an operating system installed with VMware, which should include both Windows and Ubuntu 18.04 VMs, as well as a reliable internet connection to test external sources and download the necessary tools for each chapter.

Software/hardware covered in the book	Operating system requirements
VMware	Windows, macOS, or Linux
Microsoft Event Viewer	Ubuntu 18.04
Event Log Explorer
PSLoglist
SIEM
HELK
Tasklist
Task Manager
Process Hacker
PowerShell
PsExec
Registry Editor
Reg.exe
schtasks.exe
sc.exe
NET Utility
YARA
PEStudio
EXEinfo
FakeNet
Process Monitor (ProcMon)
ProcDot
RegShot
Autoruns

Conventions used

There are a number of text conventions used throughout this book.

Code in text: Indicates code words in text, database table names, folder names, filenames, file extensions, pathnames, dummy URLs, user input, and Twitter handles. Here is an example: “In this case, the user executed a malicious Microsoft Word document named RS4_WinATP-Intro-Invoice(9).dotm, which spawned the PowerShell.exe process to download the stage two malware file named Win-ATP-Intro-Backdoor.exe.”

A block of code is set as follows:

A new process has been created.

Creator Subject:

     Security ID:  S-1-5-21-2431329721-3629005211-3263396425-1105

     Account Name:  mostafa.yahia

     Account Domain:  soc

     Logon ID:  0x89553D

When we wish to draw your attention to a particular part of a code block, the relevant lines or items are set in bold:

SELECT username,password FROM users WHERE username='' or 1=1; --' and password='';

Any command-line input or output is written as follows:

SELECT username,password FROM users WHERE username='Mostafa' and password='123456';

Bold: Indicates a new term, an important word, or words that you see onscreen. For instance, words in menus or dialog boxes appear in bold. Here is an example: “The second section is the Object section, which consists of the Object Server field and is always Security.”

Tips or important notes

Appear like this.

Disclaimer

The information within this book is intended to be used only in an ethical manner. Do not use any information from the book if you do not have written permission from the owner of the equipment. If you perform illegal actions, you are likely to be arrested and prosecuted to the full extent of the law. Packt Publishing does not take any responsibility if you misuse any of the information contained within the book. The information herein must only be used while testing environments with properly written authorizations from the appropriate persons responsible.

Get in touch

Feedback from our readers is always welcome.

General feedback: If you have questions about any aspect of this book, email us at [e-mail] and mention the book title in the subject of your message.

Errata: Although we have taken every care to ensure the accuracy of our content, mistakes do happen. If you have found a mistake in this book, we would be grateful if you would report this to us. Please visit www.packtpub.com/support/errata and fill in the form.

Piracy: If you come across any illegal copies of our works in any form on the internet, we would be grateful if you would provide us with the location address or website name. Please contact us at [e-mail] with a link to the material.

If you are interested in becoming an author: If there is a topic that you have expertise in and you are interested in either writing or contributing to a book, please visit authors.packtpub.com.

Share Your Thoughts

Once you’ve read Effective Threat Investigation for SOC Analysts, we’d love to hear your thoughts! Please click here to go straight to the Amazon review page for this book and share your feedback.

Your review is important to us and the tech community and will help us make sure we’re delivering excellent quality content.

Download a free PDF copy of this book

Thanks for purchasing this book!

Do you like to read on the go but are unable to carry your print books everywhere? Is your eBook purchase not compatible with the device of your choice?

Don’t worry, now with every Packt book you get a DRM-free PDF version of that book at no cost.

Read anywhere, any place, on any device. Search, copy, and paste code from your favorite technical books directly into your application.

The perks don’t stop there, you can get exclusive access to discounts, newsletters, and great free content in your inbox daily

Follow these simple steps to get the benefits:

1. Scan the QR code or visit the link below

https://packt.link/free-ebook/9781837634781

2. Submit your proof of purchase
3. That’s it! We’ll send your free PDF and other benefits to your email directly