The final Splunk room in the SOC Level 1 learning path! I may do the other Splunk rooms in the future after completing the phishing and Wireshark write-ups, so be on the lookout for it too! Task 2 Scenario: Identify and Investigate an Infected Host As always, I try to…

We’re gonna do our first Splunk related CTF in the learning path after the introductory courses. I might do things that aren’t efficient but that’s ok. We’re all learning together. Hopefully it’s not too difficult and the difficulty is appropriate for those who just completed the introductory courses. Let’s go! …

I did the introductory Splunk room after a long break. I felt like the introductory room was pretty basic the second time around but it doesn’t feel overwhelming as a beginner, so that’s also good! Again, I will be doing all the Splunk room in the SOC Level 1 path…

I recently came back from my break and, as promised, will be redoing Splunk rooms to create a write-up. This also doubles as a review for me as I did this early on in the SOC Level 1 learning path, so this will help me reinforce what I learned before…

This one seems to be a room more focused on Malware Analysis rather than artifacts left behind. I’m actually pretty interested in Malware Analysis too, so hopefully this will give me some basic idea and steps on how to proceed. Task 2 Malware Analysis 1: Which team uses malware analysis…

I don’t know why, but the idea of having multiple people working on a case simultaneously sounds pretty cool. It’s like working on Google Docs together. Everyone’s work can be seen real-time and anyone can make adjustments as necessary. Of course, it should be in a well-trusted environment as it…

We’ll be learning about Velociraptor now. Another tool that I never heard of but I wonder how this will be different compared to the rest. It seems like this one is produced by DFIR experts that needed to hunt for certain types of artifacts. I’m curious how this is going…

I remember about the order of volatility when I was studying for Sec+. It looks like Volatility is going to focus more on RAM, which is generally very volatile and should be collected earliest as possible. I think this is the first tool that we’ve worked with in SOC Level…

We finished Redline and now we’re moving onto KAPE. It seems like this is a tool that helps automate what we learned back in the Windows Forensics 1/2 lab room. Eric Zimmerman tools were really great, and I really enjoyed using his tools. That being said, it was pretty annoying…