Soc Analyst

Alert Received
  |
  v
1. Is this a known false positive? ----YES----> Update tuning rule, close
  |NO
  v
2. Does alert have sufficient context? ---NO---> Enrich (lookup IP, hash, user)
  |YES
  v
3. Severity assessment:
   - What asset is affected? (Crown jewel? User workstation?)
   - What's the potential impact? (Data loss? Lateral movement?)
   - Is this correlated with other alerts?
  |
  v
4. Initial classification:
   [True Positive]    -> Investigate, escalate if needed
   [Benign True Pos]  -> Document, close (legit admin activity)
   [False Positive]    -> Tune detection rule, close
   [Suspicious]        -> Investigate further (15 min timebox)

                        Asset Criticality
                   Low        Medium       High
              +-----------+-----------+-----------+
   High       |  Medium   |   High    | Critical  |
              +-----------+-----------+-----------+
Threat  Med   |    Low    |  Medium   |   High    |
Level         +-----------+-----------+-----------+
   Low        | Informational |  Low  |  Medium   |
              +-----------+-----------+-----------+

Response SLAs:
  Critical:      15 min initial response, continuous investigation
  High:          30 min initial response
  Medium:        4 hours initial response
  Low:           Next business day
  Informational: Logged, reviewed in weekly analysis

# Brute force detection: 10+ failed logins in 5 minutes
index=auth sourcetype=windows:security EventCode=4625
| bin _time span=5m
| stats count as failed_attempts dc(TargetUserName) as targeted_users
  values(TargetUserName) as users by src_ip _time
| where failed_attempts >= 10
| sort -failed_attempts

# Lateral movement: RDP to multiple hosts
index=auth sourcetype=windows:security EventCode=4624 Logon_Type=10
| bin _time span=1h
| stats dc(dest) as unique_hosts values(dest) as destinations by src_ip user _time
| where unique_hosts >= 5
| sort -unique_hosts

# Data exfiltration: Large outbound transfers
index=firewall action=allowed direction=outbound
| stats sum(bytes_out) as total_bytes by src_ip dest_ip
| where total_bytes > 1073741824
| evaluate total_gb = round(total_bytes / 1073741824, 2)
| sort -total_gb

# Suspicious PowerShell: Encoded commands
index=windows sourcetype=windows:security EventCode=4688
| search (New_Process_Name="*powershell*" OR New_Process_Name="*pwsh*")
  AND (Process_Command_Line="*-enc*" OR Process_Command_Line="*-EncodedCommand*"
       OR Process_Command_Line="*FromBase64*" OR Process_Command_Line="*download[s]tring*")
| table _time ComputerName Account_Name New_Process_Name Process_Command_Line

# Impossible travel: Login from distant locations within short time
index=auth action=success
| iplocation src_ip
| sort user _time
| streamstats current=f last(lat) as prev_lat last(lon) as prev_lon
  last(_time) as prev_time by user
| evaluate distance_km = round(acos(sin(lat*pi()/180)*sin(prev_lat*pi()/180)
  + cos(lat*pi()/180)*cos(prev_lat*pi()/180)*cos((lon-prev_lon)*pi()/180))
  * 6371, 0)
| evaluate time_diff_hours = round((_time - prev_time) / 3600, 2)
| evaluate speed_kmh = if(time_diff_hours > 0, round(distance_km / time_diff_hours, 0), 0)
| where speed_kmh > 1000 AND distance_km > 500
| table _time user src_ip City Country prev_lat prev_lon distance_km time_diff_hours speed_kmh

# Failed authentication spike
event.category: "authentication" AND event.outcome: "failure"
| stats count() by source.ip, user.name
| where count > 20

# Suspicious process execution
process.name: ("powershell.exe" or "cmd.exe" or "wscript.exe")
  AND process.args: ("*-enc*" or "*bypass*" or "*hidden*" or "*download[s]tring*")
  AND NOT process.parent.name: ("explorer.exe" or "svchost.exe")

# DNS queries to newly registered domains
dns.question.name: * AND NOT dns.response_code: "NXDOMAIN"
| lookup dns.question.name in newly_registered_domains.csv
| where match = true

# Outbound connections to threat intel IPs
destination.ip: * AND event.action: "connection_attempted"
| lookup destination.ip in threat_intel_ips.csv on ip
| where threat_category IS NOT NULL
| table @timestamp source.ip destination.ip threat_category confidence

class IOCAnalyzer:
    """Structured IOC analysis and enrichment."""

    def analyze_ip(self, ip_address: str) -> dict:
        """Full analysis of a suspicious IP address."""
        result = {
            'ip': ip_address,
            'checks': {}
        }

        # 1. Geolocation
        result['checks']['geolocation'] = self.geoip_lookup(ip_address)

        # 2. Threat intelligence feeds
        result['checks']['virustotal'] = self.query_virustotal(ip_address)
        result['checks']['abuseipdb'] = self.query_abuseipdb(ip_address)
        result['checks']['otx'] = self.query_alienvault_otx(ip_address)

        # 3. Reverse DNS
        result['checks']['rdns'] = self.reverse_dns(ip_address)

        # 4. ASN information
        result['checks']['asn'] = self.asn_lookup(ip_address)

        # 5. Historical connections in SIEM
        result['checks']['siem_history'] = self.siem_query(
            f'dest_ip="{ip_address}" | stats count by src_ip action | head 20'
        )

        # 6. Reputation scoring
        result['risk_score'] = self._calculate_risk_score(result['checks'])
        result['recommendation'] = self._recommend_action(result['risk_score'])

        return result

    def analyze_hash(self, file_hash: str) -> dict:
        """Analyze a file hash (MD5/SHA1/SHA256)."""
        return {
            'hash': file_hash,
            'virustotal': self.vt_file_report(file_hash),
            'malware_bazaar': self.query_malware_bazaar(file_hash),
            'any_run': self.query_any_run(file_hash),
            'internal_seen': self.search_edr(f'file_hash:{file_hash}'),
        }

    def analyze_domain(self, domain: str) -> dict:
        """Analyze a suspicious domain."""
        return {
            'domain': domain,
            'whois': self.whois_lookup(domain),
            'dns_records': self.dns_resolve(domain),
            'certificate': self.cert_transparency(domain),
            'age_days': self.domain_age(domain),
            'virustotal': self.vt_domain_report(domain),
            'urlhaus': self.query_urlhaus(domain),
            'typosquat_check': self.check_typosquat(domain),
        }

    def _calculate_risk_score(self, checks: dict) -> int:
        """0-100 risk score based on enrichment results."""
        score = 0
        if checks.get('virustotal', {}).get('malicious', 0) > 3:
            score += 40
        if checks.get('abuseipdb', {}).get('confidence_score', 0) > 50:
            score += 30
        if checks.get('geolocation', {}).get('country') in HIGH_RISK_COUNTRIES:
            score += 15
        if checks.get('asn', {}).get('name') in KNOWN_BULLETPROOF_HOSTING:
            score += 15
        return min(100, score)

Starting IOC: Malicious IP 185.x.x.x
  |
  +-> Reverse DNS -> suspicious-domain.xyz
  |     +-> WHOIS -> registrant email: evil@protonmail.com
  |     |     +-> Reverse WHOIS -> 12 other domains by same registrant
  |     +-> Passive DNS -> other IPs hosting this domain
  |     +-> Certificate transparency -> wildcard cert, other subdomains
  |
  +-> SIEM: Which internal hosts connected?
  |     +-> host-a.internal connected 50 times in 24h
  |     |     +-> EDR: What process made connections? -> chrome.exe (suspicious)
  |     |     +-> What else did chrome.exe do? -> Dropped payload to %TEMP%
  |     |     +-> File hash of payload -> VirusTotal: Known malware family X
  |     +-> host-b.internal connected once -> likely automated scan, low risk
  |
  +-> Threat Intel: Known C2 for APT group Y
        +-> Check for other known IOCs from APT group Y
        +-> Review TTPs associated with this group

playbook:
  name: Phishing Email Investigation
  id: PB-PHISH-001
  severity: medium
  estimated_time: 30 minutes
  trigger: "User-reported phishing or email security alert"

  steps:
    - step: 1
      action: "Collect email artifacts"
      details:
        - "Get original email (EML format, not screenshot)"
        - "Extract: sender, reply-to, return-path, X-headers"
        - "Extract: all URLs (hover, don't click)"
        - "Extract: attachment hashes (SHA256)"
        - "Note: receiving time, number of recipients"
      automation: "SOAR: auto-extract IOCs from reported email"

    - step: 2
      action: "Analyze sender"
      details:
        - "Check SPF/DKIM/DMARC authentication results"
        - "Verify sender domain age and reputation"
        - "Compare envelope sender vs display name"
        - "Check if domain is typosquat of known brand"
      decision:
        spoofed: "Continue to step 3, mark as confirmed phishing"
        legitimate: "May be compromised account, check step 3"

    - step: 3
      action: "Analyze payload"
      details:
        - "URLs: Expand shortened URLs, check against threat intel"
        - "URLs: Screenshot with urlscan.io (DO NOT visit directly)"
        - "Attachments: Submit hash to VT, run in sandbox"
        - "Check for credential harvesting page"
      decision:
        malicious: "Escalate to step 4 immediately"
        suspicious: "Continue analysis with 15 min timebox"
        benign: "Close as spam/marketing, update user"

    - step: 4
      action: "Scope the impact"
      details:
        - "Search email gateway: How many recipients got this email?"
        - "Check proxy/DNS logs: Did anyone click the URL?"
        - "Check EDR: Did anyone open the attachment?"
        - "Check auth logs: Any credential use from phishing IP?"
      automation: "SOAR: auto-search email gateway for message-id"

    - step: 5
      action: "Contain"
      details:
        - "Block sender domain in email gateway"
        - "Block malicious URLs in proxy/DNS"
        - "Delete email from all mailboxes (admin purge)"
        - "If credentials compromised: force password reset + revoke sessions"
        - "If malware executed: isolate endpoint, trigger IR playbook"

    - step: 6
      action: "Document and close"
      details:
        - "Record all IOCs in threat intel platform"
        - "Update detection rules if new pattern found"
        - "Notify affected users"
        - "Log investigation in case management"

tuning_approach:
  1_baseline_false_positives:
    - "Track false positive rate per detection rule for 2 weeks"
    - "Rules with > 80% FP rate: immediate tuning or disable"
    - "Rules with 50-80% FP rate: add exclusions or context"
    - "Target: < 20% FP rate per rule"

  2_context_enrichment:
    - "Add asset criticality to alerts (crown jewel vs dev box)"
    - "Add user context (admin vs regular, VPN vs office)"
    - "Add historical baseline (normal for this user/host?)"
    - "Auto-close alerts that match known benign patterns"

  3_alert_correlation:
    - "Correlate related alerts into single incident"
    - "Example: failed logins + successful login + privilege escalation = one case"
    - "Reduce 50 alerts to 1 actionable investigation"

  4_tiered_response:
    - "Tier 1: Automated response (SOAR) for known patterns"
    - "Tier 2: Junior analyst for low-medium alerts with runbook"
    - "Tier 3: Senior analyst for complex/high-severity only"
    - "Goal: 70% automated, 20% tier 2, 10% tier 3"

  5_detection_engineering:
    - "Review top 10 noisiest rules monthly"
    - "Replace signature-based with behavioral detections"
    - "Implement detection-as-code (version controlled rules)"
    - "A/B test detection rules before production deployment"

hunt:
  name: "Living Off the Land Binary (LOLBin) Usage"
  hypothesis: >
    Attackers may be using legitimate Windows binaries to download
    and execute malicious payloads, bypassing endpoint protection.
  data_sources:
    - Windows Security Event Logs (4688)
    - Sysmon Process Creation (Event 1)
    - EDR telemetry
  timeframe: "Last 30 days"

  # NOTE: The indicator strings in the queries below are intentionally
  # defanged for safe distribution (some endpoint scanners flag raw
  # download-cradle keywords inside documentation). A bracketed character
  # such as "[c]" or "[t]" or "[.]" is a placeholder; before deploying in
  # your SIEM, remove the square brackets so each token becomes contiguous
  # again (rejoin the bracketed letter or dot into the surrounding word).
  queries:
    certutil_download:
      description: "certutil[.]exe used to fetch remote files (LOLBin download cradle)"
      spl: |
        index=windows (process_name=certutil.exe OR original_file_name=CertUtil.exe)
        AND (command_line="*url[c]ache*" OR command_line="*verifyctl*"
             OR command_line="*-decode*")
        | stats count by Computer user command_line
        | sort -count

    mshta_execution:
      description: "mshta[.]exe executing remote content"
      spl: |
        index=windows process_name=mshta.exe
        AND (command_line="*h[t]tp*" OR command_line="*javascript*"
             OR command_line="*vbscript*")
        | table _time Computer user parent_process command_line

    rundll32_unusual:
      description: "rundll32.exe with unusual DLL paths"
      spl: |
        index=windows process_name=rundll32.exe
        | where NOT match(command_line, "(?i)(shell32|setupapi|advpack|syssetup)")
        | stats count by Computer user command_line
        | where count < 5

  analysis_steps:
    - "Review results for anomalous command-line patterns"
    - "Correlate with known LOLBin techniques from LOLBAS project"
    - "Check parent process chain for suspicious ancestry"
    - "Pivot on user accounts and machines for additional activity"
    - "If finding confirmed: create detection rule and document TTP"

shift_handoff:
  date: "2024-06-15"
  outgoing_shift: "Day shift (08:00-16:00)"
  incoming_shift: "Evening shift (16:00-00:00)"
  analyst: "Jane Smith"

  active_incidents:
    - id: INC-2024-0892
      severity: high
      summary: "Possible credential stuffing against customer portal"
      status: "Investigating - waiting for WAF logs from vendor"
      next_steps: "Review WAF logs when received, correlate with auth failures"
      escalated_to: "Incident Commander (Bob)"

  open_investigations:
    - alert_id: ALT-45892
      summary: "Unusual PowerShell activity on FINANCE-SRV-01"
      status: "Gathering additional EDR data"
      priority: medium
      context: "Finance team confirmed no planned maintenance"

  notable_events:
    - "Microsoft released out-of-band patch for CVE-2024-XXXXX (critical RCE)"
    - "New phishing campaign targeting our industry reported by FS-ISAC"
    - "Scheduled maintenance on SIEM cluster tonight 22:00-23:00"

  metrics:
    alerts_received: 142
    alerts_closed: 128
    incidents_opened: 2
    incidents_closed: 1
    average_triage_time: "4.2 minutes"

  action_items_for_next_shift:
    - "Follow up on INC-2024-0892 WAF logs"
    - "Review overnight scan results from vulnerability assessment"
    - "Check if phishing IOCs from FS-ISAC alert appear in our logs"

# Soc Analyst Analysis

## Context Assessment
[Situation summary and constraints]

## Recommended Approach
[Primary recommendation with rationale]

## Implementation Steps
1. [Step with specific details]
2. [Step with specific details]
3. [Step with specific details]

## Trade-offs and Considerations
- [Key trade-off 1]
- [Key trade-off 2]

## Next Steps
- [Immediate action item]
- [Follow-up action item]