I run a community showing you how to build practical hands-on skills to become a Cybersecurity SOC analyst. 👇
Joined December 2022
- Tweets392
- Following167
- Followers3.5K
- Likes396
Pinned Tweet
ICYMI for those wanting to become a #socanalyst, this is what I would focus on.
From Zero to SOC Analyst: Complete Roadmap (2026)
youtu.be/5cQrfNxvRG4
I keep getting the same question from those starting out “I want to build a #homelab, but where do I even start?” Instead of sending them another guide to read, I created a beginner-friendly challenge that walks them through building one step by step.
Introducing the Wazuh #SOCAnalyst Challenge.
It is a completely free video series where you will build a #Wazuh lab, analyze the logs, create your own detection and investigate what happened.
By the end of the challenge you will have:
1) A working Wazuh #SOC lab
2) A dashboard & custom rule that you created
3) An investigation report
Also there is a giveaway attached to this challenge where three people who complete it will win three months inside the #MYDFIR Forge.
The Forge is for anyone who wants a structured SOC analyst learning path where they'll tackle investigations using #Splunk, #Microsoft Sentinel, Defender XDR and get direct feedback on their work.
Learn more about the challenge here:
youtu.be/duEibRGYMHo
Good luck and Have fun!
𝗙𝗮𝗸𝗲 𝗜𝗻𝘃𝗶𝘁𝗲𝘀, 𝗥𝗲𝗮𝗹 𝗔𝗰𝗰𝗲𝘀𝘀: 𝗣𝗵𝗶𝘀𝗵𝗶𝗻𝗴 𝗖𝗮𝗺𝗽𝗮𝗶𝗴𝗻
@anyrun_app researchers tracked a large campaign going after organizations with fake event invitations.
Here is the remote-tool path, detonated in the sandbox.
🔸 User clicks the invite link
🔸 A Cloudflare CAPTCHA loads
🔸 Page auto-downloads a remote management installer, pulled straight from the lure domain
🔸 In one version there is not even a button. The download just starts on its own.
🔸 The installer runs through msiexec
🔸 The remote client installs as a Windows service running as SYSTEM
🔸 That service beacons out to a relay the attacker controls
That last step allows the attacker to have hands on keyboard access through a signed, legitimate allowlisted tool.
Full ANY.RUN analysis #1: app.any.run/tasks/dcbc4301-f…
Full ANY.RUN analysis #2:
app.any.run/tasks/4c2687da-1…
Targeting, what to hunt for, and IOCs👇
#Phishing #ANYRUN #ExploreWithANYRUN #SOCAnalyst #DFIR #CISO #ad
𝗪𝗵𝗼 𝗧𝗵𝗲𝘆 𝗔𝗿𝗲 𝗚𝗼𝗶𝗻𝗴 𝗔𝗳𝘁𝗲𝗿, 𝗮𝗻𝗱 𝗛𝗼𝘄 𝘁𝗼 𝗖𝗮𝘁𝗰𝗵 𝗜𝘁
Most of the ANY.RUN submissions for this campaign came out of the United States. And the industries getting hit are the ones you would expect:
🔸 Education
🔸 Banking
🔸 Government
🔸 Technology
🔸 Healthcare
Look at what those have in common. Email, identity, and remote administration are just part of the normal workday. A remote management tool showing up on a machine in a hospital IT shop or a university help desk does not look strange.
As of late April, around 160 suspicious links were analyzed and around 80 phishing domains were observed. Most sat on .de TLDs, which is a little odd for a campaign aimed at US orgs and worth watching for on its own. A lot of them were built from the same phish kit and some sessions even had instructions left in for the operator on how to edit the page.
That reused infrastructure is good news for us. When attackers mass produce lure sites from one kit, they leave similar fingerprints everywhere.
Here is what to hunt for and be sure to baseline your environment first.
🔸 An RMM (Remote Monitoring and Management) client install (ScreenConnect, ConnectWise, ITarian, Datto, LogMeIn, etc.)
🔸 An RMM service reaching out to a relay you do not recognize as your own
🔸POST requests to /processmail.php, /process.php, /pass.php, /mlog.php (likely noisy which is why baseline is important here)
A quick win is to find every RMM in your environment and note the ones that belong. After that, any new RMM install should get flagged for a closer look.
Pivot from this campaign's lure signature in ANY.RUN TI Lookup:
intelligence.any.run/analysi…
IOCs in 3/3 👇
𝗖𝗮𝗺𝗽𝗮𝗶𝗴𝗻 𝗜𝗢𝗖𝘀 (𝗥𝗲𝗺𝗼𝘁𝗲-𝗧𝗼𝗼𝗹 𝗗𝗲𝗹𝗶𝘃𝗲𝗿𝘆 𝗣𝗮𝘁𝗵)
Lure domain @anyrun_app observed:
🔸 vallparty[.]de (sitting behind Cloudflare)
🔸 Lure page: /winedine.html
🔸 Payload served from: vallparty[.]de/ScreenConnect.ClientSetup.exe (~5 MB)
🔸 SHA256: 66CA66CAE93C34E60A9A328B082FC7AA5396CC046BCFC5A14681D072128B9BE7
Lure HTML:
🔸 winedine.html SHA256: D52B32EA18EEB88C7EE2EBBBECE4705D81F2EBBBB50518E765C1D84466989732
🔸 MSI staged under %Temp%\ScreenConnect
Credential-theft variant endpoints:
🔸 /processmail.php, /process.php, /pass.php, /mlog.php, /check_telegram_updates.php
Suricata hits worth building alerts on:
🔸 ET REMOTE_ACCESS Observed DNS Query to Known ScreenConnect/ConnectWise Remote Desktop Service Domain
🔸 REMOTE [ANY.RUN] ScreenConnect Server Response
One fake invite can end in a compromised mailbox, a stolen OTP, or a remote tool running as SYSTEM. And your team might not connect those dots until the foothold is already there.
This is where a sandbox earns its keep. When a suspicious link hits your queue during triage, you can detonate it somewhere safe instead of guessing. Within seconds you can see whether it is a fake invite, a credential form, an OTP prompt, or a remote tool quietly downloading itself. And as it runs, you are watching the actual behavior. The network calls, where the credentials get posted, what files drop, and whether anything reaches out for remote access.
Get special 10th anniversary offers from ANY.RUN: app.any.run/plans?utm_source…
#Phishing #ANYRUN #ExploreWithANYRUN #CISO #SOCAnalyst
I broke down a #socanalyst job posting and showed you exactly what they expect + how you can start learning each skill so you’re actually prepared when applying.
If you’ve ever looked at a #soc posting and thought:
“Where do I even start learning all of this?”
This video is for you.
youtu.be/Ygca5xdNK-A
#cybersecurity
Can you spot the suspicious activity?
This is a snippet of the MFT (Master File Table) artifact data from a forensic investigation scenario. Been building this out as part of the DFIR course for the MYDFIR Forge. Total of 14 modules with a mix of Windows, Linux, network, memory and cloud (Azure) forensics including a capstone investigation. This is a big course and will include a lot of theory + labs!
Can't wait to release it.
I'll be providing more details in the free SOC community as we get closer to the release!
skool.com/mydfir-community/a…
I kept getting messages from beginners saying they wanted to become SOC analysts but not sure where to start so I built a free community that’ll give them a good starting point called The MYDFIR SOC Community:
Inside has 4 structured modules (fundamentals → portfolio projects)
No paywall. No catch.
skool.com/mydfi-community/ab…
ICYMI: Here is one of many walkthroughs from our monthly capture the flag events in the MYDFIR SOC Community.
Learn how to investigate and build your own investigative methodology!
WATCH: SOC Analyst Full Compromise Investigation | MYDFIR SOC Community
lnkd.in/euxQaJms
While building a lab for the community, I ran into something weird.
Setup:
Attacker PC: Windows 10 22H2 (UTC):
1) Created a timestomped LNK file (Year 2028)
2) Zipped it with password-protected 7-Zip
Target PC: Windows 11 24H2 (PST)
1) Extracted the file
2) Examined the MFT
- SI records 2028 && FN records 2026 (so far so good)
3) Shift + Right-Click LNK > Run as Administrator
The weird part:
After running it as Administrator, the FN timestamp, what use to be 2026 is now blank which if I am not mistaken would indicate it is the same time as SI.
Has anyone else seen this behavior? Not sure if this is a known thing or something new with 24H2.
Anyways, another reason to be sure to correlate with other artifacts!
#DFIR
ALT Extracted File
ALT Run As Administrator
Received a fake sponsorship email back on Oct 4th. Here is a full video of my analysis! Perfect for aspiring SOC analysts.
REAL SOC Analyst Investigation | Email Phishing | MYDFIR SOC Community
youtu.be/gB7mPHGxFK8
We officially wrapped up our first CTF inside the MYDFIR SOC Community and it honestly warms my heart to see how much growth has happened in such a short time.
Watching members put in the work, dive deep into research, and push themselves to get better every single day is what fuels me to keep going and make sure they have everything they need to succeed.
Here is one of our members first writeup!
linkedin.com/posts/toukeevan…
Here is a 50 minute technical video going through how I would investigate a malware compromise.
This is perfect for aspiring SOC Analysts who want to see my thought process, what questions I ask and how I craft up my KQL queries to understand what happened.
REAL SOC Analyst Investigation | MALWARE DETECTED | MYDFIR SOC Community
youtu.be/d0cv5yrO3Tc?si=UUhQ…
MyDFIR retweeted
Everybody wants a roadmap to some Tech role but nobody is willing to put in the hardcore work needed to complete the roadmap..
When they ask, “Do you have a road map?”
Most people mean..
“I’m too lazy.. please give me a perfectly crafted magically path, where I don’t have to do too much work to acquire the skills to land a Tech job.”
MyDFIR retweeted
Had an incredible time working on this case! 🔍
Proud to share my first contribution to @TheDFIRReport, I learned so much from investigating this case and can't wait to contribute more ☺️🐼
🌟New report out today!🌟
From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion
Analysis/reporting completed by @RussianPanda, Christos Fotopoulos, Salem Salem, reviewed by @svch0st.
Audio: Available on Spotify, Apple, YouTube and more!
Report:⬇️
Enjoy! I am excited to see how y’all transform this into something even better. These are just the building blocks, it is up to you and your creativity 💙
youtu.be/Xh9AP-x06jU?feature…
A SOC Project with N8N, Splunk, ChatGPT & Slack hm…
SOC Automation Project 2.0 coming soon 👀
If you haven’t already, check out my projects playlist on YouTube. Put 2-3 of these onto your portfolio and you’ll be in good shape!
Cybersecurity Analyst Projects
youtube.com/playlist?list=PL…
This was a fun report!
HTML Smuggling Leads to Domain Wide Ransomware
➡️Initial Access: Thread-Hijacked Email > HTML Attachment
➡️Credentials: LSASS Access, SessionGopher
➡️Lateral Movement: RDP, PsExec
➡️C2: IcedID, Cobalt Strike
➡️Impact: Nokoyawa Ransomware
thedfirreport.com/2023/08/28…
MyDFIR retweeted
HTML Smuggling Leads to Domain Wide Ransomware
➡️Initial Access: Thread-Hijacked Email > HTML Attachment
➡️Credentials: LSASS Access, SessionGopher
➡️Lateral Movement: RDP, PsExec
➡️C2: IcedID, Cobalt Strike
➡️Impact: Nokoyawa Ransomware
thedfirreport.com/2023/08/28…
A SOC Project with N8N, Splunk, ChatGPT & Slack hm…
SOC Automation Project 2.0 coming soon 👀
If you haven’t already, check out my projects playlist on YouTube. Put 2-3 of these onto your portfolio and you’ll be in good shape!
Cybersecurity Analyst Projects
youtube.com/playlist?list=PL…
Just uploaded another investigation for aspiring SOC analysts. This time around - Unusual Network Traffic.
Enjoy 💙
REAL SOC Analyst Investigation | Unusual Network Traffic
youtu.be/kUYNGIG91WE
ICYMI: I just uploaded a 40 minute technical video going through how I would investigate a successful account compromise.
This is perfect for aspiring SOC Analysts who want to see my thought process, what questions I ask and how I craft up my KQL queries to understand what happened.
REAL SOC Analyst Investigation | Account Compromise
youtu.be/RHmy5bGcKTI
