SOC Analyst Study Notes: Classes 16–22

These notes cover Classes 16–22 of the Defronix Cyber Security SOC Analyst Job Ready Free Course. I have kept the explanations simple for beginners and separated confirmed course topics from supplementary study notes.

Class 16: Data Packets and the TCP 3-Way Handshake

Confirmed course topic: IP addresses, data packets, and the TCP 3-way handshake for SOC L1.

1. Data Packets

When information travels across a network, it is divided into smaller units called packets. These packets contain information that helps deliver data to the correct destination.

Why it matters in SOC: An analyst may inspect network traffic to identify suspicious connections or unusual communication between devices.

2. IP Addresses

An IP address identifies a device or network interface so that data can be sent to the correct destination.

• Source IP: Where the packet comes from.
• Destination IP: Where the packet is going.

SOC analysts use IP addresses to investigate connections and identify potentially suspicious sources.

3. TCP 3-Way Handshake

TCP uses a three-step process to establish a connection between two devices.

1. SYN: The client requests a connection.
2. SYN-ACK: The server acknowledges the request.
3. ACK: The client confirms, and the connection is established.

Why it matters in SOC: Understanding this process helps analysts interpret connection logs and investigate unusual connection attempts.

Supplementary study note: Packet headers can also contain port numbers, protocol information, and TCP flags. These details can help analysts understand network activity, but the available course description does not confirm every one of these subtopics was covered in the lecture.

Class 17: IDS, Proxy, and VPN Infrastructure

Verification status: The title and video link could not be confirmed from the available course announcements. The following is supplementary beginner material based on the learner's roadmap.

1. IDS and IPS

An Intrusion Detection System (IDS) monitors network traffic and alerts security teams about potentially malicious activity.

An Intrusion Prevention System (IPS) can also take action to block detected threats, depending on its configuration.

SOC example: An IDS alert may help an analyst investigate repeated suspicious connection attempts.

2. Proxy Servers

A proxy acts as an intermediary between a user's device and another server.

• Forward proxy: Typically handles requests from users to external services.
• Reverse proxy: Sits in front of servers and receives requests from clients.

SOC example: Proxy logs can help analysts investigate suspicious websites, unusual access patterns, or possible data transfers.

3. VPNs

A Virtual Private Network (VPN) creates an encrypted connection between a device and a VPN endpoint.

VPNs are commonly used for remote access and privacy. However, a VPN does not automatically make every activity safe or anonymous.

SOC example: Analysts may investigate VPN login records, unfamiliar login locations, and unusual access times.

Class 18: APTs and DNS Poisoning

Verification status: The title and video link could not be confirmed from the available course announcements. The following is supplementary beginner material based on the learner's roadmap.

1. Advanced Persistent Threats (APTs)

An APT is a prolonged and often targeted cyberattack in which an attacker attempts to maintain access to a system or organization.

Attackers may use techniques such as phishing, credential theft, and unauthorized access to reach their objectives.

SOC example: Analysts may correlate login events, endpoint alerts, and network activity to investigate a possible long-running intrusion.

2. DNS

The Domain Name System (DNS) translates domain names, such as example.com, into IP addresses that computers can use to communicate.

DNS is important because devices commonly use it when accessing websites and other network services.

The 3 Simple Steps

1. You ask for a name: You type example.com into your browser. Your computer asks the DNS server, "What is the IP number for this name?"
2. DNS gives the number: The DNS server checks its directory and sends back the IP address: 93.184.216.34.
3. You open the site: Your computer uses that number to connect directly to the website server and load the page.

3. DNS Poisoning

DNS poisoning involves manipulating DNS information so that a domain name directs users to an incorrect or malicious destination.

SOC example: Unexpected DNS responses or unusual DNS requests may be useful clues during an investigation. Analysts need additional evidence before deciding that an attack has occurred.

Supplementary study note: Defensive measures can include monitoring DNS activity, securing DNS infrastructure, and using appropriate DNS security controls.

Class 19: Windows Architecture and Registry

Confirmed course topic: Windows architecture, including kernel mode and user mode, and Windows Registry components.

1. Windows Architecture

Windows separates system operations into different privilege levels.

• User mode: Where ordinary applications run with restricted access to critical system resources.
• Kernel mode: Where core operating-system components operate with greater privileges.

This separation helps protect the operating system from application errors and unauthorized access.

SOC relevance: Understanding these modes helps analysts understand the difference between normal application activity and activity involving sensitive system components.

2. Windows Registry

The Windows Registry is a database that stores configuration settings for Windows, applications, users, and devices.

It is organized into structures such as keys and values.

SOC relevance: Investigators may examine Registry changes when looking for suspicious configuration modifications or possible persistence mechanisms.

Supplementary study note: Registry evidence should be interpreted alongside other logs and system activity rather than treated as proof of an attack by itself.

Class 20: Windows Event Logs, Processes, and Services

Confirmed course topic: Windows event logs, processes, and services.

1. Windows Event Logs

Windows records many system and security events in logs. These records can help explain what happened on a computer.

For example, security logs may record successful or failed logins, while system logs may contain information about system components and services.

SOC relevance: Analysts use logs to build timelines, investigate suspicious activity, and understand how an incident developed.

2. Processes

A process is a running instance of a program.

For example, a browser running on a computer is a process. Investigators may examine process names, parent processes, command-line arguments, and execution times.

SOC relevance: A familiar program can still be used maliciously, so analysts examine its behavior and context.

3. Windows Services

Services are programs that can run in the background to provide operating-system or application functions.

SOC relevance: An unexpected service, especially one created during suspicious activity, may indicate unauthorized changes and should be investigated.

Supplementary study note: Event IDs such as 4624 (successful logon), 4625 (failed logon), and 4688 (process creation) can be useful during Windows investigations. Their availability and meaning depend on the relevant logging configuration and event details.

Class 21: Windows PowerShell for SOC L1

1. What Is PowerShell?

PowerShell is a command-line shell and scripting language used to manage Windows systems and automate tasks.

Administrators use it for routine system management, and security analysts may use it to investigate system activity.

2. PowerShell Commands

PowerShell commands are often called cmdlets. They commonly use a Verb-Noun naming pattern.

For example:

• Get-Process — lists running processes.
• Get-Service — displays services.
• Get-EventLog — retrieves entries from supported event logs.

These commands can help an analyst gather information during an investigation. Exact command availability depends on the PowerShell version and installed modules.

3. PowerShell and Security

PowerShell is a legitimate administration tool, but attackers can also misuse it to execute commands or scripts.

SOC relevance: Analysts may investigate unusual PowerShell execution, suspicious command-line arguments, encoded commands, and related process activity.

Supplementary study note: PowerShell logging and endpoint telemetry can help investigators understand what commands were executed and how a process was started. One suspicious command alone does not necessarily prove malicious activity.

Class 22: Windows Active Directory for SOC L1

Confirmed course topic: Active Directory and its components, including domains, organizational units, trees, and forests.

1. What Is Active Directory?

Active Directory (AD) is a Microsoft directory service used to manage users, computers, groups, and access within a Windows domain environment.

Organizations use it to centralize identity and access management.

2. Important Active Directory Components

• Domain: A logical environment for managing users, computers, and related resources.
• Organizational Unit (OU): A container used to organize directory objects and apply management or policy settings.
• Tree: A group of related domains organized in a hierarchical namespace.
• Forest: A collection of one or more AD domains that share a common directory structure and trust framework.

3. Domain Controllers

A domain controller is a server that provides Active Directory services, including authentication and directory access.

When users sign in to a domain environment, domain controllers help verify their identities and apply relevant access controls.

4. Why Active Directory Matters in SOC

If an attacker compromises an account, they may attempt to access additional systems or gain higher privileges.

SOC analysts investigate suspicious logins, unexpected group membership changes, account lockouts, and unusual authentication activity.

Supplementary study note: Windows security events related to authentication and group changes can help analysts investigate these behaviors. The relevant events and evidence depend on the system's audit configuration.

Final Thoughts

These topics connect several important areas of SOC work:

• Network traffic: Understand how devices communicate and how connections are established.
• Network security tools: Learn how IDS/IPS alerts, proxy records, and VPN logs can support investigations.
• Threat behavior: Recognize the concepts behind targeted attacks and DNS manipulation.
• Windows investigations: Understand the operating system, Registry, logs, processes, services, and PowerShell.
• Identity security: Learn how Active Directory manages accounts and access within an organization.

For beginners, the goal is not to memorize everything at once. Focus on understanding each concept, learning where its evidence appears, and practicing how to connect that evidence during an investigation.

I hope these notes help you starting your SOC Analyst journey. Keep learning, keep practicing, and stay consistent!

If you found these notes helpful, feel free to share your thoughts or learning tips in the comments.