SOC Analyst: Zero → Senior L3

Honestly — do you know the biggest reason people learning Cyber Security get stuck? It's not because they lack resources. It's not because courses are expensive. It's because they learn in the wrong order.

Most beginners do exactly one thing: open a book, read theory, memorize, then take a certification. They memorize the 7-layer OSI model but can't read a single real packet. They know the definition of Brute Force but have never seen 1000 consecutive Event ID 4625 in one minute. They buy a $500 course then stand in front of a real SIEM not knowing what query to type.

This article is a battle map. Every phase, every skill, every specific technique. No room for "learn theory to understand, then practice" — because that approach has been proven to fail 90% of people.

Exercise #1: Capture Packets — Don't Read About It

Install Wireshark. Open it. Select your Wi-Fi interface. Capture packets on your home network right now. Don't read documentation — capture and watch simultaneously. Every packet tells a story. You just need to learn how to read it.

Type this filter into Wireshark's filter bar:

# See every TCP connection being initiated (SYN packets)
tcp.flags.syn == 1 and tcp.flags.ack == 0

# See which domains your machine is querying
dns.qry.name contains "."

# Find DNS Exfiltration indicators — weird domain names
dns.qry.name contains ".xyz"
dns.qry.name contains ".top"

When you type tcp.flags.syn == 1 and tcp.flags.ack == 0, you'll see every TCP connection your machine is initiating. Each line is an application connecting to some server. If you see your machine connecting to a domain like a2b3c4d5.xyz — that's a DNS Exfiltration indicator. Data is leaking out through DNS queries to random domains. This is a technique real APTs use.

Exercise #2: Open Event Viewer — Read What Windows Is Telling You

Press Win + R, type eventvwr.msc, hit Enter. Navigate to Windows Logs → Security. This is where Windows records everything happening on your machine — who logged in, who failed, which process ran, which file was accessed. Start with these 3 Event IDs:

Hands-on exercise: filter for Event ID 4625 in the last 24 hours on your machine. How many failed logins do you see? From which IPs? If there are > 50 from the same IP — someone is brute forcing your machine.

# Query Event ID 4625 (Failed Logon) in the last 24 hours
Get-WinEvent -FilterHashtable @{
    LogName = 'Security'
    Id = 4625
    StartTime = (Get-Date).AddHours(-24)
} | Select-Object TimeCreated, 
    @{N='TargetUser';E={$_.Properties[5].Value}},
    @{N='SourceIP';E={$_.Properties[19].Value}} |
    Format-Table -AutoSize

# Count failed logons by source IP
Get-WinEvent -FilterHashtable @{LogName='Security';Id=4625} |
    Group-Object {$_.Properties[19].Value} |
    Sort-Object Count -Descending |
    Select-Object Count, Name -First 10

Windows Internals Deep Dive

Once you're comfortable with Event Viewer, you need to understand where attackers hide. Windows has several persistence locations (running code on every startup) that every SOC analyst must know by heart:

# PERSISTENCE VECTORS — Where attackers hide auto-running code

# 1. Registry Run keys (auto-run when user logs in)
# Check:
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"

# 2. Service creation (create hidden service)
# Check:
reg query "HKLM\SYSTEM\CurrentControlSet\Services" /s | findstr "ImagePath"

# 3. Scheduled Tasks (tasks running on schedule)
schtasks /query /fo LIST /v

# 4. Group Policy audit
gpresult /H report.html

Linux Basics — You Don't Need to Learn Everything

You don't need to become a Linux admin. You just need to be able to read Linux logs and know a few filter commands. Here are the log files you must know:

# Read authentication log — find failed SSH logins
sudo cat /var/log/auth.log | grep "Failed password"

# Read syslog — system overview
sudo tail -100 /var/log/syslog

# Read Nginx access log — find web attacks
sudo cat /var/log/nginx/access.log | grep "POST" | grep "200"

# Use grep + awk + cut to filter
grep "Failed password" /var/log/auth.log | \
    awk '{print $(NF-3)}' | \
    sort | uniq -c | sort -rn | head -20

# Check crontab — persistence vector
crontab -l
sudo crontab -l

# Check systemd services
systemctl list-unit-files --state=enabled

Hands-on exercise: write a Bash script to parse auth.log for failed SSH logins, count by IP, and output the top 10:

#!/bin/bash
# ssh_brute_detector.sh — Detect SSH brute force
# Usage: ./ssh_brute_detector.sh [threshold]

LOG="/var/log/auth.log"
THRESHOLD=${1:-50}

echo "=== SSH Brute Force Detector ==="
echo "Threshold: $THRESHOLD attempts"
echo "Log file: $LOG"
echo ""

# Count failed logins by IP
echo "--- Top attacking IPs ---"
grep "Failed password" "$LOG" | \
    awk '{ 
        for(i=1;i<=NF;i++) 
            if($i=="from") print $(i+1) 
    }' | \
    sort | uniq -c | sort -rn | \
    awk -v thresh="$THRESHOLD" '$1 >= thresh {print $1 " attempts → " $2 " ⚠️ BRUTE FORCE"}'

echo ""
echo "--- Targeted accounts ---"
grep "Failed password" "$LOG" | \
    awk '{
        for(i=1;i<=NF;i++)
            if($i=="for") print $(i+1)
    }' | sort | uniq -c | sort -rn | head -10

Weekly Lab Roadmap

The Truth About L1 Work

Sit staring at alerts for 8 hours a day. Most are false positives. But one is real. Find it. That's your job. And to do that, you have to write SIEM queries as fast as writing your native language — fast, accurate, no syntax errors. Every second of delay gives the attacker more time.

Splunk SPL — Learn It This Way or Stay Slow

Don't learn syntax first. Start from investigation questions. Example: "Which accounts are being brute forced in the last 24 hours?" — translate that question into SPL:

# Brute Force Detection — Find accounts being brute forced
index=windows_logs EventCode=4625
| stats count by TargetUserName, Source_Network_Address
| where count > 50
| sort - count

# Brute Force Success — Account brute forced then successfully logged in
index=windows_logs (EventCode=4625 OR EventCode=4624)
| stats count as attempts, 
    count(eval(EventCode=4625)) as failed, 
    count(eval(EventCode=4624)) as succeeded
  by TargetUserName, Source_Network_Address
| where failed > 10 AND succeeded > 0
| sort - failed

# Detect Impossible Travel — logins from 2 countries within 1 hour
index=windows_logs EventCode=4624 Logon_Type=10
| iplocation Source_Network_Address
| stats values(Country) as countries, 
    dc(Country) as country_count 
  by TargetUserName
| where country_count > 1

Next challenge: "Which accounts successfully logged in after 10+ failed attempts?" — this is a sign of brute force success, the attacker guessed the right password. The second query above answers exactly that question.

Elastic KQL — Your Phishing Hunting Weapon

Phishing = the #1 attack vector. Signature tell: user opens Word/Excel → spawns PowerShell/CMD. The KQL query below detects that pattern:

# Phishing Detection — Office app spawns shell
process.parent.name : ("winword.exe" OR "excel.exe" OR "outlook.exe")
AND process.name : ("cmd.exe" OR "powershell.exe" OR "wscript.exe" OR "mshta.exe")

# Why add outlook.exe and mshta.exe?
# - outlook.exe: HTML attachment with macro/veil code
# - mshta.exe: HTML Application (HTA) — attacker uses 
#   it to run JScript/VBScript via mshta, bypassing many AV
# Most original documentation SKIPS these 2 vectors!

# Extended version — add suspicious child processes
process.parent.name : ("winword.exe" OR "excel.exe" OR "outlook.exe" OR "powerpnt.exe")
AND process.name : ("cmd.exe" OR "powershell.exe" OR "wscript.exe" OR "mshta.exe" 
    OR "cscript.exe" OR "certutil.exe" OR "bitsadmin.exe")

MITRE ATT&CK — Don't Get Overwhelmed

MITRE ATT&CK has 400+ techniques. Don't try to learn all of them. Pick the top 5 and go deep. These are the 5 techniques you'll see every day in the SOC:

For each technique: reproduce in your lab → see what it leaves in the logs → this is the only way to recognize it in production. No shortcuts. You have to create a malicious scheduled task yourself, watch Event 4698 appear, write a query to detect it. Then next time you see an alert — you'll recognize it instantly.

EDR Tools — Reading the Process Tree

CrowdStrike Falcon / Microsoft Defender for Endpoint — the two most common EDRs. The most important skill: reading the process tree (parent → child relationship). Every EDR alert shows you the process tree:

Sample process tree that should set off alarms: winword.exe → cmd.exe → powershell.exe → IEX (New-Object Net.WebClient).DownloadString(...). Word never spawns CMD. If you see this = phishing confirmed 99%.

Case Study: Web Shell — From Alert to Root Cause in 90 Minutes

This is a real L2 investigation. Every step, every decision, every query. Follow the timeline:

# List running processes
python3 vol.py -f memory.dmp linux.pslist

# Network connections — find reverse shells
python3 vol.py -f memory.dmp linux.netstat

# Find injected code in process memory
python3 vol.py -f memory.dmp linux.malfind

# DLL libraries loaded — find suspicious DLLs
python3 vol.py -f memory.dmp linux.dlllist

# Windows equivalents (if memory dump is Windows)
python3 vol.py -f memory.dmp windows.pslist
python3 vol.py -f memory.dmp windows.netstat
python3 vol.py -f memory.dmp windows.malfind
python3 vol.py -f memory.dmp windows.dlllist

Incident Response Framework

L2 analysts must have an IR Playbook for each type of incident. Standard framework: Contain → Eradicate → Recover → Lessons Learned. Every step has a specific checklist, nothing is "improvised." Root cause analysis methodology: 5 Whys — ask "why?" 5 times to find the real root cause, not just the symptom.

Static Malware Analysis

L2 doesn't need to know full reverse engineering. But you must know static malware analysis — reading a binary without running it:

PE Header Reading — what does the binary say before it runs? Use pestudio or die (Detect It Easy) to read the PE header: which compiler, which sections are abnormal, which imports are suspicious (VirtualAlloc, WriteProcessMemory, CreateRemoteThread = process injection).

Strings Extraction — use FLOSS (FireEye Labs Obfuscated String Solver) instead of regular strings, because FLOSS decodes obfuscated strings too:

rule Suspicious_PowerShell_Download {
  meta:
    description = "Detects PowerShell download cradle patterns"
    author = "QA210"
    severity = "high"
    date = "2026-03-01"
  strings:
    $s1 = "IEX" ascii wide
    $s2 = "New-Object Net.WebClient" ascii wide
    $s3 = "DownloadString" ascii wide
    $s4 = "Invoke-Expression" ascii wide
    $s5 = "FromBase64String" ascii wide
    $s6 = "System.Net.Sockets" ascii wide
  condition:
    2 of ($s1, $s2, $s3, $s4, $s5, $s6)
}

VirusTotal Deep Dive — don't just check the detection ratio. Read the behavioral analysis tab: what processes does it spawn, what files does it create, what registry keys does it modify, what network connections does it make. That's where you see the malware's real TTPs.

L2 Hands-On Lab

1. Download FlareVM + REMnux — the two standard malware analysis VMs. FlareVM = Windows analysis, REMnux = Linux analysis. Set up both, network isolated.
2. Get real samples from MalwareBazaar.abuse.ch — in a sandbox! Download samples, analyze with pestudio, FLOSS, strings, YARA. Never run on your real machine.
3. Run Volatility3 on sample memory dumps — search GitHub for "volatility memory dump samples", download, analyze. Find injected processes, network connections, persistence mechanisms.
4. Build a vulnerable Apache server, upload a web shell, investigate yourself, then patch. Investigating your own case = deepest understanding.

The Biggest Mindset Shift

L1/L2 react to alerts. Seniors create new detections for things that no alert covers. The question a Senior asks every week:

Threat Hunting — 4-Step Process

Sample hunt query — find DLL Sideloading (DLL loading from unusual directories):

# DLL Sideloading Hunt — Find DLLs loading from unusual directories
event.type: "library" AND
dll.path: (* AND NOT "C:\\Windows\\*" AND NOT "C:\\Program Files\\*")
AND process.name: ("svchost.exe" OR "lsass.exe" OR "explorer.exe")

# Logic: svchost/lsass/explorer should only load DLLs 
# from C:\Windows\ or C:\Program Files\
# If loading DLL from AppData, Temp, Downloads → SIDESTEPPING

Sigma Rules — Write New Detections

What is Sigma? A standard format for writing detection rules — vendor-agnostic. Write 1 Sigma rule → convert to Splunk SPL, Elastic KQL, Microsoft Sentinel KQL, QRadar AQL... All from 1 source. This is why Seniors must know how to write Sigma:

title: Potential Credential Dumping via LSASS Access
id: a3a8c5e2-7f1b-4d9e-a6c3-8b2d1e4f5a7c
status: production
level: high
author: QA210
date: 2026/03/01
description: >
  Detects potential credential dumping by monitoring process access 
  to lsass.exe with specific access patterns used by Mimikatz 
  and similar tools.

logsource:
  category: process_access
  product: windows

detection:
  selection:
    TargetImage|endswith: '\lsass.exe'
    GrantedAccess|contains:
      - '0x1010'
      - '0x1410'
      - '0x143a'
      - '0x1410'
  condition: selection

tags:
  - attack.credential_access
  - attack.t1003.001
  - attack.credential_access
  - car.2019-04-004

Python Automation — Real Scripts, Not Hello World

The script below enriches IOCs from the VirusTotal API — ready to run, processes 200 IPs per hour automatically. Add CSV export + Slack webhook = mini SOAR:

#!/usr/bin/env python3
"""
VT IOC Enrichment Script — QA210
Enrich IP addresses via VirusTotal API v3.
Free tier: 4 requests/minute → ~200 IPs/hour.
"""
import requests
import json
import csv
from time import sleep

API_KEY = "YOUR_VT_API_KEY_HERE"
VT_BASE = "https://www.virustotal.com/api/v3"

def enrich_ip(ip: str, api_key: str) -> dict:
    """Enrich single IP via VirusTotal."""
    url = f"{VT_BASE}/ip_addresses/{ip}"
    headers = {"x-apikey": api_key}
    response = requests.get(url, headers=headers)
    
    if response.status_code != 200:
        return {"ip": ip, "error": response.status_code}
    
    data = response.json()
    stats = data["data"]["attributes"]["last_analysis_stats"]
    
    return {
        "ip": ip,
        "malicious": stats.get("malicious", 0),
        "suspicious": stats.get("suspicious", 0),
        "undetected": stats.get("undetected", 0),
        "country": data["data"]["attributes"].get("country", "Unknown"),
        "owner": data["data"]["attributes"].get("as_owner", "Unknown"),
        "reputation": data["data"]["attributes"].get("reputation", 0)
    }

def bulk_enrich(ip_list: list, api_key: str, output_csv: str = None):
    """Bulk enrich IP list. Auto-throttle for VT free tier."""
    results = []
    
    for i, ip in enumerate(ip_list):
        result = enrich_ip(ip, api_key)
        results.append(result)
        
        # Alert on high-risk IPs
        if result.get("malicious", 0) > 3:
            print(f"[HIGH RISK] {ip} — "
                  f"{result['malicious']} vendors flagged malicious "
                  f"| Owner: {result.get('owner', 'N/A')}")
        
        # VT free tier: 4 requests/minute
        sleep(15)
        
        # Progress
        if (i + 1) % 10 == 0:
            print(f"[PROGRESS] {i+1}/{len(ip_list)} IPs processed")
    
    # Export to CSV if requested
    if output_csv:
        with open(output_csv, "w", newline="") as f:
            writer = csv.DictWriter(f, fieldnames=results[0].keys())
            writer.writeheader()
            writer.writerows(results)
        print(f"[EXPORT] Results saved to {output_csv}")
    
    return results

# === USAGE ===
# suspicious_ips = ["45.33.32.156", "107.189.19.52", "91.234.99.42"]
# results = bulk_enrich(suspicious_ips, API_KEY, output_csv="vt_results.csv")

SOAR Playbook — Automating Response

Automated response playbook for malware detection — reduces MTTC from 20-45 minutes (manual) to under 2 minutes:

Threat Intelligence

L3 must know how to consume and produce threat intelligence. Tools: MISP / OpenCTI — feed management and correlation. Method:

1. Feed Management — Subscribe to threat feeds (AlienVault OTX, Abuse.ch, MITRE ATT&CK). Ingest into MISP/OpenCTI. Auto-correlate with internal logs.
2. APT Group Tracking — Track APT groups by region, sector, TTPs. Know which groups target your industry.
3. TTP Mapping — Map every intel report to MITRE ATT&CK techniques. From technique → write detection rule → hunt query.
4. Write Intel Reports — Actionable, not copy-paste. Format: TTP observed → IoC list → detection recommendations → hunting queries.

Lead & Mentor

L3 isn't just technical — you have to build the team. Coaching L1/L2, reviewing detection rules, designing tabletop exercises, building security programs. This is the difference between "Senior technical" and "Senior leader":

1. L1/L2 Coaching — Pair investigation. Sit next to a junior, guide them through each step, ask "why did you make that decision?" to develop their investigative thinking.
2. Detection Rule Review — Review the team's Sigma/YARA rules. Is the logic correct? Where are the coverage gaps? What's the false positive rate?
3. Tabletop Exercise Design — Create simulated attack scenarios, let the team practice response. Discover process gaps before a real incident happens.
4. Security Program Building — Build a detection engineering pipeline, define SLAs for alert response, create metrics dashboards for SOC effectiveness.

Certifications don't replace skills. But they're checkpoints — proving you've learned enough breadth. And many companies use certifications as CV filters. Here's the certification table by phase:

Reading this and doing nothing = wasted time. Here are 5 things you can do tonight:

1. Install Wireshark + capture packets on your home network right now. Type tcp.flags.syn==1 and tcp.flags.ack==0 — see what's connecting to what. You'll be surprised how many servers your machine talks to that you never knew about. Every connection is a question: "Why is my machine connecting to this IP?"
2. Open TryHackMe — do the SOC Level 1 room tonight. Free, real labs, nothing to install. Sign up → choose "SOC Level 1" path → start. Your first hour in a SOC lab is worth more than 10 hours of watching videos.
3. Set up Elastic Stack locally with Docker in 15 minutes. docker-compose up — you've got a real SIEM running on your machine. Ingest Windows Event Logs, write your first query. This is a safe environment to make mistakes — and making mistakes is how you learn fastest.
4. Read 1 real APT report on MITRE ATT&CK or Mandiant. Understand what real attackers do. Not CTFs, not labs — real adversaries targeting real victims. Know the enemy = know what you need to detect.
5. Write your first 20-line Python script to read Windows Event Logs. import xml.etree.ElementTree — read .evtx files, analyze them yourself. Your first script = your first step into automation. From here, every next script is easier than the last.

Cyber Security doesn't lack learners. It lacks people who dare to do.

You read this article in 25 minutes. But doing every exercise across all 4 phases = 5 years of real experience. No shortcuts, no hacks — just sitting down, opening the tools, and doing the work.

The difference between a Senior and a Newbie isn't time — it's the number of times you refused to give up debugging an alert until you found the root cause. Every time you don't quit halfway, you move one step forward. Every time you choose to read logs instead of closing the alert, you move one step forward.

Start tonight. Open Wireshark. Capture packets. Ask questions.