What this book covers
Chapter 1, Investigating Email Threats, provides an in-depth analysis of email-based cyber threats and the techniques used by threat actors to gain initial access. This chapter provides a comprehensive overview of the anatomy of secure email gateway logs and how to use them to investigate suspicious emails.
Chapter 2, Email Flow and Header Analysis, provides an in-depth analysis of email flow and the importance of email header analysis for investigating email-based cyber threats. It then explores the different email authentication techniques, such as SPF, DKIM, and DMARC, and the investigation of email headers of spoofed messages.
Chapter 3, Introduction to Windows Event Logs, discusses the different types of Windows event logs. It then provides an overview of the various tools and techniques that SOC analysts can use to analyze Windows event logs effectively.
Chapter 4, Tracking Accounts Login and Management, explores the critical role of account and login event tracking in detecting and investigating security incidents. It then delves into the specifics of account and group management tracking and the types of events that should be monitored for security purposes.
Chapter 5, Investigating Suspicious Process Execution Using Windows Event Logs, provides a comprehensive overview of Windows processes and different types of processes, and a solid understanding of how to investigate suspicious process executions by using the Windows event logs.
Chapter 6, Investigating PowerShell Event Logs, provides an overview of PowerShell, and how it could be used by attackers to carry out malicious activity on a system. It then delves into the specifics of PowerShell execution tracking events and how they can be used to identify suspicious activity.
Chapter 7, Investigating Persistence and Lateral Movement Using Windows Event Logs, explores attackers’ persistence and lateral movement techniques to maintain access to a compromised system and move laterally across a network and explains how these techniques can be detected and investigated using Windows event logs.
Chapter 8, Network Firewall Logs Analysis, delves into the anatomy of firewall logs and provides a solid understanding of their structure and how to effectively use them to detect and investigate security incidents.
Chapter 9, Investigating Cyber Threats by Using Firewall Logs, covers how to use firewall logs for detecting and investigating security incidents, including four major types of attacks: reconnaissance, lateral movement, C&C, and Denial of Service (DoS).
Chapter 10, Web Proxy Log Analysis, delves into the value of proxy logs in detecting and investigating security incidents. It provides an overview of the anatomy of proxy logs and the various types of information provided in them.
Chapter 11, Investigating Suspicious Outbound Communications (C&C Communications) by Using Proxy Logs, focuses on the key attributes and techniques of suspicious outbound communications, including C&C communications, and provides valuable insights into investigating such activities by analyzing web proxy logs.
Chapter 12, Investigating External Threats, provides insights into various types of web attacks and suspicious external access to remote services. It also covers WAF and application logs and their value in detecting and investigating such attacks.
Chapter 13, Investigating Network Flows and Security Solutions Alerts, guides SOC analysts in investigating cyber threats using network flows, IPS/IDS alerts, network antivirus, and sandbox alerts. Furthermore, the chapter explores the techniques to investigate alerts generated by EDR and antivirus solutions.
Chapter 14, Threat Intelligence in an SOC Analyst’s Day, provides an overview of threat intelligence and its importance in investigating cyber threats. It also covers several tools and platforms for investigating threats, including VirusTotal, IBM-XForce, AbuseIPDB, and Google.
Chapter 15, Malware Sandboxing – Building a Malware Sandbox, provides a comprehensive practical guide for SOC analysts on developing an on-premises sandbox environment to investigate suspicious files using static and dynamic malware analysis techniques. It covers the required tools for analysis, the preparation of guest VMs, various analysis tools in action, and a demo lab for better understanding.
