Overview of My First Book “Effective Threat Investigation for SOC Analysts”
After a year of dedicated effort during evenings and weekends, my first book ‘Effective Threat Investigation for SOC Analysts’ was finally launched on August 25, 2023. In this book, I have explained most modern cyber threats that may face any SOC Analyst and how to detect and investigate them by analyzing the security logs generated from various sources.
Why I wrote this book?
I authored this book to fill a glaring gap in the available resources for SOC analysts that explaining how to investigate cyber threats utilizing the logs , aiming to equip them with the skills needed to effectively investigate modern cyber threats by analyzing logs generated from log sources like the Secure Email Gateways, Windows OSs, Firewalls, Proxies, and various other security controls. Drawing from years of personal experience, I recognized that SOC analysts across different proficiency levels often encounter challenges in acquiring this vital knowledge.
The Book content
The book is structured into four parts, each comprising a total of 15 comprehensive chapters as follows:
The first part is “Email Investigation Techniques”, this part including the first two chapters:
Chapter 1, Investigating Email Threats, provides an in-depth analysis of email-based cyber threats and the techniques used by threat actors to gain initial access such as Phishing Emails, Blackmailing emails, Email spoofing, BEC, Email thread hijacking, and more . This chapter provides a comprehensive overview of the anatomy of secure email gateway logs and how to use them to investigate suspicious emails.
Chapter 2, Email Flow and Header Analysis, provides an in-depth analysis of email flow and email header for investigating email-based cyber threats. It then explores the different email authentication protocols, such as SPF, DKIM, and DMARC, and the investigation of email headers of spoofed Email messages.
The second part is “Investigating Windows Threats by Using Event Logs”, this part including the chapters from 3 to 7 :
Chapter 3, Introduction to Windows Event Logs, discusses the different types of Windows event logs. It then provides an overview of the various tools and techniques that SOC analysts can use to analyze Windows event logs effectively. This chapter provides an introduction the lab I built for the rest part’s chapters.
Chapter 4, Tracking Accounts Login and Management, explores the critical role of Windows accounts as well as their types. It then delves into accounts login and account and group management tracking and the types of events that should be monitored for security purposes to detect and investigate cyber threats.
Chapter 5, Investigating Suspicious Process Execution Using Windows Event Logs, provides a comprehensive overview of the Windows processes and different types of processes. It also provides a solid understanding of how to investigate suspicious process executions and techniques such as the Hiding in plain sight, Living Off The Land (LOTL), Suspicious parent-child process relationships, and Suspicious process paths by using the Windows event logs.
Chapter 6, Investigating PowerShell Event Logs, provides an overview of PowerShell, and how it could be used by attackers to carry out malicious activity on a system. It then delves into the PowerShell execution tracking events and artifacts and how they can be used to identify suspicious activity.
Chapter 7, Investigating Persistence and Lateral Movement Using Windows Event Logs, explores most common attackers’ persistence and lateral movement techniques to maintain access to a compromised system and move laterally across a network and explains how these techniques can be detected and investigated using Windows event logs.
The third part is “Investigating Network Threats by Using Firewall and Proxy Logs”, this part including the chapters from 8 to 11:
Chapter 8, Network Firewall Logs Analysis, delves into the anatomy of firewall logs and provides a solid understanding of their structure and how to effectively use them to detect and investigate cyber attacks.
Chapter 9, Investigating Cyber Threats by Using Firewall Logs, covers how to use firewall logs for detecting and investigating security incidents, including four major types of attacks: reconnaissance, lateral movement, C&C, exfiltration and Denial of Service (DoS).
Chapter 10, Web Proxy Log Analysis, delves into the value of proxy logs in detecting and investigating security incidents. It provides an overview of the anatomy of proxy logs and the various types of information provided in them.
Chapter 11, Investigating Suspicious Outbound Communications (C&C Communications) by Using Proxy Logs, focuses on the key attributes and techniques of suspicious outbound communications ,including C&C communications, and provides valuable insights into investigating such activities by analyzing web proxy logs in questions, answers, and hypothesis manner.
The fourth part is “Investigating Other Threats and Leveraging External Sources to Investigate Cyber Threats”, this part including the chapters from 12 to 15:
Chapter 12, Investigating External Threats, provides insights into various types of web attacks such as SQL and command injection, XSS, path traversal and suspicious external access to remote services such as RDP and VPN. It also covers WAF and application logs and their value in detecting and investigating such attacks.
Chapter 13, Investigating Network Flows and Security Solutions Alerts, guides SOC analysts in investigating cyber threats using network flows, IPS/IDS alerts, network antivirus, and sandbox alerts. Further more, the chapter explores the techniques to investigate alerts generated by EDR and antivirus solutions.
Chapter 14, Threat Intelligence in an SOC Analyst’s Day, provides an overview of threat intelligence and its importance in investigating cyber threats. It also covers several tools and platforms for investigating threats, including VirusTotal, IBM-XForce, AbuseIPDB, and Google.
Chapter 15, Malware Sandboxing — Building a Malware Sandbox, provides a comprehensive practical guide for SOC analysts on developing an on-premises sandbox environment to investigate suspicious files using static and dynamic malware analysis techniques. It covers the required tools for analysis, the preparation of guest VMs, various analysis tools in action, and a demo lab for better understanding.
This book is crafted in accessible language, and including numerous real-world and practical scenarios, with the overarching goal of assisting you in fortifying your organization against diverse cyber threats.
If you believe that this book aligns with your reading interests and needs, you can conveniently order it from Amazon: https://www.amazon.com/Effective-Threat-Investigation-SOC-Analysts/dp/1837634785
If you have any inquiries, please feel free to reach out to me on LinkedIn or email me at Mostafayahia753@gmail.com without hesitation.
