You're reading from Effective Threat Investigation for SOC Analysts The ultimate guide to examining various threats and attacker techniques using security logs

Product type Paperback

Published in Aug 2023

Publisher Packt

ISBN-13 9781837634781

Length 314 pages

Edition 1st Edition

Concepts

Cybersecurity

Author (1):

Mostafa Yahia

View More author details

Table of Contents (22) Chapters

Preface

1. Part 1: Email Investigation Techniques

2. Chapter 1: Investigating Email Threats FREE CHAPTER

3. Chapter 2: Email Flow and Header Analysis

4. Part 2: Investigating Windows Threats by Using Event Logs

5. Chapter 3: Introduction to Windows Event Logs

6. Chapter 4: Tracking Accounts Login and Management

7. Chapter 5: Investigating Suspicious Process Execution Using Windows Event Logs

8. Chapter 6: Investigating PowerShell Event Logs

9. Chapter 7: Investigating Persistence and Lateral Movement Using Windows Event Logs

10. Part 3: Investigating Network Threats by Using Firewall and Proxy Logs

11. Chapter 8: Network Firewall Logs Analysis

12. Chapter 9: Investigating Cyber Threats by Using the Firewall Logs

13. Chapter 10: Web Proxy Logs Analysis

14. Chapter 11: Investigating Suspicious Outbound Communications (C&C Communications) by Using Proxy Logs

15. Part 4: Investigating Other Threats and Leveraging External Sources to Investigate Cyber Threats

16. Chapter 12: Investigating External Threats

17. Chapter 13: Investigating Network Flows and Security Solutions Alerts

18. Chapter 14: Threat Intelligence in a SOC Analyst’s Day

19. Chapter 15: Malware Sandboxing – Building a Malware Sandbox

20. Index

Why subscribe?

21. Other Books You May Enjoy

Index

As this ebook edition doesn't have fixed pagination, the page numbers below are hyperlinked for reference only, based on the printed edition of this book.

AbuseIPDB 150, 250

URL 251

used, for investigating suspicious inbound IPs 251, 252

accessed URL (cs-uri) field 184

account and group management tracking 73

account creation, tracking 74, 75

account deletion, tracking 74, 75

adding, to security groups 75-77

change activities, tracking 74, 75

account login tracking logs 59

failed logins, tracking 67-71

logon sessions, tracking 66, 67

successful administrator logins, tracking 64, 65

successful logins, tracking 62-64

Windows accounts 60

anti-debug techniques 269

ANY.RUN sandbox 22, 256

for file analysis 24, 25

URL 24

application event log types 51

application layer DoS attacks 168

APT3 group 119

attacker techniques

to evade email security detection 10-12

Autoruns 255, 258,...

The rest of the chapter is locked

You're reading from Effective Threat Investigation for SOC Analysts The ultimate guide to examining various threats and attacker techniques using security logs

Table of Contents (22) Chapters

Index

Authors (1)

Personalised recommendations for you

You're reading from Effective Threat Investigation for SOC Analysts The ultimate guide to examining various threats and attacker techniques using security logs

Table of Contents (22) Chapters

Index

Unlock this book and the full library FREE for 7 days

Authors (1)

Personalised recommendations for you