Within many large organizations, the IT department usually implements a network operation center (NOC) to monitor and resolve all network-related issues. With the rise of security threats, organizations can sometimes implement a dedicated team that focuses on cybersecurity; this team is called the security operation center (SOC).
The responsibilities of the SOC range from threat monitoring and remediation to security appliance configurations, compliance, forensics, and even reverse malware engineering.
Some of the suspicious activities that should be investigated by the SOC include the following:
- Abnormal traffic spikes during after-work hours
- Unusual inbound and outbound traffic flow
- Abnormal DNS requests
The following screenshot shows the Wireshark capture in my lab. By carefully observing the flow of packets, we can see that a port scan is taking...
