A Day In The Life Of Our SOC Heroes: Behind The Scenes Of A Ransomware Attack

2025-02-15

Every day in our SOC starts with an alert, a potential sign of a cyber threat. This alert is our call to action, and our team springs into motion.

Meet Ali, our vigilant Tier 1 Analyst. He dives into alerts using powerful tools like Wazuh (SIEM) and tcpdump, spotting anomalies and gauging the severity of situations. When Ali detects something suspicious, he knows it’s time to call in Tier 2 Analyst.

Maryam, our skilled Tier 2 Analyst, takes the investigation to the next level with advanced tools like Wireshark, Cortex, and MISP. She enriches our threat intelligence and assesses the full scope of threats, ensuring no stone is left unturned.

Together, Ali and Maryam meticulously document every finding in TheHive, fostering seamless collaboration and a coordinated response. Their teamwork not only enhances our detection and analysis process but also maximizes the capabilities of our SOC tools, fortifying our defense against cyberattacks.

Practice Verified Codes and Commands:

1. Wazuh (SIEM) Commands:

Check Wazuh agent status: `systemctl status wazuh-agent`
– Start Wazuh agent: `systemctl start wazuh-agent`
– Stop Wazuh agent: `systemctl stop wazuh-agent`
– Restart Wazuh agent: `systemctl restart wazuh-agent`

2. tcpdump Commands:

Capture packets on a specific interface: `tcpdump -i eth0`
– Capture packets from a specific IP: `tcpdump host 192.168.1.1`
– Capture packets to a specific port: `tcpdump port 80`
– Save captured packets to a file: `tcpdump -w capture.pcap`

3. Wireshark Commands:

Open a capture file: `wireshark capture.pcap`
– Filter packets by IP: `ip.addr == 192.168.1.1`
– Filter packets by protocol: `tcp`
– Filter packets by port: `tcp.port == 80`

4. Cortex Commands:

Start Cortex service: `systemctl start cortex`
– Stop Cortex service: `systemctl stop cortex`
– Restart Cortex service: `systemctl restart cortex`
– Check Cortex service status: `systemctl status cortex`

5. MISP Commands:

Start MISP service: `systemctl start misp`
– Stop MISP service: `systemctl stop misp`
– Restart MISP service: `systemctl restart misp`
– Check MISP service status: `systemctl status misp`

6. TheHive Commands:

Start TheHive service: `systemctl start thehive`
– Stop TheHive service: `systemctl stop thehive`
– Restart TheHive service: `systemctl restart thehive`
– Check TheHive service status: `systemctl status thehive`

What Undercode Say:

In the ever-evolving landscape of cybersecurity, the role of a Security Operations Center (SOC) is paramount. The SOC is the nerve center of an organization’s defense mechanism, where threats are detected, analyzed, and mitigated in real-time. The tools and techniques employed by SOC analysts, such as Wazuh, tcpdump, Wireshark, Cortex, MISP, and TheHive, are critical in identifying and responding to cyber threats.

Wazuh, an open-source SIEM tool, provides real-time monitoring and alerting, enabling analysts to detect anomalies quickly. Tcpdump, a powerful command-line packet analyzer, allows for deep packet inspection, helping to identify malicious traffic. Wireshark, with its graphical interface, offers a more intuitive way to analyze network traffic, making it easier to spot irregularities.

Cortex and MISP are indispensable for threat intelligence. Cortex automates the analysis of observables, while MISP facilitates the sharing of threat intelligence across organizations. TheHive, a scalable security incident response platform, ensures that all findings are documented and acted upon promptly, fostering collaboration among team members.

In conclusion, the synergy between these tools and the expertise of SOC analysts like Ali and Maryam is what keeps organizations safe from cyber threats. The continuous evolution of these tools and the skills of the analysts are crucial in staying ahead of adversaries. As cyber threats become more sophisticated, the importance of a well-equipped and well-trained SOC cannot be overstated.

For further reading on SOC tools and techniques, visit:
– Wazuh Documentation
– Wireshark User Guide
– Cortex Documentation
– MISP User Guide
– TheHive Documentation