Listen to this Post
Introduction:
A Security Operations Center (SOC) is the nerve center of any mature cybersecurity program, combining people, processes, and technology to detect, analyze, and respond to threats in real time. With the global SOC analyst shortage exceeding 3 million professionals, free high-quality training resources have become the most valuable asset for aspiring defenders. This article extracts and expands upon a recently shared SOC learning repository, providing practical commands, configurations, and step-by-step labs to transform theory into hands-on blue team skills.
Learning Objectives:
- Build a functional home SOC lab using open-source tools (Elastic SIEM, Wazuh, TheHive)
- Master essential Linux and Windows commands for log analysis, network monitoring, and incident response
- Understand SOC tier classifications (L1–L3) and prepare for real-world interview scenarios and certifications
You Should Know:
- SOC Lab Deployment – Building Your Own Detection Environment on a Single Machine
Start by virtualizing a complete SOC stack using VMware/VirtualBox and Ubuntu Server 22.04 LTS. This lab mimics enterprise environments where SIEM, endpoint detection, and case management work together.
Linux Commands to Install Elastic Stack (SIEM):
Update system and install dependencies sudo apt update && sudo apt upgrade -y sudo apt install apt-transport-https openjdk-11-jre-headless wget -y Import Elastic GPG key and add repository wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo gpg --dearmor -o /usr/share/keyrings/elastic-keyring.gpg echo "deb [signed-by=/usr/share/keyrings/elastic-keyring.gpg] https://artifacts.elastic.co/packages/8.x/apt stable main" | sudo tee /etc/apt/sources.list.d/elastic-8.x.list Install Elasticsearch, Kibana, and Logstash sudo apt update sudo apt install elasticsearch kibana logstash -y Start and enable services sudo systemctl start elasticsearch kibana logstash sudo systemctl enable elasticsearch kibana logstash Verify Elasticsearch is running curl -X GET "localhost:9200"
Windows PowerShell Commands for Endpoint Log Collection (Winlogbeat):
Download and install Winlogbeat on Windows 10/11 Invoke-WebRequest -Uri "https://artifacts.elastic.co/downloads/beats/winlogbeat/winlogbeat-8.12.0-windows-x86_64.zip" -OutFile "$env:USERPROFILE\Downloads\winlogbeat.zip" Expand-Archive -Path "$env:USERPROFILE\Downloads\winlogbeat.zip" -DestinationPath "C:\Program Files\" Configure Winlogbeat to forward logs to Elasticsearch (edit winlogbeat.yml): output.elasticsearch: hosts: ["<YOUR_SIEM_IP>:9200"] Test configuration cd "C:\Program Files\winlogbeat-8.12.0-windows-x86_64" .\winlogbeat.exe test config -c .\winlogbeat.yml -e Install as Windows service .\winlogbeat.exe install -c .\winlogbeat.yml Start-Service winlogbeat
Step‑by‑Step SOC Lab Build:
- Deploy Ubuntu Server (4GB RAM, 2 vCPUs, 50GB storage) – this hosts Elasticsearch, Kibana, and Logstash.
- After installing Elastic stack, access Kibana at `http://
:5601` and set the enrollment token from initial setup. - On a separate Windows VM (or your host), install Winlogbeat and forward Security, System, and Application logs.
- Generate test alerts: run `sudo apt install hydra -y` on Linux, then simulate a failed SSH brute force:
hydra -l admin -x 1:3:a <target-ip> ssh. Observe logs in Kibana’s Discover tab. -
SOC Analyst Tier 1 – Alert Triage and False Positive Analysis Using Command Line
Tier 1 analysts review incoming alerts from SIEMs, determine legitimacy, and escalate accordingly. Mastering log extraction and correlation is critical.
Linux Commands for Log Analysis (Common SOC Tasks):
Analyze authentication failures from /var/log/auth.log
sudo grep "Failed password" /var/log/auth.log | awk '{print $9}' | sort | uniq -c | sort -nr
Check for unusual cron jobs added by attackers
sudo cat /var/log/syslog | grep CRON | tail -20
Real-time monitoring of network connections (detect reverse shells)
sudo ss -tunap | grep ESTABLISHED
Extract all IPs attempting SSH brute force and block with iptables
sudo grep "Failed password" /var/log/auth.log | grep -oE '([0-9]{1,3}.){3}[0-9]{1,3}' | sort -u | while read ip; do sudo iptables -A INPUT -s $ip -j DROP; done
Windows Command Line (CMD) for Incident Triage:
List all running processes with network connections (find malware) netstat -ano | findstr "ESTABLISHED" Check scheduled tasks for persistence schtasks /query /fo LIST /v | findstr /i "malware" View recent security events (logon type 2=interactive, 3=network, 10=remote interactive) wevtutil qe Security /c:20 /rd:true /f:text /q:"[EventData[Data[@Name='LogonType']='2']]" Export all PowerShell operational logs (often used for living-off-the-land attacks) wevtutil epl "Microsoft-Windows-PowerShell/Operational" C:\logs\ps_logs.evtx
Step‑by‑Step Alert Investigation (False Positive vs True Positive):
- Receive alert: “Multiple failed logins for user ‘admin’ from IP 192.168.1.100 within 2 minutes.”
2. SSH into the SIEM server: `ssh [email protected]`
- Query Elasticsearch logs: `curl -X GET “localhost:9200/_search?q=user.name:admin AND event.outcome:failure” | jq ‘.hits.hits[] | ._source.timestamp, ._source.source.ip’`
4. Check if the source IP (192.168.1.100) belongs to a known jump server or user workstation (use Asset DB). - If IP is internal and the user is on vacation – likely a compromised account. Escalate to Tier 2 with a timeline of events.
-
Threat Hunting – Proactive Detection Using Sigma Rules and YARA
SOC teams don’t wait for alerts; they hunt for indicators of compromise (IOCs) using rule-based detection. Sigma is an open standard for SIEM rules, and YARA identifies malware patterns.
Installing and Running Sigma Rules on Linux:
Clone Sigma repository git clone https://github.com/SigmaHQ/sigma.git cd sigma Convert a Sigma rule to Elasticsearch query format (using sigmac) pip install sigma-cli sigma convert -t elasticsearch -r rules/windows/process_creation/win_shell_spawn_susp_program.yml Example output Elastic query – use in Kibana's Discover search bar process.parent.name:cmd.exe AND process.name:powershell.exe
Using YARA to Scan a Suspicious Directory:
Install YARA
sudo apt install yara -y
Download known rule set (e.g., from Elastic's detection rules)
git clone https://github.com/elastic/detection-rules.git
cd detection-rules/rules
Scan a mounted disk image or user folder
yara -r ./windows/malware /mnt/suspicious_files/
Sample YARA rule to detect Mimikatz (simple version)
echo 'rule Mimikatz_String { strings: $a = "mimikatz" $b = "sekurlsa" condition: $a or $b }' > mimikatz.yar
yara mimikatz.yar /usr/local/bin/
Step‑by‑Step Hunting for Lateral Movement (Pass‑the‑Hash):
- Hypothesis: Attackers are using NTLM hash relaying to move laterally.
- In Kibana, run query: `event.code:4624 AND winlog.logon.type:3 AND authentication.package:Negotiate`
3. Filter for unusual source-to-destination pairs (e.g., Workstation A connecting to Domain Controller). - Export results to CSV: `curl -X GET “localhost:9200/winlogbeat-/_search?size=1000&pretty” > lateral_movement.json`
5. Use `jq` to parse: `cat lateral_movement.json | jq ‘.hits.hits[]._source | “\(.user.name) logged from \(.source.ip) to \(.destination.ip)”‘`
6. If an account logs into 20+ machines within 1 hour – immediate containment. -
Red vs. Blue Team Simulation – Emulating TTPs and Writing Detection Rules
SOC analysts must understand adversarial behavior. Using Caldera (MITRE ATT&CK emulation) and Atomic Red Team, blue teams can test detection coverage.
Deploying Caldera (Linux) and Running a TTP:
Install Python 3.10+ and pip sudo apt install python3-pip git -y Clone Caldera git clone https://github.com/mitre/caldera.git cd caldera Install requirements and run pip3 install -r requirements.txt python3 server.py --insecure Access web UI at http://localhost:8888 (default admin/admin) Create an operation with agent "sandcat" and adversary "Collection"
Windows – Running Atomic Red Team Test (Discovery):
Install Atomic Red Team (PowerShell) Install-Module -Name AtomicRedTeam -Force Import-Module AtomicRedTeam List all available techniques Get-AtomicTechnique Run T1082 – System Information Discovery Invoke-AtomicTest T1082 -TestNames "System Info Discovery"
Step‑by‑Step Writing a Custom Suricata Rule to Detect Cobalt Strike Beacon:
1. On your SOC’s network sensor, install Suricata: `sudo apt install suricata -y`
2. Create custom rule file: `sudo nano /etc/suricata/rules/cobalt_strike.rules`
- Add rule to detect default Cobalt Strike HTTP beacon pattern:
alert http any any -> any any (msg:"Cobalt Strike HTTP Beacon Detected"; http.user_agent; content:"Mozilla/5.0 (compatible; MSIE 9.0)"; http.uri; content:".jsp"; pcre:"/\/[A-Za-z0-9]{2,4}.jsp$/"; classtype:command-and-control; sid:1000001; rev:1;) - Test the rule with pcaps from `https://www.malware-traffic-analysis.net/`
sudo suricata -r suspicious_traffic.pcap -S /etc/suricata/rules/cobalt_strike.rules -l /var/log/suricata/
5. Check alert output: `cat /var/log/suricata/fast.log`
-
SOC Interview Preparation – Technical Questions and Practical Exercises
Employers test candidates on log analysis, SIEM queries, and incident response workflows. Below are real-world scenarios with commands you must know.
Common Interview Question 1: “A user reports slow computer and unknown processes. What commands do you run on Windows?”
– `tasklist /svc` – list processes and services
– `wmic process get Name,ProcessId,ParentProcessId,ExecutablePath` – get full process tree
– `Get-WinEvent -FilterHashtable @{LogName=’Security’; ID=4688} -MaxEvents 50` – recent process creation events via PowerShell
Live Exercise – Find the Malicious IP in Web Logs (Apache access.log):
Given an access.log line: 45.33.22.11 - - [14/May/2025:13:25:14 +0000] "GET /wp-admin/admin-ajax.php?action=revslider_ajax HTTP/1.1" 404 345 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
Tasks: Identify the attacker IP and possible vulnerability scanner.
Count unique IPs requesting suspicious URIs
cat access.log | grep -E "(wp-admin|phpmyadmin|.env|.git)" | awk '{print $1}' | sort | uniq -c | sort -nr
Extract all POST requests (often data exfiltration)
grep "POST" access.log | cut -d' ' -f1,7 | sort | uniq -c
Using the SIEM (Elastic), query: http.request.method:POST AND url.path:("/api/" OR "/upload")
Step‑by‑Step Building a SOC Analyst Cheatsheet:
- Create a markdown file `soc_commands.md` on your jump host.
- Organize sections: Linux Triage, Windows Forensics, SIEM Queries (EQL/KQL), Network Analysis (tcpdump filters).
- Example EQL rule for persistence detection: `process where (process.name == “reg.exe” or process.name == “schtasks.exe”) and command_line contains “/create”`
4. Practice daily on platforms like Sockpuppet (open-source SOC simulator) or TryHackMe’s SOC Level 1 path.
6. Free Certifications for SOC Career Advancement
The shared SOC resources include free certifications. Here are legit ones with direct links (verified as of 2026):
– Microsoft SC-900 (Security, Compliance, and Identity Fundamentals) – free through Microsoft Virtual Training Days (registration required)
– ISC2 Certified in Cybersecurity (CC) – free exam voucher + training (limited time offers)
– TryHackMe SOC Level 1 – free first few modules; full path often discounted
– Blue Team Level 1 (BTL1) – not free but includes a free mini-course with practical SOC simulation
How to list these on LinkedIn (for recruiters):
- Security Operations Center (SOC) Analyst Fundamentals – Practical SIEM & Log Analysis (Hands-on with ELK/Wazuh) - Certified in Cybersecurity (ISC2) CC – Exam Voucher Earned (Issued [Month 2026]) - Threat Hunting with Sigma & YARA – Open Source Detection Engineering (Self-Paced Lab)
What Undercode Say:
- Free resources are abundant, but a lab you build yourself is worth more than 100 PDFs. The shared SOC bundle provides theory, but only by deploying Elastic SIEM, writing your own detection rules, and analyzing real attacks will you gain the muscle memory for a Tier 1 role.
- Automation is your force multiplier. Integrate the Linux iptables blocking logic from Section 2 into a cron job that runs every 5 minutes, pulling fresh fail2ban alerts – this mimics enterprise SOAR playbooks.
- Soft skills in DMs (as the original post emphasizes) mirror SOC escalation protocols. Just as the analyst must articulate findings to incident commanders, your ability to explain a false positive vs. attacker TTP concisely defines your career growth.
Prediction:
By Q4 2026, SOC-as-a-Service platforms will integrate LLM-based co-pilots that automatically translate Sigma rules to native SIEM queries and generate incident timelines from raw logs. However, entry-level SOC roles will shift away from basic alert triage (automated by AI) toward “Alert Validation Engineers” – human analysts who fine-tune detection logic and investigate edge cases. Professionals who combine free resources like the one shared with hands-on lab proficiency will remain irreplaceable. Expect interview questions to replace “What is a SIEM?” with “Write a YARA rule for a new malware variant.” Start practicing today.
▶️ Related Video (82% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Dharamveer Prasad – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
