Cyber Security 08 — CySA+ & SOC Analyst

1. CySA+ Exam Overview

Domain	Weight	Key Topics
Security Operations	33%	Log analysis, SIEM, threat intel, monitoring
Vulnerability Management	30%	Scanning, patch priority, risk scoring (CVSS)
Incident Response & Management	20%	IR lifecycle, containment, forensics, reporting
Reporting & Communication	17%	Dashboards, KPIs, escalation, stakeholder comms

Exam: CS0-003 | 85 questions (MCQ + Performance-Based) | 165 min | Pass: 750/900

2. SOC Tiers Overview

Tier	Role	Responsibilities
Tier 1	Alert Analyst	Monitor SIEM alerts, triage, escalate, follow playbooks
Tier 2	Incident Responder	Deep investigation, containment, log correlation
Tier 3	Threat Hunter / Expert	Proactive hunting, malware analysis, create detections
Tier 4	SOC Manager	Team leadership, metrics, process improvement

3. SOC Alert Triage — Step-by-Step

# Alert fires in SIEM (Splunk / QRadar / Microsoft Sentinel)

Step 1: ACKNOWLEDGE the alert
  - Mark in-progress in your ticketing system

Step 2: READ the alert
  - What rule triggered?
  - Which asset / user is affected?
  - Severity level? (Critical / High / Medium / Low)

Step 3: GATHER CONTEXT
  - Source IP → internal or external?
  - Lookup: VirusTotal, AbuseIPDB, Shodan
  - User account → service account? admin? new?
  - Time → business hours? First occurrence?

Step 4: CORRELATE events
  - Did same IP / user trigger OTHER alerts?
  - Look ±30 min around the event
  - Check firewall logs, DNS, EDR

Step 5: DETERMINE verdict
  - True Positive  → Escalate to Tier 2, document findings
  - False Positive → Document WHY, close, suggest rule tuning

Step 6: DOCUMENT everything
  - Ticket: what you found, what you checked, decision rationale

4. Key Log Sources & Questions

Log Source	What to Look For
Windows Security Event Log	Event ID 4625 (failed login), 4720 (account created), 4672 (admin privs)
Linux /var/log/auth.log	"Failed password", "Invalid user", sudo commands
Firewall / Network logs	Port scans, unusual outbound, denied traffic spikes
DNS logs	Queries to newly-registered domains, DGA-like names, TXT abuse
Web proxy / HTTP logs	User-Agent anomalies, POST to weird endpoints, .exe downloads
Endpoint (EDR)	PowerShell, base64 decode, process injection, lateral movement
Email gateway	Phishing indicators, attachment hashes, SPF/DKIM/DMARC fails
Cloud (AWS CloudTrail)	IAM changes, S3 public bucket, API calls from new region

5. Windows Event IDs Cheat Sheet

# Authentication
4624 - Successful logon
4625 - Failed logon  ← many within short time = brute force
4634 - Logoff
4648 - Explicit credential use (runas)

# Account Management
4720 - User account created
4722 - User account enabled
4728 - User added to global security group
4732 - User added to local Administrators  ← suspicious!

# Privilege / Process
4672 - Admin privileges assigned to new logon
4688 - New process created  ← watch: powershell, wscript, mshta
4698 - Scheduled task created

# Audit
1102 - Audit log cleared  ← RED FLAG
4719 - Audit policy changed

# Splunk hunt for brute force:
index=wineventlog EventCode=4625
| stats count by src_ip, Account_Name
| where count > 10
| sort -count

6. Vulnerability Management Lifecycle

1. DISCOVER  → Scan assets (Nessus, Qualys, OpenVAS)
2. PRIORITIZE → Score with CVSS, add context
3. REMEDIATE → Patch, configure, or mitigate
4. VERIFY    → Re-scan to confirm fix
5. REPORT    → Track metrics, present to leadership

# CVSS v3.1 Severity Ranges
Critical  9.0-10.0 → patch within 24-72 hours
High      7.0-8.9  → patch within 1-2 weeks
Medium    4.0-6.9  → patch within 30 days
Low       0.1-3.9  → next maintenance window

# Prioritization factors BEYOND CVSS score:
# ✔ Internet-facing?
# ✔ Known exploit in the wild? (CISA KEV list)
# ✔ Sensitive data at risk?
# ✔ Exploitable without authentication?
# ✔ Business-critical service?

7. Incident Response Lifecycle

Phase	Actions
1. Preparation	IR plan, playbooks, tools, contacts, tabletop exercises
2. Detection & Analysis	Alert triage, IOC identification, scope the incident
3. Containment	Isolate systems, block IOCs at firewall/DNS, reset creds
4. Eradication	Remove malware, close vulnerabilities, clear persistence
5. Recovery	Restore from backup, verify clean state, monitor closely
6. Lessons Learned	Post-incident review, update playbooks, add detections

NIST SP 800-61 = official IR framework. CySA+ exam မှာ ဒါကို reference လုပ်တတ်တယ်။

8. Incident Report Template

INCIDENT REPORT
================
ID          : INC-2024-0312
Severity    : HIGH
Status      : RESOLVED
Date/Time   : 2024-03-12 14:32 UTC
Analyst     : [Your Name]

EXECUTIVE SUMMARY
-----------------
Malware infection on WORKSTATION-042 via phishing email.
Employee clicked link → PowerShell dropper → C2 beacon.
Contained within 47 min. No data exfiltration confirmed.

TIMELINE
---------
14:32 - SIEM alert: Unusual outbound → 185.220.x.x
14:38 - Confirmed C2 beacon (Cobalt Strike watermark)
14:45 - Host quarantined (EDR isolation)
14:52 - User credentials reset
15:19 - C2 IP + domain blocked at perimeter

ROOT CAUSE
----------
Phishing email bypassed email gateway filter.
User ran .lnk file → PowerShell dropper executed.
No application whitelisting in place.

IOCs
-----
IP:     185.220.x.x
Domain: evil-cdn.cloud
Hash:   d41d8cd98f00b204e9800998ecf8427e
File:   C:\Users\user\AppData\Local\Temp\update.ps1

REMEDIATION
-----------
1. Host re-imaged from clean baseline
2. User credentials reset + tokens revoked
3. IOCs blocked at firewall and DNS sinkhole
4. Detection rule added for PS Script Block patterns
5. Phishing awareness re-training scheduled

LESSONS LEARNED
---------------
- Enable PS Script Block Logging (Event ID 4104)
- Evaluate AppLocker / WDAC for app whitelisting
- Tune email gateway for .zip + .lnk combos

9. Threat Intelligence Reference

Concept	Description
IOC	Indicator of Compromise — IP, domain, file hash, URL
TTP	Tactics, Techniques, Procedures — HOW attackers behave
MITRE ATT&CK	Framework cataloging adversary behaviors by tactic/technique
Diamond Model	Maps adversary → capability → infrastructure → victim
Kill Chain	Recon → Weaponize → Deliver → Exploit → Install → C2 → Act
STIX/TAXII	Standards for sharing threat intel data
VirusTotal	Hash / IP / domain reputation lookup (free)
AbuseIPDB	Community IP reputation database
CISA KEV	Known Exploited Vulnerabilities catalog — patch these first

📌 Study Checklist

အပေါ်က concept ကို တစ်ကြောင်းချင်းဖတ်ပြီး example ကို ကိုယ်တိုင်ပြန်ရေးကြည့်ပါ။
Code/command ပါတဲ့ lesson ဆိုရင် value/name/path တစ်ခုခု ပြောင်းပြီး result ဘာကွာလဲ စမ်းပါ။
မမှတ်မိသေးတဲ့ keyword 3 ခုကို notebook ထဲရေးပြီး နောက် lesson မသွားခင် ပြန်ရှင်းကြည့်ပါ။
ပြီးရင် Home / Hub ကိုပြန်သွားပြီး next lesson ဆက်သင်ပါ။

🎧 Cyber Security 08 — CySA+ & SOC Analyst

1. CySA+ Exam Overview

2. SOC Tiers Overview

3. SOC Alert Triage — Step-by-Step

4. Key Log Sources & Questions

5. Windows Event IDs Cheat Sheet

6. Vulnerability Management Lifecycle

7. Incident Response Lifecycle

8. Incident Report Template

9. Threat Intelligence Reference

📌 Study Checklist