SOC Investigation Note Samples

These notes are intended to show my thought process, methodology, and note-taking approach. The alerts will come from platforms like LetsDefend, KC7, and Splunk BoTC.

These notes will span from early 2024 to the present, and you will see the methodology evolve. Earlier notes focused on artifact collection and closure, while later ones reflect a more structured timeline approach and incorporate advice from working SMEs and practitioners.

For Let’sDefend notes, there will be tags for T1/T2 or for Security Analyst/Incident Responder. These tags indicate which cases I handle with basic triage (T1) or with deep-dive, comprehensive investigations (T2).

SOC Investigation:

Tags:

Investigation Date:

SOC Investigation:

Tags:

Investigation Date:

SOC Investigation Note Samples

SOC Investigation: Phishing → Malware Execution

SOC Investigation: SSH Brute Force → Credential Enumeration & Data Exposure

SOC Investigation: Malicious PDF → Payload Execution

SOC Investigation: Brute-Force Access → Mimikatz Execution

SOC Investigation: NTDS Credential Dumping & Exfiltration

SOC Investigation: Cobalt Strike C2 & Living-off-the-Land Activity

SOC Investigation: SQL Injection → Command Injection → Reverse Shell

SOC Investigation:

SOC Investigation: