Series

SOC Alert Walkthroughs (LetsDefend)

Real-world SOC alert investigations and incident analysis based on LetsDefend simulations.

🚨SOC202-FakeGPT Malicious Chrome Extension
Alert Investigation Walkthrough (LetsDefend.io) Today, I’m going to walk through my investigation of the SOC202 – FakeGPT Malicious Chrome Extension alert from LetsDefend.io. This write-up documents my step-by-step thought process as a SOC analyst, a...
Feb 1, 20264 min read12
SOC138 – Detected Suspicious XLS File | SOC Alert Walkthrough
In this blog, I will walk through the investigation of SOC138 – Detected Suspicious XLS File, performed on the Letsdefend.io platform. The objective of this analysis is to identify whether the detected file is malicious, determine host impact, and va...
Feb 2, 20263 min read15
🛑 SOC211 – Utilman.exe Winlogon Exploit Attempt Walkthrough
📌 Alert Overview In this investigation, we analyze SOC211 – Utilman.exe Winlogon Exploit Attempt, an alert indicating abuse of a Windows built-in binary (LOLBin) to achieve persistence and privilege escalation on a compromised host. The alert highl...
Feb 2, 20263 min read18
⭐ SOC146 – Phishing Mail Detected (Excel 4.0 Macros)[Event ID: 93]
Today, we are going to re-investigate SOC146 – Phishing Mail Detected (Excel 4.0 Macros).This alert is particularly interesting because I had investigated it almost a year ago, and revisiting it now helps reinforce how phishing investigations evolve ...
Feb 5, 20264 min read7
SOC257 – VPN Connection Detected from Unauthorized Country (EventID:225)
(LetsDefend Alert Walkthrough)
Feb 10, 20264 min read41
SOC335 – CVE-2024-49138 Exploitation Detected Walkthough (EventID: 313)
Today we are going to investigate another LetsDefend alert:SOC335 – CVE-2024-49138 Exploitation Detected. This alert is more serious than the usual login or brute-force alerts because it involves a known vulnerability and possible exploitation on a h...
Feb 13, 20263 min read4

Command Palette