HTSOC
nktris/htsocReproducible SOC lab for CVE-2024-4577 detection and response
educationincident-responseintrusion-detection+7
nktris/htsocReproducible SOC lab for CVE-2024-4577 detection and response
nate-ryan-7690/home_soc_suiteA personal Windows SOC suite built in PowerShell — monitors network connections, resource usage, scheduled tasks and power events with severity…
0x0allenace/soc-analyst-portfolioA curated portfolio showcasing my SOC investigations, threat hunting projects, DFIR labs, detection engineering, technical blogs, and cybersecurity…
jhatchi/nexacorp-dfir-inc-2026-001DFIR investigation + 7 Suricata rules on a simulated NexaCorp intrusion (vsftpd 2.3.4 CVE-2011-2523 + MITRE Caldera C2). 4-day solo engagement…
abiral-timalsina/cyber-defenders-lab-My write-ups from CyberDefenders' Blue Team labs, solved using Wireshark. Covers TeamCity RCE (CVE-2024-27198), XSS session hijacking, and…
cross-samuel1/soc-analyst-hubFree, offline SOC Analyst Hub for Tier 1 — IR checklists, alert triage playbooks, threat hunting queries & analyst onboarding. Single HTML file, no…
securityjoes/masterparserMasterParser is a powerful DFIR tool designed for analyzing and parsing Linux logs
zedocun/soc-investigation-powershell-edrfreezeSOC investigation of CVE-2024-49138 exploitation alert involving PowerShell, EDRFreeze execution, and defense evasion behavior in a simulated…
v3ng4mxv1p3r/mobile-drop-device-soc-detectionEnd-to-end simulation of detecting a root-less Android Drop Device (Casper) using Wazuh SIEM to capture Layer 7 attacks like Shellshock…
khalilu020/offensive-security-adversary-emulationSimulated a real-world attack (CVE-2011-2523) against a vulnerable host, then cross-checked detection coverage against an existing…
czabatta/thm-tempestTryHackMe SOC Level 1 — Follina CVE-2022-30190, Nim C2, Chisel, PrintSpoofer, backdoor accounts
letsdefend/awesome-soc-analystUseful resources for SOC Analyst and SOC Analyst candidates.
blackhillsinfosec/freelabfriday_labsThis repository contains all lab instructions for the following content: Info Sec Core Skills, SOC Core Skills, ADCD Labs, SOC Analyst Labs, & BnB…
ibondarenko1/azure-sentinel-detection-engineering9 MITRE ATT&CK-mapped KQL detections on a live Microsoft Sentinel + Defender XDR environment (control-plane, endpoint, identity), with a PR-gated…
hashdr1ft/soc274-palo-alto-networks-pan-os-command-injection-vulnerability-exploitation-cve-2024-3400SOC lab exercise for analyzing and responding to Palo Alto Networks PAN-OS command injection vulnerability (CVE-2024-3400) with step-by-step incident…
pedrofbrm/apache-web-log-analysis-labBlue Team lab focused on analyzing Apache web access logs to detect directory brute forcing and web scanning activity.
jonathaninfinity01/soc-l1-osint-investigation-mikrotik-cve-2018-1156L1 SOC Analysis: OSINT detection and risk validation of publicly exposed MikroTik RouterOS vulnerable to RCE | Tools: Shodan, NIST NVD
cyprianatsyor/letsdefend-cve-2024-49138-investigationHands-on SOC investigation of CVE-2024-49138 using LetsDefend, VirusTotal, Hybrid Analysis, TrueFort, and ChatGPT.