SOC Fundamentals

Introduction to Security Operations Center (SOC)

Learning Outcome

A student solves a math problem on a whiteboard. The board contains all the calculations needed to solve the problem.

Whiteboard = RAM;

Calculations = Temporary Data

The student erases the whiteboard, and the calculations disappear. In the same way, RAM data is generally lost when the computer is powered off.

RAM = Volatile Memory

What is a Security Operations Center (SOC)?

A Security Operations Center (SOC) is a centralized team or facility that continuously monitors, detects, analyzes, and responds to cybersecurity threats and incidents.

In simple terms, a SOC is like a security control room that protects an organization’s networks, systems, applications, and data.

Purpose and Importance of a SOC

The main purpose of a SOC is to protect an organization’s information systems and digital assets.

Without a SOC, incidents may go unnoticed, causing data breaches, financial losses, and reputational damage.

Minimize cyberattack impact

Detect threats early

Protect sensitive information

Ensure business continuity

Maintain customer trust

Meet compliance requirements

A SOC helps organizations:

Need for SOC in Modern Organizations

Modern organizations depend on cloud services, online applications, and interconnected networks, increasing cyber risks.

A SOC is needed because:

Cyberattacks are becoming more sophisticated.

Large amounts of security data are generated.

Continuous monitoring is required.

Rapid response reduces damage.

Regulations require strong security controls.

Goals and Objectives of a SOC

Continuously monitor systems

Detect threats and vulnerabilities

Reduce cyberattack impact

Improve security posture

Protect critical assets

Investigate suspicious activities

Respond to security incidents

Ensure regulatory compliance

Core Functions of a SOC

Continuously observes networks, systems, applications, and security devices for abnormal activity.

Monitoring

Monitor login attempts

Track network traffic

Review system activities

Monitor security alerts

Identifies potential threats and suspicious activities such as malware, phishing, unauthorized access, and data exfiltration.

Detection

Analyzes alerts, logs, network traffic, user activities, and system events to confirm incidents, identify the root cause, and assess impact.

Investigation
 

Block malicious IPs

Isolate infected systems

Remove malware

Restore services

Document incidents

Response

Takes action to contain, mitigate, and recover from incidents.

Process Enumeration

Process names

Process IDs (PID)

Parent-child relationships

Process start times

Resource usage

Process enumeration identifies active processes stored in memory.

Investigators examine:

This helps identify suspicious or unauthorized programs.

Active Network Session Analysis

Open Handles and Objects

Memory analysis can reveal active network connections while a computer is running.

Investigators may identify:

Connected IP addresses

Open ports

TCP/UDP connections

Remote servers

This helps determine whether the system communicated with suspicious devices.

This helps understand application activity.

An open handle is a reference used by a program to access system resources. Investigators examine handles to determine which resources were being accessed.

Examples include:

Open files

Registry keys

Running processes

Network sockets

Registry Data in Memory

Parts of the Windows Registry are loaded into memory while the system is running.

Investigators can analyze this data to identify:

User accounts

Recently opened files

Installed software

System configuration

Startup programs

Registry data helps reconstruct user activity and system settings.

User Activity Reconstruction

User activity reconstruction rebuilds user actions by analyzing memory data.

This helps determine what the user was doing when memory was captured.

Investigators may identify:

Logged-in users

Recently opened applications

Open documents

Browsing activity

Chat sessions

Clipboard contents

Malware Artifact Discovery

Memory analysis can reveal malware that operates in memory to avoid detection.

This helps determine what the user was doing when memory was captured.

Common artifacts include:

Malicious processes

Injected code

Suspicious DLLs

Unauthorized network connections

Hidden services

Code Injection Detection

Code injection occurs when malicious code is inserted into a legitimate process. Investigators examine processes for unusual memory regions, injected code, or modified behavior.

Detecting code injection helps identify sophisticated attacks.

Credential Artifact Analysis

Credential artifacts are traces of authentication information stored in memory.

These artifacts help determine who accessed the system and how authentication occurred.

Examples include:

Usernames

Password hashes

Login sessions

Security credentials

Authentication tokens

Memory timeline analysis arranges memory-related events chronologically to reconstruct system activity.

Memory Timeline Analysis

A timeline may include:

• Process creation
• User logins
• Network connections
• Application launches
• Malware execution

Threat Hunting in Memory

Memory threat hunting proactively searches RAM for malicious activity that traditional security tools may miss.

It helps detect advanced and fileless attacks.

Investigators look for:

Unknown processes

Suspicious DLLs

Hidden malware

Unauthorized network connections

Code injection

Rootkits

Memory Analysis Frameworks

Memory threat hunting proactively searches RAM for malicious activity that traditional security tools may miss.

They simplify investigations and improve analysis accuracy.

Key features include:

Process analysis

Network analysis

Registry analysis

Malware detection

Timeline generation

Memory Investigation Tools

Common memory forensic tools include:

Analyzes memory dumps for processes, malware, network connections, and registry data.

Analyzes memory images and detects malicious activity.

Captures memory from live systems and creates forensic images.

Captures RAM from running Windows systems.

Acquires RAM from live computers for forensic analysis.

Volatility Framework

Rekall

FTK Imager

Magnet RAM Capture

Belkasoft RAM Capturer

Summary

Quiz

Which type of memory loses its contents when the computer is turned off?

Quiz-Answer

C. RAM

Which type of memory loses its contents when the computer is turned off?