SOC 200: Security Operations and Defense Analysis

Resources and notes for Offensive Security's SOC-200 course and OffSec Defense Analyst (OSDA) exam

Introduction to SOC-200

• Growth mindset:

...a defender with a growth mindset can adapt to previously-unseen approaches and improve their skills to match that of more-advanced attackers.

Since skilled adversaries adapt a growth mindset, we must follow suit. There are many practical ways we can do this, but in the next subsections, we will explore a few of them.

Attacker Methodology Introduction

Windows Endpoint Introduction

Windows Server Side Attacks

Windows Client-Side Attacks

Windows Privilege Escalation

Linux Endpoint Introduction

Linux Server Side Attacks

Linux Privilege Escalation

Network Detections

Antivirus Alerts & Evasions

Network Evasion & Tunneling

Active Directory Enumeration

Windows Lateral Movement

Active Directory Persistence

SIEM Part I: Intro to ELK

SIEM Part II: Combining the Logs

Trying Harder: The Labs