Blue team & SOC
6 reports // The defender side: life in a SOC, detection frameworks like the Kill Chain, MITRE ATT&CK and the Diamond Model, YARA rules, Active Directory and the network basics underneath.
cybersecurityFeaturedActive Directory Tutorial for Beginners: Domains, OUs, GPOs and Trusts
A beginner-friendly Active Directory tutorial: what a Windows domain and domain controller do, users, computers and security groups, OUs and delegation, Group Policy, and forests, trees and trusts.
cybersecurityFeaturedThe Secret Campus of Connections: A Beginner's Guide to Ports and Protocols in Networking
Welcome to GITAM University, a vibrant campus where data flows like magic, powering everything from online lectures to group study chats. Meet Satvik, a curious first-year student navigating this digital hub, unaware of the invisible helpers—ports and protocols—making it all happen. Think of protocols as the campus rulebook for communication, like knowing how to ask for lecture notes, and ports as numbered doors (like Room 80 or 443) where specific tasks, like browsing or emailing, get done. Join Satvik as they explore key campus spots: the "Digital Classroom Block" (HTTP/HTTPS, Ports 80/443) for seamless web surfing, the "Resource Exchange Center" (FTP, Port 21) for sharing files, and the "Secure Lab Wing" (SSH, Port 22) for remote access. From emailing profs via the "Communication Hub" (SMTP/IMAP) to finding their way with the "Info Kiosk" (DNS, Port 53), Satvik discovers how these unsung heroes quietly fuel student life. Whether you're checking grades or streaming tutorials, ports and protocols are the backstage stars at GITAM—and in your daily digital world. Ready to dive into Satvik’s adventure? Let’s go!
![Yara [ Yet Another Ridiculous Acronym ]](/_vercel/image?url=https%3A%2F%2Fmedia.satvik.live%2Fblog-covers%2Fyara-yet-another-ridiculous-acronym.png&w=640&q=72)
BlueTeamingYara [ Yet Another Ridiculous Acronym ]
Hey, cyber explorers! Ready to dive into the world of malware hunting? The **Yara Rules** TryHackMe room is your gateway to mastering **Yara**, a powerful tool for identifying malicious files using pattern matching. Created by Victor M. Alvarez and VirusTotal, Yara is like a Swiss Army knife for malware researchers, SOC analysts, and pentesters. This blog breaks down the room’s key concepts—why Yara matters, how to write rules, and how tools like LOKI and yarGen supercharge your skills. Expect a beginner-friendly guide with real-world examples, TryHackMe tasks, and some extra research to keep it spicy. Let’s hunt some malware!
BlueTeamingDiamond Model and MITRE Att&ck
In Part 3, we unpacked the Diamond Model, a framework to analyze attacks via four corners: Adversary, Victim, Capability, and Infrastructure. It’s perfect for breaking down APTs and explaining incidents. MITRE ATT&CK is your encyclopedia of hacker TTPs, like phishing or Pass-the-Hash, helping you map and block threats. Together, they make you a cyber detective, as seen in examples like the SolarWinds attack. Combined with Part 2’s frameworks, they give you a complete toolkit to investigate, predict, and stop cyberattacks like a pro.
BlueTeamingCybersecurity Frameworks
Part 2 dove into three frameworks to outsmart hackers. The Pyramid of Pain ranks how much pain you cause by blocking hacker tools, from hashes (easy) to TTPs (tough). The Cyber Kill Chain outlines seven attack stages (Recon to Actions), letting you break the chain to stop hackers. The Unified Kill Chain modernizes it with 18 phases across In, Through, and Out stages, covering complex attacks. Real-world examples, like the Colonial Pipeline ransomware, showed how these frameworks help SOCs detect and disrupt threats, making you a hacker’s worst nightmare.
BlueTeamingBecoming a Junior Cybersecurity Analyst - Your First Step into SOC World
In Part 1, we explored the life of a Junior Security Analyst in a Security Operations Center (SOC). It’s like being a digital security guard, monitoring for threats 24/7. We covered the SOC’s role in protecting assets, the three-tier model (Tier 1: triage, Tier 2: incident response, Tier 3: threat hunting), and a day in the life of a Tier 1 analyst—triaging alerts, investigating phishing, and documenting everything. With tools like SIEM and skills in networking and OS basics, you’re the first line of defense. Real-world examples, like stopping a phishing attack, showed how critical this role is in today’s cyber landscape.