SOCSimulator

Real Alerts. Real Pressure. Zero Consequences.

[SOCSimulator @socsimulator]

Reference: SigmaHQ win_security_kerberoasting_activity, MITRE T1558.003. The threshold is the part nobody ships for you. Count distinct ServiceName values per source host per 5 seconds and tune it on a week of your own data.

[SOCSimulator @socsimulator]

Kerberoasting looks like normal Kerberos traffic except for the burst.

Windows Security
EventID: 4769
TicketEncryptionType: 0x17
Status: 0x0
drop ServiceName ending in $ or krbtgt

Legacy apps still request RC4. Baseline which SPNs do it.

[SOCSimulator @socsimulator]

A guided walkthrough is fine the first time. By the tenth, if the hints are still there, you're reading along. At some point the exercise has to let you get it wrong.

[SOCSimulator @socsimulator]

Three consoles on this one, SIEM, XDR and firewall: https://t.co/C5N26Kv5TW

[SOCSimulator @socsimulator]

TRITON is on the board. A safety controller at a petrochemical plant fell into a failed safe state and shut the process down.
Would your OT telemetry tell you whether that was a fault or a write?

[SOCSimulator @socsimulator]

Two things in a handover ruin a morning.

'Left open, looked fine.'
An empty notes box.

Which one has cost you more time?

[SOCSimulator @socsimulator]

Script block logging is where you read the decoded version without doing any of this by hand: https://t.co/1oUPGCS7A3

[SOCSimulator @socsimulator]

An -enc PowerShell payload is base64 over UTF-16LE. Decode it as ASCII and every second byte is a null, so you call it junk. A blob starting JAB is a variable. SQBFAFgA is IEX.

[SOCSimulator @socsimulator]

Practise investigating the evidence: https://t.co/AykE1ap0gw

[SOCSimulator @socsimulator]

ATT&CK v19 changed tactic and technique mappings. Audit the IDs used in your detections and reports; this reference highlights eight retired IDs and their replacements.

[SOCSimulator @socsimulator]

The directory. An exclusion is a statement of intent and it names the exact place someone plans to work from. Enumerate what is in it, when it was created and by which process, before touching the exclusion. Then find who can change policy on that host.

[SOCSimulator @socsimulator]

Defender 5007 on a domain controller: a new exclusion path under ProgramData that did not exist yesterday.
No detection, no process alert, nothing else in the queue.
Where do you start?

[SOCSimulator @socsimulator]

The part of tier 1 that's automatable is copy the hash, paste the hash, close the ticket. That was automatable in 2015. What's left is deciding whether it matters, and I haven't seen a model do that on its own yet.

[SOCSimulator @socsimulator]

Beginner, 15 minutes, SIEM console only. The free tier covers 10 investigation scenarios.
https://t.co/5T1TKG37US

[SOCSimulator @socsimulator]

A QR code is a URL your gateway cannot read, scanned on a phone you do not manage.
That is QR Code Phishing: Scan to Compromise.
Where does quishing get caught for you?

[SOCSimulator @socsimulator]

Practise investigating the evidence: https://t.co/AykE1ap0gw

[SOCSimulator @socsimulator]

An alert gives you leads: host, time, account, process and command line. Correlate them before reaching a verdict. This example shows where to start.

[SOCSimulator @socsimulator]

Safety instrumented system sabotage, defender's view: https://t.co/C5N26Kv5TW

[SOCSimulator @socsimulator]

A petrochemical plant dropped into emergency shutdown. Engineering wrote it up as a controller fault.
It was a failed write by someone reprogramming the safety system.
TRITON drops Tuesday.

[SOCSimulator @socsimulator]

The 1,400 failures are noise the attacker made. The one success from an address that never failed is the thing that worked. Open the 4624 first and come back to the spray afterwards.

[SOCSimulator @socsimulator]

Queue at 02:10.
1,400 failed logons, six accounts, all 4625 sub status 0xC000006A.
Then one 4624, logon type 10, from an address that never failed.
Which one is the alert?