Breaking Into Blue Team: A SOC Analyst Walkthrough
section 1 :
Understanding Events, Incidents, and Incident Handling
Before diving into incident handling, it’s important to understand three core terms that are often confused with one another.
🔹 What Is an Event?
An event is any observable action that occurs within a system or network. Events are neutral by nature and happen constantly throughout the day.
Common examples include:
- A user sending an email
- A mouse click
- A firewall permitting a connection request
🔹 What Is an Incident?
An incident is an event that results in a negative consequence.
For example:
- A system crash
- Unauthorized access to sensitive data
It’s worth noting that an incident isn’t always caused by malicious activity — it can also result from natural disasters, power outages, or hardware failures.
🔹 What Is a Security Incident?
A security incident is more specific. It’s an event carried out with a clear intent to cause harm against a computer system.
Examples include:
- Data theft
- Unauthorized access to data
- Installation of malware or remote access tools
🔹 The Key Difference
The distinction comes down to two things: intent and impact.
Every incident is an event, and every security incident is an incident — but the reverse isn’t true.
An event only becomes an incident when it has a harmful outcome, and it becomes a security incident when that harm is intentional.
🔹 So, What Is Incident Handling?
With these definitions in place, Incident Handling (IH) can be defined as:
A clearly defined set of procedures for managing and responding to security incidents within a computer or network environment.
As cyber threats continue to grow, a strong incident handling capability has become essential for any organization that cannot afford a compromise to the confidentiality, integrity, or availability
The CIA Triad
At the core of information security lies a foundational model known as the CIA Triad. It represents the three principles that every security measure ultimately aims to protect. (And no — it has nothing to do with the intelligence agency.)
🔹 Confidentiality
Confidentiality ensures that data is accessible only to those authorized to view it. Sensitive information must remain hidden from anyone without proper permission.
- Example of a breach: An attacker stealing a database of user passwords
- Common safeguards: Encryption and access controls
🔹 Integrity
Integrity ensures that data remains accurate and unaltered by unauthorized parties. What you store should be exactly what you retrieve, with no tampering in between.
- Example of a breach: A hacker modifying bank account balances or forging records
- Common safeguards: Hashing and digital signatures
🔹 Availability
Availability ensures that data and services remain accessible to legitimate users whenever they’re needed.
- Example of a breach: A DDoS attack taking a website offline
- Common safeguards: Backups and redundancy
🔹 Why It Matters
Every security incident ultimately impacts one or more of these three principles. That’s why the primary goal of any defensive strategy is to preserve the Confidentiality, Integrity, and Availability of an organization’s data.
The Scope and Value of Incident Handling
🔹 Incident Handling Goes Beyond Intrusions
It’s important to understand that incident handling isn’t limited to intrusion incidents alone. Its scope is much broader and covers many other types of incidents, such as:
- Incidents caused by malicious insiders
- Availability issues
- Loss of intellectual property
A comprehensive incident handling plan should address these various types of incidents and provide appropriate measures to identify, contain, eradicate, and recover from them — with the ultimate goal of restoring normal business operations as quickly and efficiently as possible.
Get Z3DX’s stories in your inbox
Join Medium for free to get updates from this writer.
Keep in mind that it isn’t always obvious whether an event is actually an incident until an initial investigation is performed. That said, some suspicious events should be treated as incidents unless proven otherwise.
🔹 Why Incident Handling Matters
IT security incidents often involve the compromise of personal and business data, which makes a quick and effective response critical. The impact varies from one incident to another — sometimes it’s limited to just a few devices, while in other cases a large part of the environment can be compromised.
This is where a dedicated incident handling team (often called an incident response team) becomes invaluable. A trained workforce responds systematically, ensuring the right actions are taken at the right time. Their main objective is to minimize the theft of information or the disruption of services caused by the incident.
This is achieved through investigations and remediation steps (which we’ll explore in more depth shortly). Ultimately, the decisions made before, during, and after an incident all shape its final impact.
🔹 The Importance of Prioritization
Since different incidents carry different levels of impact, prioritization becomes essential.
- Incidents with greater severity demand immediate attention and dedicated resources.
- Lower-rated incidents may still require an initial investigation — just to confirm whether they’re genuine IT security incidents in the first place.
🔹 The Role of the Incident Manager
Every incident handling team is led by an incident manager. This role is typically assigned to a:
- SOC Manager
- CISO / CIO
- Trusted third-party vendor
The incident manager usually has the authority to direct other business units and can require any employee in the organization to perform a necessary activity in a timely manner. Most importantly, they act as the single point of communication, tracking every activity taken during the investigation along with its completion status.
Different Types of Real-World Incidents
Studying real incidents is one of the best ways to understand how attacks actually happen. Below are some of the most common incident categories, each illustrated by a well-known real-world case and its root cause.
🔹 1. Leaked Credentials
This occurs when an employee’s login details are exposed — often sold on the dark web — and later abused by attackers.
📌 Colonial Pipeline Ransomware Attack
One of America’s largest oil pipeline systems was shut down by a ransomware attack. Rather than a direct network breach, the attackers used a compromised password for an inactive VPN account — one that didn’t have Multi-Factor Authentication (MFA) enabled.
Lesson: A single forgotten account can bring down an entire organization.
🔹 2. Default / Weak Credentials
This happens when devices are shipped with factory-default passwords (e.g., admin/admin) that are never changed.
📌 Mirai Botnet (2016)
Mirai scanned for IoT devices still using default credentials and conscripted them into a massive DDoS botnet. Hundreds of thousands of infected devices caused large-scale disruptions, affecting companies like Dyn and OVH.
📌 LogicMonitor Incident (2023)
Some customers were compromised because the vendor issued weak default passwords to their accounts, leading to follow-on ransomware and unauthorized access.
🔹 3. Outdated Software / Unpatched Systems
This is one of the most common root causes — a known vulnerability with an available patch that simply isn’t applied in time.
📌 Equifax Breach (2017)
Attackers exploited a known Apache Struts vulnerability (CVE-2017–5638), exposing the personal data of roughly 143–147 million people. The cause? A publicly released patch that wasn’t applied in time.
📌 WannaCry (2017)
This ransomware spread like a worm using the SMB EternalBlue exploit, hitting over 200,000 systems across 150+ countries, including hospitals. The systems were unpatched — even though the MS17–010 fix was already available.
🔹 4. Rogue Employee / Insider Threat
This involves an employee (often a former one) abusing their legitimate access to cause harm.
📌 Cash App / Block Inc. (2021)
A former employee accessed the personal information of approximately 8.2 million current and former customers. The root cause was the abuse of legitimate access combined with insufficient internal controls and monitoring.
🔹 5. Phishing / Social Engineering
Instead of attacking systems, this technique targets people — tricking users into handing over credentials or granting access.
📌 Industry Trend
Phishing remains one of the most pervasive attack vectors, linked to a significant portion of breaches year after year.
📌 U.S. Interior Department Attack
Attackers used an “evil twin” technique — a fake Wi-Fi network mimicking the real one — to lure users into connecting and stealing their credentials.
📌 Twitter Account Hijacking (2020)
Attackers used social engineering against Twitter employees to reach internal admin tools, hijacking high-profile accounts to promote a Bitcoin scam.
🔹 6. Supply-Chain Attack
A sophisticated approach: instead of attacking the victim directly, attackers compromise a trusted vendor and let the malicious code spread to all its customers.
📌 SolarWinds Orion (2020)
Nation-state actors compromised the SolarWinds build environment and injected a malicious backdoor into Orion updates — which were then distributed to thousands of customers, including government agencies. The result was wide-reaching espionage that took a long time to detect and remediate.
The Incident Scenario
Throughout this module, we’ll follow a single incident scenario to better understand the real-world challenges that incident handlers face. This scenario reflects patterns that appear repeatedly across genuine incidents.
🔹 The Victim
Our victim is Insight Nexus, a global market research firm that handles sensitive competitive data for high-profile clients in the IT sector. What makes this case especially interesting is that the firm became the target of two distinct threat groups operating simultaneously within its environment.
🔹 How the First Attacker Got In
The entire breach began with a simple but costly human error — a forgotten default password.
Here’s how the attack unfolded, step by step:
- Initial Access: System administrators forgot to change the default
admin/adminpassword on an internet-facing application — ManageEngine ADManager Plus — following a product update. - Reconnaissance: After logging in easily, the attackers mapped out users and machines across the environment.
- Persistence: They created new privileged Active Directory accounts to secure their foothold.
- Pivoting: Using one of these new accounts, the adversaries moved deeper into the network and discovered an external RDP service exposed through a misconfiguration.
- Escalation & Deployment: Exploiting that entry point, they escalated their control and ultimately used Group Policy Objects (GPOs) to deploy spyware via an MSI package across multiple endpoints at once.
🔹 The Takeaway
Notice how a single small mistake — an unchanged default password — gradually escalated into full control over the environment. In the next section, we’ll explore the Cyber Kill Chain and MITRE ATT&CK frameworks, whose phases map directly onto this kind of attacker lifecycle and the observable actions at each stage.
follow me on LinkedIn for more 🚀
See you soon! 👋😄
#CyberSecurity #WebPentesting #CTF#Z3DX
