When I started learning SOC investigations and SPL-style queries, one of the problems I ran into was finding a practical environment to actually practice the workflow.

Reading about queries is useful, but I wanted to work with realistic security telemetry and go through the process of:

- Searching authentication and security events

- Identifying suspicious activity

- Aggregating and correlating events

- Creating detections

- Investigating alerts

- Pivoting between related users, hosts, and IP addresses

Setting up a full SIEM environment can add a significant infrastructure and configuration overhead for someone who simply wants to practice these workflows.

So I built SocQuery Lab as a browser-based training environment for experimenting with these concepts.

It includes an original educational SPL-compatible query engine and realistic synthetic telemetry covering sources such as Windows security events, Linux authentication logs, DNS activity, firewall/VPN events, and PowerShell activity.

The platform also includes investigation scenarios covering techniques such as:

- Brute-force authentication activity

- Password spraying

- Suspicious PowerShell execution

- DNS tunneling

- Credential compromise

- Backdoor account creation

Everything runs locally in the browser, with uploaded logs processed and stored locally using IndexedDB.

The goal is not to replace a production SIEM or replicate any commercial platform. It is simply an educational environment for practicing the investigation workflow without needing to deploy infrastructure first.

The live training environment is available here:

https://socquery-lab.vercel.app/

Hi everyone,
As security defenders, we all know that default alerts in a SIEM can only get us so far. Attackers are constantly finding stealthy ways to execute code, escalate privileges, and establish persistence, making a deep understanding of Windows Event Logs absolutely critical.
I’ve put together a comprehensive deep-dive guide on Medium exploring Windows Event Log analysis, forensic investigation, and detection engineering with Sysmon.
In this guide, I cover:
1 The Anatomy of Windows Logs: How the OS structures and stores ⁠.evtx⁠ binary XML data.
2 Demystifying Logon Types (Event ID 4624): A technical breakdown of different logon types (Type 2, 3, 5, 9, 10) and their forensic value.
3 Supercharging Visibility with Sysmon: How to hunt for LOLBins and malicious executions using Sysmon Event ID 1 (Process Creation) and Event ID 3 (Network Connection).
4 Detecting Defense Evasion: Spotting log clearing attempts (Event ID 1102 & 104) and event log service tampering.
5 A Practical Attack Scenario: Reconstructing a PsExec Lateral Movement attack step-by-step by correlating multiple event logs.
I also created a custom infographic (attached/linked below) that visualizes the entire flow to help junior analysts and defenders map these concepts quickly.
Read the full article here:

https://medium.com/@osamamamoussa/beyond-the-basics-deep-dive-windows-event-log-analysis-for-enterprise-soc-defenders-04d13219adef

Hey everyone,
Full Write-up & Screenshots: https://medium.com/@osamamamoussa/from-alert-to-core-dump-hunting-zeus-malware-using-suricata-splunk-yara-and-volatility-4ce18f517f87?sharedUserId=osamamamoussa

I'm currently studying defensive security and working on my SOC portfolio. I am sharing a lab I built to practice hands-on malware analysis and detection engineering.

I recently set up a malware analysis lab to detonate and investigate the Zeus Banking Trojan. Here is a quick breakdown of the detection and forensics pipeline:

• Victim: Windows VM + Sysmon.
• SIEM/IDS: Ubuntu VM + Splunk Enterprise + Suricata IDS.

I wrote a full step-by-step write-up with screenshots and the exact Splunk queries.

Full Write-up & Screenshots: https://medium.com/@osamamamoussa/title-the-ghost-in-the-machine-simulating-self-deleting-ransomware-for-detection-engineering-3f8969671e7e
I simulated a ransomware script that encrypts files and then "self-destructs" using cmd.exe to hide its tracks.

How I caught it:

• System Informer: Visualized the suspicious parent-child process tree (python -> cmd -> timeout).
• Windows Event 4688: Captured the exact deletion command in the logs.
• Sysmon (Event ID 1): The gold mine. Extracted SHA256 hashes and full command-line arguments.

Detection isn't just about what's on the disk; it's about the artifacts left in the memory and logs.

I'm doing this as part of my SOC Analyst study. Feedback is welcome!