---

Day 2 – Understanding SOC, SOC Team & Cyber Kill Chain.

---

🏢 What is a SOC – Deep Explanation (Simple & Clear)

A SOC is a 24/7 digital security control room for a company.

Think of it like this:

A shopping mall has:

• CCTV cameras
• Security guards
• Control room
• Incident response team

A company’s SOC has:

• Monitoring tools
• SOC Analysts (L1, L2, L3)
• Incident Response team
• Threat Intelligence team

SOC = Digital safety headquarters.

---

👥 SOC Team Structure (Explained in simple words)

1️⃣ L1 – SOC Analyst (Junior)

Role:

• Watch alerts
• Identify suspicious activity
• Escalate to L2

Simple example:
You see someone trying the wrong password 30 times → You escalate the issue.

---

2️⃣ L2 – Senior SOC Analyst

Role:

• Deep investigation
• Log correlation
• Validates incidents
• Suggest containment steps

Simple example:
L2 checks logs from firewall, server, VPN, and confirms the attacker’s IP is malicious.

---

3️⃣ L3 – Expert SOC Analyst / Threat Hunter

Role:

• Advanced threat hunting
• Malware analysis
• Forensics
• Writing complex detection rules

Example:
L3 finds out the attacker used a new technique and creates a rule to detect it in future.

---

4️⃣ Incident Response (IR) Team

Role:

• Contain the attack
• Block attacker
• Recover systems

Example:
They isolate an infected system from the network.

---

5️⃣ Threat Intelligence Team

Role:

• Research new attacks
• Provide IOCs (bad IPs, domains, hashes)
• Update detection rules

---

🔄 How SOC Monitoring Works (Explained for Beginners)

Step-by-step (Easy Example):

1. User logs in at midnight from another country → unusual
2. SIEM creates an alert
3. L1 sees the alert → Flags it as suspicious
4. L2 investigates logs → Confirms it’s unauthorized
5. IR team blocks the login + resets password
6. L3 writes new rule to improve detection

This is the SOC workflow.

---

🔗 Cyber Kill Chain (Day 2 Key Topic)

Cyber Kill Chain explains how attackers plan and execute attacks.
We teach this to understand the attack lifecycle.

---

🧨 1. Reconnaissance – Attacker studies the target

Example:
Checking LinkedIn profile of employees, scanning open ports.

---

🧪 2. Weaponization – Preparing the attack

Example:
Creating a malware file or phishing email.

---

✉️ 3. Delivery – Sending the attack

Example:
Sending malicious email attachment.

---

💥 4. Exploitation – Attack is executed

Example:
User clicks link → malware runs.

---

⚙️ 5. Installation – Malware installs itself

Example:
Malware hides in system files.

---

📡 6. Command & Control (C2)

Example:
Attacker connects to the infected device remotely.

---

🎯 7. Actions on Objectives

Example:
Data theft, ransomware, deleting files, etc.

---

🧠 Simple Real-World Example of Entire Kill Chain

“An employee receives a fake Amazon refund email with an attachment.”

• Recon: Attacker finds employee email
• Weaponize: Creates malicious PDF
• Delivery: Sends email
• Exploit: User opens PDF
• Install: Malware downloads
• C2: Attacker controls PC
• Objective: Attacker steals data

This is how attackers operate — and SOC Analysts stop them.

---

📝 Day 2 Activity for Students

Ask them to list:

• One real-life example for each Kill Chain stage
  (Example: Delivery = phishing mail)

---

🏠 Day 2 Homework

Google and write:
“Famous phishing attack cases in India.”
Note down:

• What happened?
• Who was targeted?

---

🎤 Trainer Script for Day 2

You can read this during class:

“SOC is like a security control room.
L1, L2, L3 all have different responsibilities just like security staff in a mall.

Cyber Kill Chain teaches us how hackers attack step-by-step.
If we know their steps, we can stop them early.

Today, you understood how SOC teams work and how attacks happen in real life.”

---