Cyber Security & SOC Operations

Defend Modern Infrastructure, Harden Linux & Windows Systems, Remediate OWASP Top 10 Flaws, Engineer SIEM Detections, and Lead SOC Incident Response

12Weeks

5Stages

60+Lessons

8Projects

IntermediateLevel

Welcome to the Tech Minds Academy Cyber Security & SOC Operations Track. As Nigerian fintechs, enterprises, public institutions, and global SaaS teams digitise critical infrastructure, the highest-demand security role is the practical defender: the SOC Analyst, Detection Engineer, and Security Operations specialist who can read raw network packets, lock down servers, audit web applications, write high-signal SIEM alerts, and contain live incidents calmly under pressure. Across 12 intensive weeks at our Bwari, Abuja campus (G5 Plaza, Sabon-Gari Road) or Live Online, you will train inside isolated, authorised cyber range labs to graduate with verifiable defensive engineering artifacts.

IMPORTANT

Strict Ethical & Legal Authorisation Mandate: Every network scan, packet capture, vulnerability check, and exploitation test in this programme is conducted exclusively inside isolated Tech Minds Academy lab environments or explicitly authorised cyber ranges under Nigeria's Cybercrimes (Prohibition, Prevention, etc.) Act and international computer misuse laws. Unauthorised scanning or testing of external targets results in immediate dismissal.

---

Programme Overview

Attribute	Details
Track Title	Cyber Security, Defensive Engineering & SOC Operations
Duration	12 Weeks (5 Progressive Stages · 72 Guided Cyber Lab Lessons)
Delivery Modes	In-Person Lab Cohort (Bwari, Abuja) & Instructor-Led Live Online
Level & Prerequisites	Intermediate — Comfort with OS usage, basic networking/command-line concepts (graduates of Computer Training, Web, or Cloud Computing & DevOps transition seamlessly)
Defensive Focus	Blue-Team SOC Operations, System Hardening, AppSec Remediation, Detection Engineering, Digital Forensics & Incident Response (DFIR)
Core Lab Stack	Ubuntu Linux, Windows Server / Sysmon, Wireshark, tcpdump, Zeek, Nmap, OWASP ZAP, Wazuh SIEM, OpenSearch/Splunk, Sigma Rules
Portfolio Output	8 Defensive Runbooks, Hardening Baselines, Detection Rules & SOC Incident Reports
Certification Alignment	CompTIA Security+ (SY0-701), CompTIA CySA+, ISC2 Certified in Cybersecurity (CC), and Junior SOC Analyst Level 1/2 readiness

---

Curriculum Rationale

1. Ethical & Legal Authorisation Boundary First

Professional security is built on trust, written Rules of Engagement (RoE), scope discipline, and data confidentiality (NDPA / GDPR principles). Before touching a single scanner, students learn legal boundaries, asset scoping, responsible disclosure, and chain-of-custody documentation so employers can trust them with privileged production telemetry.

2. Blue-Team SOC & Defensive Engineering Focus

Many beginner courses over-index on running automated offensive scripts without understanding how attacks appear in network traffic, OS logs, or application code—leaving graduates unprepared for entry-level hiring, where 80%+ of junior/mid-level roles sit on the Blue Team (SOC Analyst, Security Engineer, Vulnerability Analyst, GRC/AppSec). You will learn how adversaries operate via MITRE ATT&CK, and immediately translate that knowledge into hardening configurations, code fixes, and SIEM detection rules.

3. Evidence-Driven Hands-On Lab Methodology

Every week runs inside containerised or virtualised lab topologies where you capture real PCAPs, harden live Linux/Windows instances against CIS Benchmarks, patch vulnerable web endpoints, ingest Sysmon and auditd telemetry into Wazuh SIEM, and write executive-ready incident reports.

---

Stage 1: Security Principles, Threat Landscape & Network Packet Analysis (Weeks 1–2)

Goal: Master foundational security governance, map adversary tradecraft with MITRE ATT&CK, and inspect raw network protocols packet-by-packet using Wireshark, tcpdump, and Zeek.

Week 1: Security Governance, Threat Modelling & MITRE ATT&CK

Lesson	Topic	Core Security Concepts
1.1	Legal Ethics, Rules of Engagement & NDPA Compliance	Authorised scoping, Nigeria Data Protection Act (NDPA) breach duties, responsible disclosure, lab safety isolation
1.2	Core Security Pillars & Defense-in-Depth	CIA Triad (Confidentiality, Integrity, Availability), Zero Trust principles, least privilege, separation of duties
1.3	Threat Actors, TTPs & The Pyramid of Pain	Script kiddies vs cybercrime syndicates vs APTs; why hunting Adversary TTPs beats chasing static hashes/IPs
1.4	Cyber Kill Chain & MITRE ATT&CK Matrix	Mapping Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Lateral Movement, and C2
1.5	Structured Threat Modelling (STRIDE) & Risk Scoring	Spoofing, Tampering, Repudiation, Information Disclosure, DoS, Elevation of Privilege; Risk = Likelihood × Impact
1.6	Identity, Authentication & Access Control Models	MFA resistance (FIDO2/Passkeys vs SMS OTP SIM-swap risks), RBAC vs ABAC, SSO, password manager enterprise hygiene

Weekly Project 1 — Fintech Architecture STRIDE Threat Model & Risk Register: Perform a structured STRIDE threat model on a sample Nigerian mobile-payments web architecture, mapping top 10 threats to MITRE ATT&CK techniques, business risk ratings, and layered compensating controls.

---

Week 2: Deep Network Protocols & Packet Forensics (Wireshark, tcpdump, Zeek)

Lesson	Topic	Core Security Concepts
2.1	Encapsulation, ARP, IP, ICMP & TCP/UDP Header Anatomy	TCP flags (SYN, ACK, FIN, RST, PSH), sequence numbers, spotting SYN floods and half-open scan signatures
2.2	Capturing Traffic on Headless Linux Hosts with tcpdump	BPF capture filters, ring buffers, capturing specific VLANs/ports without dropping packets, saving .pcap evidence
2.3	Deep Packet Inspection with Wireshark	Display filter mastery, TCP/HTTP stream reconstruction, conversation statistics, exporting suspect payload objects
2.4	Inspecting DNS, HTTP & TLS Metadata on the Wire	Identifying DNS tunnelling/DGAs, cleartext credential leaks, TLS ClientHello SNI & JA3/JA4 fingerprint basics
2.5	Network Security Monitoring (NSM) with Zeek	Converting raw packet captures into structured conn.log, dns.log, http.log, and ssl.log telemetry
2.6	Perimeter Segmentation, DMZs, VPNs & IDS/IPS (Suricata)	Subnet zoning, WireGuard/IPsec concepts, signature vs anomaly detection

Weekly Project 2 — Malicious PCAP Forensic Reconstruction Lab: Investigate a multi-megabyte lab .pcap capture containing port reconnaissance, brute-force authentication, suspicious DNS C2 beaconing, and data exfiltration—producing a timestamped packet-level forensic timeline.

Practical Example: tcpdump, Wireshark & Zeek Analytical Reference

# 1. Capture suspicious outbound DNS & non-standard HTTP traffic on eth0 to rotating PCAPs
sudo tcpdump -i eth0 -nn -s 0 \
  '(udp port 53 or (tcp port 8080 and (tcp[tcpflags] & tcp-syn != 0)))' \
  -C 50 -W 5 -w /var/pcap/lab-capture.pcap

# 2. Parse a captured PCAP with Zeek and hunt high-entropy / long DNS queries (DNS Tunnelling check)
zeek -r /var/pcap/suspect-session.pcap
zeek-cut id.orig_h query qtype_name < dns.log \
  | awk 'length($2) > 55 { print $0 }' \
  | sort | uniq -c | sort -nr | head -n 20

# High-Signal Wireshark Display Filters for SOC Packet Triage:

# 1. Spot TCP SYN scan bursts (SYN set, ACK not set) from a single source
tcp.flags.syn == 1 && tcp.flags.ack == 0

# 2. Identify HTTP POST requests carrying login attempts or WebShell commands
http.request.method == "POST" && (http.request.uri contains "login" || http.request.uri contains "cmd")

# 3. Inspect TLS handshakes to extract Server Name Indication (SNI) domains
tls.handshake.type == 1 && tls.handshake.extensions_server_name

# 4. Detect potential ARP spoofing / gratuitous ARP anomalies on local LAN
arp.duplicate-address-detected || arp.isgratuitous == 1

---

Stage 2: Endpoint & Server Hardening — Linux, Windows & Cryptography (Weeks 3–4)

Goal: Shrink the attack surface across Linux servers and Windows endpoints using CIS Benchmarks, host firewalls, Sysmon telemetry, Active Directory hygiene, and modern cryptographic standards.

Week 3: Linux Server Hardening, Access Controls & Cryptography

Lesson	Topic	Core Security Concepts
3.1	CIS Benchmarks & Attack Surface Reduction	Removing unnecessary daemons, securing bootloaders, sysctl kernel network hardening (SYN cookies, disabling IP forwarding)
3.2	Hardening OpenSSH, sudoers & PAM Policies	Key-only auth, AllowUsers, Fail2Ban / sshguard, sudo command logging, account lockout policies
3.3	Host Firewalls (ufw / nftables) & Mandatory Access Control	Default-deny ingress, egress filtering concepts, AppArmor / SELinux enforcement profiles
3.4	Linux Audit Daemon (auditd) & File Integrity Monitoring	Watching /etc/passwd, /etc/shadow, /etc/sudoers, and binary execution (execve) for tamper detection
3.5	Applied Cryptography: Hashing, Symmetric & Asymmetric	Argon2id / bcrypt password hashing (why MD5/SHA-1 fail), AES-256-GCM, RSA vs Elliptic Curve (Ed25519), KMS secrets
3.6	PKI, X.509 Certificates & TLS 1.3 Hardening	Certificate Authorities, revocation (OCSP), disabling weak ciphers/TLS 1.0–1.1, automated certificate lifecycle

Weekly Project 3 — CIS-Aligned Ubuntu Server Hardening & Audit Script: Take a deliberately misconfigured Ubuntu Linux server (world-writable files, root SSH enabled, legacy services exposed, unmonitored /etc) and apply a documented hardening baseline verified with Lynis to achieve a hardening index above 80+.

Practical Example: Hardened /etc/ssh/sshd_config.d/99-techminds-hardening.conf

# Tech Minds CIS-Aligned OpenSSH Hardening Drop-In Configuration
Protocol 2
PermitRootLogin no
MaxAuthTries 3
MaxSessions 2
LoginGraceTime 30

# Enforce cryptographic public-key authentication only
PasswordAuthentication no
PermitEmptyPasswords no
KbdInteractiveAuthentication no
PubkeyAuthentication yes

# Disable lateral-movement / tunnelling features when not explicitly required
X11Forwarding no
AllowAgentForwarding no
AllowTcpForwarding no
PermitTunnel no

# Strong modern key exchange, ciphers & MACs
KexAlgorithms sntrup761x25519-sha512@openssh.com,curve25519-sha256
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com

ClientAliveInterval 300
ClientAliveCountMax 2
LogLevel VERBOSE
AllowGroups sshusers

---

Week 4: Windows Endpoint Security, Sysmon & Active Directory Defence

Lesson	Topic	Core Security Concepts
4.1	Windows Security Internals: Processes, Services & Registry	lsass.exe, svchost.exe, Run/RunOnce persistence keys, Scheduled Tasks, User Account Control (UAC)
4.2	Windows Security Event Logs & Sysmon Deployment	Critical Event IDs (4624, 4625, 4672, 4688, 4698, 4720) + Sysmon IDs (1 Process Create, 3 Network, 11 File, 22 DNS)
4.3	PowerShell Security Telemetry	Enabling Script Block Logging (4104), Module Logging, Constrained Language Mode, spotting -EncodedCommand obfuscation
4.4	Active Directory (AD) Architecture & Common Attack Paths	Domains, OUs, Group Policy Objects (GPOs), Kerberoasting, Pass-the-Hash, Tiered Admin Model, LAPS for local admin passwords
4.5	Endpoint Hardening: BitLocker, Attack Surface Reduction & AppLocker	Full-disk encryption, Microsoft Defender ASR rules (blocking Office macro child processes), patch cadence
4.6	Cloud Identity & M365/Workspace Baseline Controls	Conditional Access policies, blocking legacy authentication, impossible-travel alerts, OAuth app consent governance

Weekly Project 4 — Windows Endpoint Hardening + Sysmon Telemetry Baseline: Deploy a modular SwiftOnSecurity-inspired Sysmon XML configuration and PowerShell Script Block Logging onto a Windows lab host, simulate benign-test persistence techniques (Scheduled Task + encoded PowerShell), and extract exact forensic Event ID evidence.

---

Stage 3: Vulnerability Assessment & Web Application Security (Weeks 5–6)

Goal: Discover network assets responsibly, triage CVEs by real exploitability rather than raw CVSS score alone, and find + patch OWASP Top 10 web and API vulnerabilities.

Week 5: Authorised Asset Discovery & Vulnerability Management

Lesson	Topic	Core Security Concepts
5.1	Asset Inventory & Attack Surface Management	Shadow IT risks, passive subdomain enumeration (crt.sh certificate transparency), WHOIS/DNS footprinting
5.2	Authorised Network Scanning with Nmap	Host discovery, SYN (-sS) vs Connect (-sT) scans, service/version detection (-sV), default safe NSE scripts (-sC)
5.3	Vulnerability Scanners & Authenticated vs Unauthenticated Scans	Running OpenVAS / Greenbone / Nuclei in lab environments; why credentialed OS/package scans reduce blind spots
5.4	CVE, CVSS v3.1/v4.0, EPSS & CISA KEV Prioritisation	Why a CVSS 7.8 on an internet-facing service in CISA's Known Exploited Vulnerabilities (KEV) catalogue beats an internal 9.0
5.5	Software Supply Chain Security & SBOMs	Dependency vulnerabilities (npm audit, pip-audit, Trivy), typosquatting packages, generating CycloneDX SBOMs
5.6	Remediation SLAs, Patch Verification & Exception Workflows	Writing developer-friendly remediation tickets, compensating controls (WAF virtual patching) when immediate downtime isn't viable

Weekly Project 5 — Authorised Lab Network Vulnerability Assessment & Prioritised Remediation Plan: Scan a multi-host lab subnet using Nmap and vulnerability tooling, correlate findings against CVSS + CISA KEV + asset criticality, verify false positives manually, and deliver a ranked 30/60/90-day remediation roadmap.

---

Week 6: OWASP Top 10 Web & API Security + Remediation Code Patterns

Lesson	Topic	Core Security Concepts
6.1	Intercepting Web Proxies (OWASP ZAP / Burp Community)	Inspecting HTTP requests/responses, cookies (HttpOnly, Secure, SameSite), headers, session tokens
6.2	Broken Access Control (A01) & IDOR / BOLA Flaws	Horizontal vs vertical privilege escalation in REST APIs, enforcing object-level ownership checks server-side
6.3	Injection (A03): SQL Injection & Command Injection	How string concatenation breaks SQL syntax; remediating permanently with parameterised queries / prepared statements
6.4	Cross-Site Scripting (XSS), CSRF & Content Security Policy	Stored vs Reflected vs DOM XSS, context-aware output encoding, strict Content-Security-Policy & SameSite=Lax/Strict
6.5	Authentication Flaws (A07) & Server-Side Request Forgery (A10)	Credential stuffing rate limits, JWT alg & secret pitfalls, SSRF targeting cloud metadata (169.254.169.254) & IMDSv2 defence
6.6	Security Headers, CORS Misconfigurations & Secure SDLC	Strict-Transport-Security, X-Content-Type-Options, avoiding Access-Control-Allow-Origin: * with credentials

Weekly Project 6 — Web App Security Audit & Defensive Pull Request: Audit an intentionally vulnerable Node.js/Express lab application (OWASP Juice Shop / custom Tech Minds lab API), document 5 confirmed OWASP vulnerabilities with reproducible PoCs, and submit a remediation Git Pull Request fixing SQLi, IDOR, and missing security headers.

Practical Example: Vulnerable vs Remediated API Endpoint (SQLi + IDOR Fix)

// ❌ VULNERABLE: Raw SQL string interpolation (SQLi) + no ownership check (IDOR)
app.get('/api/invoices/:invoiceId', requireAuth, async (req, res) => {
  const query = `SELECT * FROM invoices WHERE id = '${req.params.invoiceId}'`;
  const result = await db.query(query);
  return res.json(result.rows[0]);
});

// ✅ REMEDIATED: Input validation + Parameterised Query + Object-Level Ownership Enforcement
import { z } from 'zod';

const InvoiceParamsSchema = z.object({
  invoiceId: z.string().uuid()
});

app.get('/api/invoices/:invoiceId', requireAuth, async (req, res) => {
  const parsed = InvoiceParamsSchema.safeParse(req.params);
  if (!parsed.success) {
    return res.status(400).json({ error: 'Invalid invoice identifier format.' });
  }

  const result = await db.query(
    `SELECT id, amount_ngn, status, created_at
     FROM invoices
     WHERE id = $1 AND account_owner_id = $2`,
    [parsed.data.invoiceId, req.user.id]
  );

  if (result.rowCount === 0) {
    return res.status(404).json({ error: 'Invoice not found.' });
  }

  return res.status(200).json(result.rows[0]);
});

---

Stage 4: SOC Operations, SIEM & Threat Hunting (Weeks 7–9)

Goal: Operate inside a modern Security Operations Centre—centralising telemetry into Wazuh/OpenSearch SIEM, authoring vendor-agnostic Sigma detections, analysing phishing/IOCs, and hunting stealthy threats.

Week 7: Log Centralisation & SIEM Operations (Wazuh / OpenSearch / Splunk)

Lesson	Topic	Core Security Concepts
7.1	Modern SOC Architecture & Tier 1 / Tier 2 Workflows	Log shippers, SIEM indexing, SOAR playbooks, Mean Time to Detect (MTTD) & Mean Time to Respond (MTTR)
7.2	Deploying Wazuh Manager, OpenSearch & Endpoint Agents	Enrolling Linux (auditd/auth logs) and Windows (Sysmon/Security Event) agents, File Integrity Monitoring (FIM)
7.3	Log Normalisation, Parsing & Time Synchronisation	Why UTC NTP alignment across firewalls, cloud logs, and endpoints is non-negotiable for timeline correlation
7.4	Querying Security Telemetry (OpenSearch DQL / KQL & SPL Basics)	Filtering failed logins followed by success, rare parent-child process trees (winword.exe -> powershell.exe), geo/ASN anomalies
7.5	Building High-Signal SOC Dashboards	Authentication velocity spikes, privilege escalations, FIM alerts on critical config paths, agent health monitoring
7.6	Cloud Audit Log Ingestion (AWS CloudTrail / M365 Audit)	Detecting root console logins, disabled CloudTrail logging, public S3 policy changes, IAM access key creation

Weekly Lab Milestone (Week 7) — Multi-Platform Wazuh SIEM Telemetry & Dashboard Deployment: Deploy Wazuh Manager + OpenSearch Dashboards, enrol Ubuntu (auditd) and Windows (Sysmon) lab agents, verify UTC log normalisation, and build a Tier-1 SOC authentication & FIM monitoring dashboard.

---

Week 8: Detection Engineering, Wazuh XML & Sigma Rules

Lesson	Topic	Core Security Concepts
8.1	Detection-as-Code Philosophy	Version-controlling detections in Git, mapping every rule to MITRE ATT&CK tactic/technique IDs, testing with Atomic Red Team
8.2	Authoring Custom Wazuh Decoders & Correlation Rules	Frequency/timeframe correlation (e.g., 8 SSH failures + 1 success from same srcip within 120 seconds)
8.3	Vendor-Agnostic Detection with Sigma Rules	Sigma YAML specification (logsource, detection, condition, falsepositives, level), converting Sigma to SIEM queries
8.4	Detecting Persistence, Credential Dumping & Lateral Movement	Alerting on lsass.exe memory access, /etc/cron* tampering, new Windows services, unexpected sudo escalation
8.5	Tuning False Positives & Alert Fatigue Engineering	Allowlisting legitimate admin automation safely (by signed binary path + service account + host, never blanket path exclusions)
8.6	Threat Intelligence Enrichment & IOC Lifecycle	Threat feeds, STIX/TAXII concepts, VirusTotal / AbuseIPDB / URLhaus lookups without leaking confidential internal files

Weekly Project 7 — Custom SIEM Detection Pack (5 Sigma + Wazuh Rules): Deploy Linux and Windows agents to your Wazuh lab cluster, execute 5 safe Atomic Red Team simulations, and author + validate 5 custom detection rules mapped to MITRE ATT&CK with < 5% false-positive noise on baseline traffic.

Practical Example: Sigma Detection Rule + Wazuh Custom Correlation Rule

# sigma-rules/win_suspicious_powershell_encoded_from_office.yml
title: Suspicious Encoded PowerShell Spawned by Office Application
id: 7c94b8e2-41d3-4f8a-9c51-2a8e19f0b312
status: stable
description: Detects Microsoft Office applications spawning PowerShell with encoded command arguments, common in spear-phishing macro payloads.
author: Tech Minds SOC Engineering Track
date: 2026/03/15
tags:
  - attack.execution
  - attack.t1059.001
  - attack.initial_access
  - attack.t1566.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\WINWORD.EXE'
      - '\EXCEL.EXE'
      - '\POWERPNT.EXE'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_cli:
    CommandLine|contains:
      - ' -enc '
      - ' -EncodedCommand '
      - ' -e '
      - 'FromBase64String'
  condition: selection_parent and selection_child and selection_cli
falsepositives:
  - Rare internal finance automation macros (verify signed macro hash and IT ticket)
level: high

<!-- /var/ossec/etc/rules/local_rules.xml — Wazuh Brute-Force Followed by Success Correlation -->
<group name="local,sshd,authentication,">
  <rule id="100210" level="12" timeframe="120">
    <if_matched_sid>5712</if_matched_sid>
    <if_sid>5715</if_sid>
    <same_source_ip />
    <description>SOC CRITICAL: SSH brute-force attack followed by successful login from $(srcip) for user $(dstuser).</description>
    <mitre>
      <id>T1110</id>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

---

Week 9: Phishing Triage, Email Security & Hypothesis-Driven Threat Hunting

Lesson	Topic	Core Security Concepts
9.1	Email Authentication & Phishing Header Forensics	Inspecting raw .eml headers: SPF, DKIM, DMARC, Return-Path vs From spoofing, relay hops
9.2	Safe Triage of Malicious Links & Attachments	Defanging IOCs (hxxps://, [.]), sandbox detonation analysis (ANY.RUN / CyberChef), macro/LNK/ISO delivery chains
9.3	Decoding Obfuscated Payloads with CyberChef	Base64, XOR, gzip/deflate PowerShell streams, URL de-obfuscation, extracting embedded C2 domains
9.4	Structured Alert Triage Methodology	True Positive vs Benign True Positive vs False Positive; the 5W1H SOC analyst investigation checklist
9.5	Hypothesis-Driven Threat Hunting	Assuming breach: hunting living-off-the-land binaries (LOLBins like certutil, rundll32, curl), beaconing intervals
9.6	Writing Clear Tier-1-to-Tier-2 Escalation Notes	Documenting host, user, blast radius, verified IOCs, raw log evidence, and recommended containment actions

Weekly Lab Milestone (Week 9) — Phishing .eml Forensics, CyberChef De-Obfuscation & Threat Hunt: Dissect 3 real-world sanitised phishing .eml samples (SPF/DKIM/DMARC verification + CyberChef payload decoding), extract defanged IOCs, and run a hypothesis-driven SIEM hunt across lab endpoint logs.

---

Stage 5: Incident Response, Digital Forensics & SOC Capstone (Weeks 10–12)

Goal: Execute calm, forensically sound containment and recovery following the NIST SP 800-61 lifecycle, conduct tabletop simulations, and complete an end-to-end Blue-Team SOC Investigation & Hardening Capstone.

Week 10: NIST Incident Response Lifecycle & Containment Playbooks

Lesson	Topic	Core Security Concepts
10.1	NIST SP 800-61r2 / r3 Incident Response Phases	Preparation → Detection & Analysis → Containment, Eradication & Recovery → Post-Incident Activity
10.2	Building High-Priority IR Playbooks	Ransomware containment, Business Email Compromise (BEC / invoice fraud), Compromised Cloud IAM Key, WebShell intrusion
10.3	Short-Term vs Long-Term Containment Decisions	Isolating an endpoint via EDR/firewall without destroying volatile RAM evidence prematurely; revoking sessions & rotating keys
10.4	Order of Volatility & Evidence Preservation	CPU registers/RAM → network connections/processes → disk → backups; sha256sum cryptographic evidence hashing & chain of custody
10.5	Linux & Windows Live Triage Acquisition	Collecting active processes, open sockets, scheduled tasks, auth.log, and evtx artefacts cleanly using triage scripts
10.6	Eradication Verification & Safe Production Recovery	Rebuilding from golden images vs cleaning in place, verifying clean backups before restore, heightened post-recovery monitoring

Weekly Lab Milestone (Week 10) — NIST IR Playbook & Live WebShell Containment Drill: Execute short-term network isolation, volatile memory/socket evidence acquisition (sha256sum chain-of-custody), and clean image recovery on a simulated WebShell intrusion, documented via the Tech Minds SOC Incident Report template below.

Practical Example: SOC Incident Response Report & Escalation Template

# SOC INCIDENT REPORT — [INC-2026-041]

- **Severity**: SEV-1 (Critical) | **Status**: Contained — Eradication In Progress
- **Detected At (UTC)**: 2026-06-14T09:18:42Z | **Contained At (UTC)**: 2026-06-14T09:34:10Z (`MTTR-Contain: 15m 28s`)
- **Lead Analyst**: [Analyst Name] | **Affected Asset**: `prod-web-02` (`10.20.14.22`, Ubuntu 24.04)

## 1. Executive Summary
At 09:18 UTC, Wazuh rule `100305` triggered on `prod-web-02` when the `www-data` process spawned `/bin/sh -c curl ...` following an unauthenticated upload to `/api/v2/import`. Investigation confirmed remote command execution and an attempted outbound beacon. No customer database exfiltration occurred prior to network isolation.

## 2. MITRE ATT&CK Mapping
- **Initial Access**: `T1190` — Exploit Public-Facing Application
- **Execution**: `T1059.004` — Unix Shell spawned by web worker
- **Command & Control**: `T1071.001` — Web Protocols outbound beacon (`hxxps://cdn-sync-check[.]net/gate`)

## 3. Verified Indicators of Compromise (Defanged)
| Indicator Type | Value | Source |
| :--- | :--- | :--- |
| Remote Attacker IP | `198.51.100[.]74` | Nginx access log & Zeek `conn.log` |
| C2 Domain | `cdn-sync-check[.]net` | `auditd` `execve` & `dns.log` |
| Dropped Payload SHA-256 | `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` | `/tmp/.font-unix-cache` |

## 4. Containment, Eradication & Preventive Actions
1. **Immediate Containment (Completed 09:34 UTC)**: Security Group isolated `prod-web-02` from egress and removed instance from ALB target group; volatile process/socket snapshot archived (`sha256` logged).
2. **Eradication**: Replaced mutable host with fresh immutable container image; patched file-type & path validation in PR `#418`; rotated app DB credentials via Secrets Manager.
3. **Hardening Follow-Up**: Enforce read-only root filesystem and strict egress firewall allowlist on all web tier nodes.

---

Week 11: Digital Forensics, Tabletop Exercises & Executive Communication

Lesson	Topic	Core Security Concepts
11.1	Disk & Log Timeline Reconstruction	Correlating web access logs + OS auditd/evtx + firewall flows into a single master UTC CSV timeline
11.2	Memory & Process Triage Fundamentals	Spotting hollowed/unbacked processes, injected threads, and cleartext environment secrets in lab memory dumps (Volatility 3 intro)
11.3	Business Email Compromise (BEC) & Cloud Account Takeover Forensics	Investigating malicious inbox forwarding rules, OAuth token abuse, and rogue MFA device registrations
11.4	Running Crisis Tabletop Exercises	Simulating cross-functional coordination across Engineering, Legal/NDPA Data Protection Officer, Leadership, and Comms
11.5	Executive Security Reporting & Metrics	Translating packet/CVE findings into board-level business impact, risk reduction, and concise executive summaries
11.6	Career Preparation for SOC & Security Roles	Structuring a public defensive portfolio safely (sanitising data), live SOC interview triage walkthroughs

Weekly Lab Milestone (Week 11) — Master UTC Timeline Reconstruction & Ransomware Tabletop Exercise: Correlate multi-source logs (Nginx, auditd, Sysmon, firewall flows) into a unified master UTC timeline and participate in a role-assigned cross-functional ransomware & NDPA breach-notification tabletop exercise.

---

Week 12: Blue-Team SOC Investigation & Hardening Capstone

Milestone	Deliverable	Defensive Focus
12.1	Live Multi-Stage Intrusion Triage	Investigate a simulated multi-host intrusion across Wazuh SIEM, PCAPs, Linux auditd, and Windows Sysmon logs
12.2	Master Attack Timeline & IOC Report	Reconstruct every attacker step from initial foothold to lateral movement mapped to MITRE ATT&CK
12.3	Containment & System Hardening Execution	Isolate compromised hosts, patch the exploited web/OS vulnerability, and harden SSH/firewall/app configurations
12.4	Custom Detection Rule Deployment	Deploy validated Wazuh/Sigma rules that immediately alert if the adversary replays the TTPs
12.5	Executive & Technical Incident Report	Deliver a dual-layer report: 1-page C-level/NDPA impact brief + deep technical DFIR appendix
12.6	Live Oral SOC Briefing	20-minute live incident debrief and Q&A before the Tech Minds security review panel

Weekly Project 8 (Capstone) — End-to-End Blue-Team SOC Intrusion Investigation, Remediation & Detection Pack: Investigate a realistic simulated enterprise breach inside the Tech Minds cyber lab, produce a forensically sound timeline, patch the root-cause vulnerability, harden the affected hosts, deploy regression Sigma/Wazuh detections, and present your incident briefing.

---

Assessment & Grading Breakdown

Assessment Component	Weight	Evaluation Criteria
Weekly Cyber Lab Reports & 7 Stage Projects	40%	Accuracy of PCAP reconstructions, CIS hardening configs, OWASP code patches, and Sigma/Wazuh detection quality
Mid-Track Practical Triage & AppSec Exam	30%	Hands-on lab assessment: triaging live SIEM alerts, analysing a phishing sample, and remediating vulnerable web endpoints
Week 12 Blue-Team SOC Capstone & Briefing	30%	Completeness of forensic timeline, root-cause eradication, low-noise detection rules, and clarity of executive/technical IR report

---

Learning Outcomes

Graduates of the Tech Minds Cyber Security & SOC Operations programme can:

1. Operate Ethically Within Legal Scope: Scope authorised assessments responsibly, apply STRIDE threat modelling, and align incident handling with NDPA/NIST governance.
2. Analyse Network Traffic at the Packet Level: Capture and dissect network traffic with tcpdump, Wireshark, and Zeek to uncover scans, cleartext leaks, DNS anomalies, and C2 beacons.
3. Harden Linux & Windows Infrastructure: Apply CIS-aligned baselines across OpenSSH, ufw, auditd, Windows Event Logs, Sysmon, PowerShell logging, and cryptographic TLS/hashing controls.
4. Prioritise & Remediate Vulnerabilities: Conduct authorised Nmap and vulnerability assessments prioritised via CVSS + CISA KEV, and remediate OWASP Top 10 flaws directly in source code.
5. Engineer SIEM Detections & Hunt Threats: Centralise logs in Wazuh / OpenSearch, write custom correlation and Sigma rules mapped to MITRE ATT&CK, triage phishing headers, and suppress false positives.
6. Lead Structured Incident Response: Execute the NIST SP 800-61 lifecycle from evidence preservation and containment to root-cause eradication and executive post-incident reporting.

---

Tools, Platforms & Resources

Category	Tools Covered	Purpose in Curriculum
Network Forensics	Wireshark, tcpdump, Zeek, Suricata	Packet capture, protocol stream reconstruction, NSM log generation
Endpoint & OS Hardening	Ubuntu Linux (ufw, auditd, Lynis), Windows (Sysmon, Defender ASR)	Attack surface reduction, kernel/SSH hardening, host telemetry
Vulnerability & AppSec	Nmap, OWASP ZAP, Trivy, Nuclei (lab-scoped)	Authorised asset discovery, CVE scanning, OWASP Top 10 testing
SIEM & Detection	Wazuh, OpenSearch Dashboards, Sigma CLI, Atomic Red Team	Centralised log aggregation, correlation rules, detection validation
Phishing & DFIR Triage	CyberChef, Volatility 3 (intro), sha256sum	Payload de-obfuscation, header forensics, volatile evidence triage
Frameworks & Standards	MITRE ATT&CK, NIST SP 800-61, CIS Benchmarks, OWASP Top 10	Industry-standard threat mapping, hardening, and incident workflows

---

Next Steps & Related Pathways

• Browse all syllabi on the 2026 Curricula PDFs page or compare tracks in All Courses & Pathways.
• Master Cloud Infrastructure Security: Pair your Blue-Team skills with Cloud Computing & DevOps to specialise in Cloud Security & DevSecOps.
• Automate Security Analytics in Python: Explore Python, Data Science & Machine Learning to script custom threat-hunting and log-analysis pipelines.