whoami#

If you haven’t read my about page, I am a full time blue team employee who enjoys doing red team on the side. Blue team pays the bills and red team keeps my brain happy. I’ve been working in a SOC like environment for a few years now and would like to share in this post how Breachlab.org Sentinel compares to a real world SOC environment. One thing I do need to preface before the rest of this post is that at my current employment we do not have a “by the book” SOC team. We are missing a few members which means that we all need to fill multiple roles all at the same time. “Wearing many different hats” as my boss would say. One day I could be just doing triage, and the next I could be working on system architecture and detection rules.

What Breachlab is and what it isn’t#

For those of you who don’t know. Breachlab is a CTF platform that is not gamified like several other sites like HTB or THM. What makes Breachlab a great tool is the fact that it doesn’t hold your hand or have a hint button. When you get a flag on Breachlab you got it either because you knew exactly what to do or you spent the time researching what to do. That’s good for two reasons. The first being: you need to learn, not just check a box or worry about a daily streak on a gamified website. If you’d like to read more about that kind of thinking here’s a wonderful post by a fellow Breachlab crew member h0neyp0t that goes into more detail. The second and in my opinion more critical reason: cybersecurity is not a field where you can learn the basics and boom you’re set. Cybersecurity as a field requires you to constantly be learning. It’s what attracted me in the first place. There is no room for stagnation in this field. The way you research things and the way you learns things is crucial to becoming a true cybersecurity professional.

All Breachlab tracks currently#

Breachlab has several tracks that are live and have been live for some time now.

Ghost#

A fundamentals course and quoting the site directly: Ghost is “Linux and shell fundamentals. Navigation, permissions, processes, encoding, network, SSH keys, port scanning, cron, git forensics, /proc. Where every operator starts.” Ghost was a phenomneal introduciton back into shell based ctfs which I have not done in a while. It was nice to shake the rust off my linux fundamentals and it’s truly what got me hooked back into ctfs. It is twenty-two levels and builds something more than just fundamentals. “Where operators are built, not taught.”

Phantom#

After completing the Ghost track, I completed the Phantom track: “Post-exploitation — the full chain. SUID, sudo, capabilities, kernel CVEs, credential harvesting, persistence, defense evasion, lateral movement, container escape, Kubernetes takeover, cloud pivot.” I will be completely honest and upfront here: I struggled with Phantom. Phantom took me roughly 117 hours where as Ghost only took me around 4. Phantom has been a struggle for a lot of users and that is by design. It’s not a track where you can google it and there’s the answer. What I learned from the Phantom track is that even though something may be hard, do the work and you will see results. If you’re currently on Phantom and you’re stuck, keep going, you’ve got this.

Specter#

Here’s a pop quiz: what is the first step in the cyber attack kill chain? If you said recon you’re absolutely correct: “Recon & initial access — how you get in. A four-part series: OSINT, network & wireless, defense evasion & disruption, and social engineering. Specter I (OSINT, 14 levels) and Specter II (network & wireless, eight levels) are live; III–IV are planned.” Instead of you already being inside of the compromised system and getting root, you’re focused more on how to get there. The best way to look at it is the 5 W’s. Who, What, When, Where, and Why. Specter will teach you how to get those answers and how to achieve initial access. Shout out to iinovacore for being the first to complete the Specter 1 track. If you think you’ve got what it takes, Specter 2 still remains unsolved.

Mirage#

If the shell isn’t your thing, maybe web application penetration testing is: “Web application exploitation, in two parts. Mirage I — the full ladder from recon to AI, 41 browser targets: client trust, broken access control, BaaS/RLS, auth & tokens, the injection family, XSS, SSRF, deserialization, GraphQL, and AI/LLM attacks. Mirage II — the advanced sequel, 12 targets: cache deception, request smuggling, parser desync, HTTP/2 downgrade, single-packet races, and deserialization RCE.” To further quote the site, “The web is the largest attack surface in the world…” The sites that are used in Mirage are not simple misconfigured Apache sites. They are admin panels, e-commerce portals, etc. The sites don’t feel fake and the flags are not easy to find.

The Defenders Track, Sentinel#

There’s two sections to this part of the post, the first is going over what the track covers and the second is how that translates to a real world SOC environment.

The what#

Sentinel is 8 Acts of blue team goodness. In the previous four tracks we ran the attacks. Here, we defend against every one of them. Knowing both sides of the fence makes you a far more well-rounded professional.

Act I#

Learn what a SIEM is, and how to use it. If you already feel lost, I would highly recommend reading this short blog post from Rapid7. It’ll help you dip your toe into the water on what I’m about to talk about. Learning how to think like a blue teamer is just as important as learning the tools that you would use. I may not use the same SIEM at company X that they use at company Y but the concepts carry over. By the end of this act, reading what the SIEM is providing to you, the real basics of blue teaming, should start to feel natural.

Act II#

Windows telemetry hunting. If you’re not aware, Microsoft commands roughly 70% of the global desktop operating system market. Chances are you’re reading this on a Windows box right now. What this act will teach you is how to protect your portion of the 70%. I will expand on this more in the how section. We’re not just reading logs anymore, we take what they tell us, chase the thread deeper, and learn how the threat actually showed up on the host.

Act III#

Network detection and phishing. One thing that this track will help you learn is that being able to sift through the data is critical to not only finding the threat but understanding how to prevent it from happening again. Being able to bring in sources like the network or a phish email will help you build your defenses and make your organization’s readiness higher. The network will tell you plenty, and you can always count on users to click on things they shouldn’t. Users keep us blue teamers employed.

Act IV#

DFIR (Digital Forensics and Incident Response): Memory and Disk. Running forensics on a potentially compromised endpoint. This section of the track focuses on finding those deeply buried compromises on endpoint machines. When a compromise happens on an endpoint we need to know where to look. Is the threat actor clearing logs to cover their tracks? Are they executing further staged malware to further own the network that you’re protecting? Understand what malware does and how it affects a system.

Act V#

Detection-as-code. We’ve moved past being the person who works the SIEM queue. We are now actively building rules so that the people who are working the queue are able to respond quicker to alerts as they pop up. Detection engineering is an awesome skill to learn and requires a very deep understanding of what you’re protecting and who you’re protecting against.

Act VI#

Threat Hunting and CTI (Cyber Threat Intelligence). We’ve moved completely away from alerts. Now we are doing true research on something that a SIEM didn’t pick up. How this works in conjunction with the last act is often Threat Hunting will pass what they find to a Detection engineer to improve the SIEM detections. Happy Hunting.

Act VII#

Cloud and Identity DR (Disaster Recovery). With the world moving everything to the cloud, this act helps you prepare for the (what used to be the future) now where AD is no longer an on-prem device but a misconfigured mess in the cloud. This act will show what a production level environment would look like and how to protect it.

Act VIII#

We’ve made it to the final act. How to combine everything that has been taught in the previous act and how to apply it in an IR (incident response) scenario. Utilize the entire SOC workflow from the alert all the way to clean up. If you’re wanting to be in blue team this is something that will happen and you need to be able to act even under pressure.

The how#

When I was first handed these tracks, the first thing that caught my eye is we aren’t staying in one job in the SOC. Each act builds on the previous just like your experience would as you worked your way up through the SOC ladder.

Tier 1 SOC Analyst (Triage Specialist)#

Act 1 starts you off like we would start off a new employee. “Here’s your workspace, here’s how it works, and here’s how you will use it.” We all need to start somewhere. Learning to use a SIEM is something that every blue teamer should start off doing because it is the foundation on how we triage and respond to real-world compromises. A lot of places will tell you that a tier 1 is just an assign or close job, but it’s more than that. You need to understand what you’re looking at. When you get into that position metrics like MTTD (Mean Time to Detection), MTTR (Mean Time to Respond/Remediate), FPR (False Positive Rate) all start at the Tier 1 analyst. You are usually the first responder, meaning those metrics are a direct reflection of the work you do. One thing that I did enjoy is that in Act 1 one of the objectives has you going a little further outside of your realm as a Tier 1 and moving into Tier 2. You are working directly with Threat Intel (CTI) and going hunting for a potential threat actor that way. What this act will show you is that not only are you the first responder, you’re also going to work with the other members of your SOC team. The last thing I’ll add about this first act and your time as a Tier 1, is that you will need to know how to write reports and Level 5 has you work a complete end-to-end intrusion from the eyes of a Tier 1 Analyst. The flag is not just a string or a hostname, it’s a full 7 field write up including: Affected Host(s), Compromised Account, Initial Access Vector, ATT&CK Techniques (Mitre), Key IOC, Root Cause, and Recommended Action. Even in the Tier 1 position, you can still have an affect on your organization’s security posture.

Tier 2 SOC Analyst (Incident Responder)#

You’ve made it to Tier 2. Here in Act 2 and 3 you are taking on more responsibility and moving up in the SOC ladder. A Tier 2 Analyst is where the fun really starts. As a Tier 2 you move away from triage and into deep-dive investigations and active containment. When a Tier 1 passes an incident to you, it is your job to do an in-depth assessment using Threat Intelligence (indicators of compromise, updated rules). One thing that no one in a SOC can escape is reading the logs. As you get higher up in the SOC ladder you’re handed less and less aggregated data and more raw attack telemetry. This could range from logon logs, to endpoints process trees, email headers, and network traffic. This is where Act 2 and Act 3 start to blend together. Combining the workflow from Tier 1 and Tier 2 you get what is known as the SOC visibility triad.

I’d argue and say that at this tier you have one of the more important jobs and that’s containment of active threats. The Sentinel track doesn’t go super in-depth into containment, forensics, and cleanup but it is something that you are expected to do at this tier.

Tier 3 SOC Analyst (Threat Hunter and Engineer)/DFIR#

Act IV is where the training stops looking like the SOC queue and starts looking like the person the queue escalates to. Tier 1 triages, Tier 2 investigates, and when something is genuinely bad — the kind of alert that makes a Tier 2 analyst go quiet and reach for the escalation button — it lands on Tier 3’s desk. That’s the seat this Act is training you for. A Tier 3 analyst is the one who gets handed a box that’s already compromised and has to answer the hard questions: what ran, when it ran, what it touched, and what the actor tried to hide on the way out. Now keep in mind that some SOCs separate DFIR into a different designation or team. That’s exactly the Act IV skill set. And here’s the part that makes it real — the interrupted-ransomware live response. When (not if) you catch a compromise mid-detonation, Tier 3 is who decides what happens next while the clock is running. You’re not writing a ticket for someone else to action tomorrow morning. You’re the last line, working a live host, and the post-mortem you produce — an ordered kill chain from initial access to whatever the actor got their hands on — is the document the whole org reads to understand what just happened to them. If Act II and III taught you to find the threat, Act IV teaches you to sit in the chair where finding it isn’t enough. You have to prove it, time it, and tell the story end to end. That’s Tier 3.

Detection Engineer#

We’re moving away from the analyst position and more towards specialized roles inside of the SOC. Act V covers detection engineering. You’ve spent time working alerts, diving into the logs, and investigating. The reports that are written by Tiers 1 through 3 will often end up in the hands of a detection engineer. I mentioned a few acronyms earlier in the part about the Tier 1 analyst: MTTD, MTTR, and FPR. One thing that helps improve those metrics is properly tuning the detection tools that we use. That’s where a detection engineer will work with the analyst team to help make the tools that are being used by that team more effective. With the ever changing landscape of cybersecurity a lot of SOCs work with open source detection rule repositories like Sigma. Speaking from experience, good detection rule writing is a f*cking art.

CTI Analyst/Threat Hunter#

The CTI Analyst differs from the Tier 3 Analyst in many ways but the main one is that instead of being reactive, they’re proactive. These threat hunters are keeping tabs on adversary techniques, TTPs, malware families, and infrastructure. Another thing that a CTI Analyst will do is collect all of the workups either from past compromises or newly found vulnerabilities and create reports to help the rest of the SOC team out. With these reports the entire SOC becomes stronger because they can get ahead of compromises instead of waiting for a SIEM alert. This aspect of working in the SOC interests me the most because you’re constantly researching and learning new threat vectors.

Cloud SOC Analyst/Cloud IR#

This role is newer and it was nice to see cloud based identity getting some recognition in this track. With a majority of corporations, governments, and militaries moving their infrastructure to the cloud, it is becoming more and more prevalent to have someone who can focus purely on the cloud aspect of the organization. This is among the newest positions that a lot of SOCs are investing in because it is often one of the main threat surfaces that attackers are going for. You no longer need on-prem access to own a network or active directory. In my experience, this is where a lot of compromises happen because of how often the cloud infrastructure is misconfigured. If I were to go back and do cybersecurity all over again, I would focus in this area because of how many companies need dedicated coverage of their cloud based infrastructure.

Incident Response Coordinator/SOC Manager#

This is the most senior position outside of the CISO (Chief Information Security Officer). This individual manages the entire SOC team and has experience in most if not all positions previously mentioned. The full breach and contain capstone is an awesome way to show the full alert to post action workflow. In the capstone you get practice as purple team. What is purple team? Red team and blue team working together would be considered purple team. Taking the proactive threat finding approach of red team and the defensive tuning of the blue team to increase the overall security of the organization.

Purple team, when in full swing, is really fun to watch because it shows both teams doing what they do best and aggregating all that data into proper policies, detection rules, infra hardening, etc.

My final thoughts#

For a free ctf platform, getting this level of practice rivals paid ctf tracks and cert workshops. Be warned, this is not a hand holding exercise like on HTB or THM, this is a full blown deep dive into SOC operations. What this track will show you is that SOC operations build off each other and the skills, tools, and methodologies you learn are used all the way from the Tier 1 slot to the SOC manager. One thing worth noting about my breakdown of the SOC jobs - SOC tiering varies between different organizations. Smaller teams may not have a dedicated detection engineer, it might just be something a few more experienced employee do. But as skills progress, that’s the ladder: reactive-triage foundations -> deeper dual-track investigations -> four specialty jobs -> incident command. I look forward to seeing everyone completing Sentinel and becoming their very own “Incident Commander.”

–paid
Let’s conquer the world.