🛡️SOC-200

The certification associated with this course is the OffSec Defense Analyst (OSDA).

Hack Responsibly.

Always ensure you have explicit permission to access any computer system before using any of the techniques contained in these documents. You accept full responsibility for your actions by applying any knowledge gained here.

These will be the notes I felt were worth writing down as things I was not completely familiar with and/or were new to me at the time of working through this course.

Some sections may be empty due to nothing being worth noting IMO.

Table of Contents

SOC-200 - Modules
Module 1: Introduction to SOC-200
Module 2: Attacker Methodology Introduction
Module 3: Windows Endpoint Introduction
Module 4: Windows Server Side Attacks
Module 5: Windows Client-Side Attacks
Module 6: Windows Privilege Escalation
Module 7: Windows Persistence
Module 8: Linux Endpoint Introduction
Module 9: Linux Server Side Attacks
Module 10: Linux Privilege Escalation
Module 11: Network Detections
Module 12: Antivirus Alerts and Evasion
Module 13: Active Directory Enumeration
Module 14: Network Evasion and Tunneling
Module 15: Windows Lateral Movement
Module 16: Active Directory Persistence
Module 17: SIEM Part One: Intro to ELK
Module 18: SIEM Part Two: Combining the Logs
Module 19: Trying Harder: The Labs

Documentation Templates

Templates provided via the OSDA Exam Guide

Submission Checklist:

• Your exam report is in PDF format

• You have used the following format for the PDF file name "OSDA-OS-XXXXX-Exam-Report.pdf", where "OS-XXXXX" is your OSID

• Your PDF has been archived into a .7z file (Please do NOT archive it with a password)

• You have used the following format for the .7z file name "OSDA-OS-XXXXX-Exam-Report.7z", where "OS-XXXXX" is your OSID

• You have made sure that your archive is not more than 200MB

• You have uploaded your .7z file to https://upload.offsec.com

4MB

OSDA-Exam-Report.docx

Open

Microsoft Word format

4MB

OSDA-Exam-Report.odt

Open

OpenOffice/LibreOffice format