Cybersecurity Analyst Pt 2 - SOC100 - Windows OS, Services, Registry, Scheduled Tasks, CMD

Main ideas, concepts, and lessons

1) Course logistics & community roles

• Recordings/uploads are planned for YouTube, and embedded into the course with timestamps prepared later.
• A “Community Junior SOC Analyst” pathway is introduced to build experience beyond passive watching:
  • Students apply via a form in the course.
  • The organizer reviews submissions, confirms interest, and assigns a Discord role.

2) “See once, do once, teach once” learning model

The instructor emphasizes an iterative approach:

• See once: watch and learn concepts
• Do once: practice the tasks/labs
• Teach once: help others—explaining reinforces understanding and exposes gaps

3) How to ask for help without becoming dependent

Students are encouraged to:

• Ask many questions early to learn.
• Gradually build troubleshooting independence as skills grow.

A recommended sequence before posting a direct question:

1. Rubber duck debugging: explain the problem step-by-step until the mistake becomes obvious.
2. Check the SOC 100 help forum (new at the time; expected to fill up later).
3. Post in the SOC 100 student chat with context and goals:
   • “what I’m trying to do”
   • “what I tried”
   • “what outcome I expected”
4. Encourage peer collaboration (e.g., “has anyone thought about this issue?”)

Reminder: cyber security is a team sport, but you still must learn to troubleshoot.

---

Detailed methodology / step-by-step instruction segments

A) Community Junior SOC Analyst expectations (checklist-style)

• Must be active in Discord, especially in the SOC 100 chat.
• Minimum contribution expectation:
  • Help at least once per month in Discord.
• Organizer review:
  • A monthly audit is done by reviewing usernames and message contributions.
• Role purpose:
  • Provide peer technical support on core SOC 100 topics (examples mentioned: registry, processes, network traffic analysis, etc.).
• Behavioral expectations:
  • “Be excellent to one another” and follow Discord rules.
• Resume usage:
  • Can be listed as volunteer/technical support and incident-resolution style experience, including examples like:
    • Technical support to SOC 100 students
    • Endpoint/alert triage, log analytics, endpoint analysis, incident response
    • Guided students through labs and reinforced best practices/community standards

B) Windows troubleshooting before asking for help (sequence)

1. Try rubber duck debugging:
   • Explain steps line-by-line to yourself (or a “duck/coffee/figure”).
   • Stop when you notice something behaving differently than expected.
2. Check the help forum (if available).
3. Post in SOC 100 student chat, structured clearly:
   • State the goal
   • Describe what you tried (A/B/C, etc.)
   • Describe expected vs. actual behavior
   • Ask if others have seen the same issue or tried similar steps
4. If it still can’t be resolved:
   • Continue iterating with troubleshooting and peer discussion until you can move forward.
5. Avoid dependency:
   • Don’t outsource troubleshooting indefinitely; practice handling unique scenarios yourself.

C) Windows permissions lab: how to set folder/file access (conceptual procedure)

• Use Windows GUI:
  • Right-click a folder/file → Properties → Security tab
  • View permissions by groups/usernames
  • Adjust access using deny/allow rules (examples shown):
    • Deny full control to Guest, then allow only Read & execute
    • Remove access similarly by editing/removing the entry
• Key awareness:
  • Windows permissions are grouped permission sets (e.g., modify vs. read/execute), not just simple read/write/execute.
• Understand UAC:
  • Changing permissions may trigger a UAC prompt.
• Understand inheritance:
  • Parent folder permissions apply to subfolders.
  • Risk example:
    • Adding a user at a parent can unintentionally grant access down the tree.
  • Advanced options include:
    • Disabling inheritance
    • “Removing all inherited permissions” from the object
• GUI vs command-line behavior:
  • Command-line permission changes update the system state immediately.
  • GUI panels/tabs may lag and behave like a snapshot.

D) Windows command-line permission changes (example workflow)

• Use an ICACLS-style approach (as demonstrated):
  • Grant a specific user (Guest) read access to a target folder.
• Verify using the GUI Security tab afterward.

E) Process management using Task Manager (practical approach)

• In Task Manager:
  • Switch between simplified view and More details
  • Inspect parent/child relationships
• Use Details tab to:
  • Identify processes via PID
  • Target specific processes when many are similar
• Use Task Manager to:
  • End stuck/locked tasks
  • Identify CPU/memory/network bottlenecks
• PID caution:
  • PIDs can change and may be reused.
  • Treat PID as a reference for parent/child tracking, not absolute identity.

F) Windows Services (what to use and how to interpret)

• Open Services (services.msc).
• Use columns:
  • Status (running/stopped)
  • Startup type (automatic/manual/delayed/triggered)
• Start/stop/restart via context menu.
• Use Properties to view:
  • Description
  • Executable path
  • “Log on as” (e.g., local service / network service)
  • Recovery options and dependencies (if any)
• Security mindset:
  • Services are background processes; malware may hide among them.
  • PID/service mappings can help, but PIDs aren’t guaranteed stable.

G) Scheduled Tasks lab (task creation + export/import)

1. Open Task Scheduler:
   • Start menu search or Run → taskschd.msc
2. In Task Scheduler:
   • Browse Library
   • Use Create Basic Task (demo: start a program on boot / at login)
3. Configure trigger:
   • e.g., When I log on
4. Configure action:
   • Start PowerShell (demo)
5. Determine executable path if needed:
   • Use GUI/shortcuts to find location (System32 examples)
   • Or use Task Manager → “open file location” for a running app
6. Run/test:
   • Use the Task Scheduler Run button
7. Export/import:
   • Export produces an XML task definition
   • Import allows viewing/modifying properties during prompts
8. For forensics/investigation:
   • Exported XML can reveal metadata (author, user ID, and other indicators)

H) Install/remove software lab (secure admin habits)

• Installation workflow:
  • Download via browser
  • Launch installer (admin context assumed)
  • Complete EULA and installer prompts
  • Watch for bundled/optional software (AV trials, sponsor offers) and potentially malicious add-ons
  • Check for options that change file associations or install plugins
• Update awareness:
  • Updates may change UI/behavior/layout—treat it like moving “furniture.”
• Removal workflow:
  • Uninstall via Start menu → right-click software → Uninstall
  • Or via Add/Remove Programs

I) Registry fundamentals lab (how the instructor frames it)

• Core definition:
  • Windows Registry is a database (analogy: giant Excel/Sheets with tables/rows/values).
• Key concepts:
  • Hives: top-level containers (e.g., HKCU, HKLM)
  • Keys/values: stored configuration (paths, settings, startup commands, etc.)
  • Registry stores configuration; runtime items like PIDs are ephemeral (temporary)
• Startup entries location (demonstrated):
  • Run keys, specifically:
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
• Value types mentioned:
  • String, DWORD, Binary, Multi-string (not fully taught in this session)
• Malware relevance:
  • Registry “Run” keys are a common persistence location (“starts on boot/login”).
• Practical exercise:
  • Create a Run key entry to start Notepad
  • Export the key to a .reg file
  • Delete it and verify it no longer starts
  • Observe Windows notifications when startup apps are configured
• .reg file format:
  • Includes hive path and value configuration
  • Notes double backslashes as escape characters

J) Command Prompt (CMD) basics (Windows-first experience)

• Purpose:
  • CMD is the legacy text-based interface (DOS-like).
  • Often faster than GUI for direct commands.
• CMD vs PowerShell:
  • PowerShell is more purpose-built for Windows API interaction and scripting.
  • CMD is older/leaner for basic system interactions.
• Demonstrated core skills:
  • ver (version/build info)
  • dir, cd navigation, and tab auto-completion
  • Error interpretation using error messages
  • cls to clear screen
  • Creating directories with mkdir
  • Creating text with echo and redirection (e.g., > to write testfile.txt)
  • Reading file content with type
  • File operations (rename/copy/paste as shown)
  • Process commands:
    • tasklist
    • taskkill using PID
  • Registry commands:
    • reg query
    • reg delete with flags/tags
• Emphasis:
  • Learn fundamentals now; Linux will require heavier command-line usage later.

---

Overall narrative of the session (what “Part 2” covered)

The module progression follows a foundations → security-relevant administration path:

1. Permissions (GUI security tab, UAC, inheritance risk)
2. Processes (Task Manager, PIDs, bottlenecks)
3. Services (services.msc; background execution)
4. Scheduled Tasks (automation + XML export/import)
5. Installing/removing software (admin hygiene and risks)
6. Registry (database/key-value view; startup persistence with Run keys)
7. CMD basics (navigation + file/process/registry commands)

Repeated security lens:

• “Good system administration is the bedrock of security.”
• Many persistence and troubleshooting workflows rely on these Windows components.

---

Speakers / sources featured (identified)

• Primary speaker/instructor: “K S” (often referenced as KS / CI in chat; also includes Karina as a participant)
• Co-speaker / moderator in chat: KS (also supports/moderates chat)
• Participants mentioned:
  • Karina
  • Bruno
  • Arden
  • Game Design
  • Bells
  • CI
  • Zeno
• External references:
  • No required external sources were formally cited for understanding.
  • Instructor references SS64 for CMD command documentation.
• Platform/tool references:
  • YouTube (recording destination)
  • Twitch mentioned briefly (not used)
  • Discord (community help + role system)
  • Windows components: Task Manager, Services, Task Scheduler, Registry Editor, CMD