SOC Attack Simulations

This repository contains cybersecurity attack simulations and incident analysis reports created as part of my SOC (Security Operations Center) learning and research.

The goal of this repository is to simulate real-world cyber attacks and document how they are detected, investigated, and mitigated using SOC monitoring techniques.

Objectives

• Simulate common cyber attacks in a controlled lab environment
• Analyze system and network logs
• Develop detection rules for suspicious activity
• Document investigation methodology used in SOC environments

Lab Environment

The simulations were performed using a virtual security lab.

Tools used:

• Kali Linux (Attacker machine)
• Linux / Windows Server (Target systems)
• Wazuh SIEM
• PostgreSQL
• Python

Attack Simulations

This repository currently contains the following incident analysis reports:

Brute Force Attack Detection

Simulation of SSH brute force login attempts and detection using log correlation.

Port Scan Detection

Detection of network scanning activity using log analysis.

Suspicious Login Investigation

Analysis of abnormal authentication activity detected through security logs.

Each report includes:

• Attack simulation details
• Logs generated during the attack
• Detection methods
• Indicators of compromise
• Mitigation strategies

Repository Structure

soc-attack-simulations
│
├── README.md
└── attack-reports
      ├── brute-force-detection.md
      ├── port-scan-detection.md
      └── suspicious-login-analysis.md

Skills Demonstrated

• Security event monitoring
• Log analysis
• Threat detection
• Incident investigation
• Detection rule development

Portfolio

My cybersecurity portfolio:

https://yoonas18.github.io/portfolio

Author

Yoonus KY Cybersecurity Researcher | SOC Analyst

GitHub: https://github.com/Yoonas18 LinkedIn: https://linkedin.com/in/yoonusky Email: Yoonasy703@gmail.com