Operations in Cyber Defence - I

Academic Project Report - M.Sc. IT IMS & CS (Integrated)
Gujarat University | Batch 2022-2023

A comprehensive study on Security Operations Center (SOC) implementation, Network Security Monitoring, and defensive cybersecurity operations with practical incident response demonstrations.

---

📋 Project Overview

Objective

This project demonstrates defensive cybersecurity operations from a Security Operations Center perspective, focusing on threat detection, investigation, and incident response using enterprise-grade NSM tools and frameworks.

Key Highlights

• ✅ SOC Implementation: Four-tier operational model (Triage → Investigation → Threat Hunting → Management).
• ✅ Network Security Monitoring: Full deployment of Security Onion with IDS/IPS, SIEM, and packet analysis.
• ✅ Threat Intelligence: Integration of MISP, CVE/CWE databases, YARA rules, and threat feeds.
• ✅ Real Incident Analysis: Complete investigation of Remcos RAT malware infection.
• ✅ Vulnerability Assessment: OpenVAS scanning with CVSS v3.1 risk scoring.
• ✅ Industry Standards: NIST frameworks, MITRE ATT&CK, OWASP best practices.

Scope

Core Problem Addressed: Human error accounts for 95% of security breaches (IBM Study). This project demonstrates detection and response capabilities to mitigate threats that bypass traditional security controls.

Focus Areas:

• Security Operations Center workflows (Tier 1-4 operations)
• Network Security Monitoring and packet analysis
• SIEM deployment and log correlation
• Threat intelligence integration and IOC management
• Vulnerability assessment and risk management
• Real-world incident investigation and response

---

🎯 Learning Outcomes

This project demonstrates proficiency in:

Technical Skills

• Network Security Monitoring: Packet capture analysis, session tracking, traffic correlation.
• SIEM Operations: Log aggregation, query development, alert correlation, dashboard creation.
• Incident Response: Alert triage, investigation workflows, IOC extraction, timeline reconstruction.
• Threat Intelligence: MISP platform, threat feeds, IOC sharing, reputation checking.
• Vulnerability Management: OpenVAS scanning, CVSS scoring, risk assessment.
• Malware Analysis: File hashing, behavioral analysis, C2 detection.
• IDS/IPS: Snort/Suricata rule development, signature tuning, false positive reduction.

Security Domains

• Defensive security operations and SOC workflows
• Network traffic analysis and anomaly detection
• Threat hunting and proactive defense
• Security information and event management (SIEM)
• Vulnerability assessment and risk management
• Incident response and forensic investigation

Professional Competencies

• Security tool deployment and configuration
• Technical documentation and incident reporting
• Risk assessment and impact analysis
• Compliance frameworks (NIST, OWASP, MITRE ATT&CK)
• Threat intelligence research and analysis

---

📚 Project Structure

Section 1: Introduction to Cybersecurity (Pages 1-18)

• Offensive vs Defensive Security
• InfoSec Color Wheel and team structure
• CIA Triad framework
• Core Security Problem: Human error analysis (skill-based vs decision-based)

Section 2: Vulnerabilities, Risks and Threat Management (Pages 19-50)

• Vulnerability Management: Lifecycle, CVSS v3.1 scoring, CVE/CWE databases
• Risk Management: NIST SP 800-30 framework, risk assessment procedures
• Threat Management: IOCs, IOAs, threat intelligence lifecycle
• Tools Implemented: OpenVAS, YARA, LOKI, MISP

Section 3: Security Operations and Monitoring (Pages 51-104)

• SOC Model: Four-tier operations (T1: Triage, T2: Investigation, T3: Hunting, T4: Management)
• Data Types: Full packet capture, session data, transaction logs, alert data, statistical analysis
• Alert Sources: Snort, Suricata, Zeek, OSSEC
• SIEM Platform: ELK Stack (Elasticsearch, Logstash, Kibana)
• Tools & Workflows: Sguil, Wireshark, NetFlow, Cisco Talos Intelligence

Section 4: Case Study - Windows Host Attack (Pages 105-123)

• Real-world investigation of Remcos RAT infection (March 19, 2019)
• Multi-tool correlation analysis
• IOC extraction and documentation
• Remediation recommendations

---

🛠️ Tools & Technologies

Security Monitoring Platform

Tool	Category	Purpose
Security Onion	NSM Platform	Integrated security monitoring suite
Snort 2.9	NIDS	Signature-based intrusion detection
Suricata	NIDS	Multi-threaded IDS with GPU support
Zeek (Bro)	NSM	Behavioral analysis and protocol parsing
OSSEC/Wazuh	HIDS	Host-based intrusion detection

SIEM & Analysis

Tool	Category	Purpose
Elasticsearch	Search Engine	Log indexing and search
Logstash	Data Pipeline	Log collection and normalization
Kibana	Visualization	Dashboards and data exploration
Sguil	Alert Console	IDS alert management and correlation
Wireshark	Packet Analysis	Deep packet inspection

Threat Intelligence

Tool	Category	Purpose
MISP	TIP	Threat information sharing platform
Cisco Talos	Threat Feed	File reputation and IOC verification
VirusTotal	File Analysis	Malware scanning and reputation
YARA	Pattern Matching	Malware signature detection
LOKI	IOC Scanner	Host-based IOC detection

Vulnerability Assessment

Tool	Category	Purpose
OpenVAS	Vulnerability Scanner	Network vulnerability discovery
GVM	Management	Greenbone Vulnerability Manager
CVSS Calculator	Risk Scoring	Vulnerability severity rating

Testing Platforms

• VMware Workstation 16 Pro: Virtualization for isolated lab
• TryHackMe: Hands-on cybersecurity training rooms
• Kali Linux 2021: Penetration testing distribution

---

🔬 Lab Setup

Architecture

┌─────────────────────────────────────────┐
│       Security Onion Server             │
│                                         │
│  ┌─────────┐  ┌─────────┐  ┌────────┐   │
│  │  Sguil  │  │ Kibana  │  │ Squert │   │
│  └─────────┘  └─────────┘  └────────┘   │
│                                         │
│  ┌──────────────────────────────────┐   │
│  │    Elasticsearch Cluster         │   │
│  └──────────────────────────────────┘   │
│                                         │
│  ┌─────┐ ┌─────────┐ ┌──────┐ ┌─────┐   │
│  │Snort│ │Suricata │ │ Zeek │ │OSSEC│   │
│  └─────┘ └─────────┘ └──────┘ └─────┘   │
└─────────────────────────────────────────┘
                  │
                  ▼
         ┌────────────────┐
         │  TAP/SPAN Port │
         └────────────────┘
                  │
                  ▼
         ┌────────────────┐
         │ Enterprise     │
         │ Network        │
         └────────────────┘

Base Requirements

Hardware/Virtualization:

CPU: 8+ cores (16+ recommended)
RAM: 16GB minimum (32GB recommended)
Storage: 500GB+ SSD (1TB+ for production)
Network: 2+ NICs (management + monitoring)

Software Stack:

Platform: Security Onion 2.x (Ubuntu 20.04)
NIDS: Snort 2.9.x, Suricata 6.x, Zeek 4.x
HIDS: OSSEC 3.x / Wazuh 4.x
SIEM: Elasticsearch 7.x, Logstash 7.x, Kibana 7.x
Analysis: Wireshark 3.x, tcpdump
Vulnerability: OpenVAS 21.x
Threat Intel: MISP 2.4.x

Network Configuration

Management Network: 192.168.1.0/24
  └─ Security Onion: 192.168.1.100

Monitored Network: 10.0.90.0/24
  └─ Windows Host: 10.0.90.215 (Bobby-Tiger-PC)
  └─ DNS Server: 10.0.90.9
  └─ Domain Controller: 10.0.90.2

Monitoring: eth1 (promiscuous mode)

---

✨ Features Implemented

1. Security Operations Center (SOC) Model

Four-Tier Operation Structure:

Tier 4: Management
  ├─ Incident coordination
  ├─ Stakeholder communication
  └─ Business impact assessment

Tier 3: Threat Hunting
  ├─ Proactive threat detection
  ├─ Advanced forensics
  └─ Hunt hypothesis testing

Tier 2: Investigation
  ├─ Alert escalation handling
  ├─ Multi-stage attack analysis
  └─ SIEM query development

Tier 1: Triage & Automation
  ├─ Real-time alert monitoring
  ├─ Known threat remediation
  └─ Automated response workflows

2. Network Security Monitoring (NSM)

Data Collection Types:

Type	Description	Retention
Full Packet Capture	Complete network conversations	7 days
Session Data	Connection metadata (5-tuple)	30 days
Transaction Logs	HTTP, DNS, SSL, SMB protocols	90 days
Alert Data	IDS/IPS signature matches	1 year
Statistical Data	Behavioral analytics	Real-time

Alert Sources:

• Snort: 50,000+ community rules (GPL, ET, VRT)
• Zeek: Behavioral detection and protocol analysis
• Suricata: Multi-threaded signature matching
• OSSEC: Host-based file integrity and log monitoring

3. SIEM Platform (ELK Stack)

Elasticsearch:

• Log indexing and search engine
• RESTful API for queries
• Distributed NoSQL architecture

Logstash:

• Data ingestion and normalization
• Multi-source log collection
• Field parsing and enrichment

Kibana:

• Real-time dashboards
• Custom visualizations
• Saved searches and filters

Sguil:

• Alert correlation console
• Event categorization
• Pivot to packet captures

4. Intrusion Detection Systems

Snort Rule Example:

alert tcp $HOME_NET any -> $EXTERNAL_NET any (
  msg:"ET TROJAN Remcos RAT Checkin"; 
  flow:established,to_server; 
  dsize:<500; 
  content:"|1b 84 d5 b0 5d f4 c4 93 c5 30 c2|"; 
  depth:11; 
  fast_pattern; 
  content:"|da b1|"; 
  distance:2; 
  within:2; 
  threshold:type limit, seconds 30, count 1, track by_src; 
  classtype:trojan-activity; 
  sid:2025637;
)

Detection Capabilities:

• Signature-based detection (Snort, Suricata)
• Behavioral analysis (Zeek)
• Protocol anomalies
• File extraction and analysis
• C2 communication detection

5. Threat Intelligence Integration

MISP Platform:

• Event tracking and IOC management
• Taxonomies: MITRE ATT&CK, TLP, PAP
• API integration with SIEM
• Automated IOC sharing

Threat Feeds:

• Cisco Talos Intelligence
• Emerging Threats ruleset
• CVE/CWE vulnerability databases
• VirusTotal file reputation
• AbuseIPDB IP reputation

6. Vulnerability Management

OpenVAS Scanning:

• Network service discovery
• Version detection and CVE mapping
• Authenticated scans
• Compliance auditing

CVSS v3.1 Scoring:

Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base Metrics:
  Attack Vector (AV): Network
  Attack Complexity (AC): Low
  Privileges Required (PR): None
  User Interaction (UI): None
  
Impact Metrics:
  Confidentiality (C): High
  Integrity (I): High
  Availability (A): High

Score Ranges:
  None:     0.0
  Low:      0.1 - 3.9
  Medium:   4.0 - 6.9
  High:     7.0 - 8.9
  Critical: 9.0 - 10.0

7. YARA Rule Development

Custom Malware Detection:

rule RemcosRAT_Pattern {
    meta:
        description = "Detects Remcos RAT binary patterns"
        author = "SOC Analyst"
        date = "2019-03-19"
        
    strings:
        $hex1 = { 1b 84 d5 b0 5d f4 c4 93 c5 30 c2 }
        $hex2 = { da b1 }
        $string1 = "Remcos" nocase
        $string2 = "remcos_pro" nocase
        
    condition:
        (uint16(0) == 0x5A4D) and  // MZ header
        filesize < 2MB and
        all of ($hex*) or any of ($string*)
}

Integration:

• LOKI IOC scanner for host scanning
• Valhalla rule feed for latest signatures
• Custom rules for organization-specific threats

---

🔄 Process Flow

Incident Investigation Workflow

1. Alert Generation
   ├─ Snort/Suricata: Signature match
   ├─ Zeek: Behavioral anomaly
   └─ OSSEC: Host activity alert
         ↓
2. Triage (Tier 1)
   ├─ Review in Sguil console
   ├─ Check alert count/correlation
   ├─ Validate: False positive?
   └─ Decision: Escalate or close
         ↓
3. Investigation (Tier 2)
   ├─ Pivot to Wireshark (packets)
   ├─ Query Kibana (logs)
   ├─ Extract IOCs (IPs, hashes, domains)
   ├─ Check reputation (Talos, VT)
   └─ Build attack timeline
         ↓
4. Analysis (Tier 3)
   ├─ Identify malware family
   ├─ Map to MITRE ATT&CK
   ├─ Assess impact/scope
   └─ Document findings
         ↓
5. Response & Remediation
   ├─ Isolate affected systems
   ├─ Update IDS rules
   ├─ Share IOCs via MISP
   └─ Create incident report

Data Pipeline

Network Traffic
       ↓
TAP/SPAN Port
       ↓
Security Onion Sensor
   ├─ Snort/Suricata → IDS Alerts
   ├─ Zeek → Session/Transaction Logs
   ├─ tcpdump → Full Packet Capture
   └─ OSSEC → Host Logs
       ↓
Logstash (Normalization)
       ↓
Elasticsearch (Storage/Indexing)
       ↓
Kibana / Sguil (Analysis & Visualization)

---

📊 Practical Demonstrations

Case Study: Remcos RAT Investigation

Incident Timeline - March 19, 2019

01:45:03 - Initial Compromise
  └─ HTTP GET to 209.141.34.8
  └─ Download: test1.exe (disguised as image)
  └─ SHA256: [documented in report]

01:45:15 - Malware Execution
  └─ File: Win32 Trojan Agent (Remcos RAT)
  └─ C2 communication on port 2404
  └─ Encrypted traffic (RC4)

01:47:15 - Secondary Payload
  └─ HTTP GET to 217.23.14.81
  └─ Download: F4.exe
  └─ Identified: Win.Dropper.Cridex

01:48:00 - Data Exfiltration
  └─ Keylogger activity detected
  └─ Outbound to C2 servers:
      • 190.146.112.216
      • 31.22.4.176
      • 115.112.43.81

02:15:00 - Lateral Movement Attempt
  └─ EternalBlue SMB exploit probes
  └─ Target: Domain Controller (10.0.90.2)

Investigation Tools:

Tool	Purpose	Findings
Sguil	Alert correlation	12 related alerts, CNT=8
Wireshark	Packet analysis	Extracted test1.exe and F4.exe
Kibana	Log visualization	HTTP requests, DNS queries
Cisco Talos	File reputation	Confirmed malware hashes
Zeek	Transaction logs	File details, HTTP metadata

IOCs Extracted:

Malicious Files:
  • test1.exe - SHA256: [hash]
  • F4.exe - SHA256: [hash]

C2 Infrastructure:
  • 209.141.34.8:80
  • 217.23.14.81:80
  • 190.146.112.216:2404
  • 31.22.4.176:443
  • 115.112.43.81:443

Domains:
  • toptoptop1[.]online (flagged by VirusTotal)

Network Indicators:
  • Non-standard C2 port: 2404
  • Encrypted traffic patterns
  • SMB exploit attempts (EternalBlue)

Remediation Actions:

1. ✅ Isolated infected host (10.0.90.215) from network
2. ✅ Blocked C2 IPs at firewall
3. ✅ Deployed Snort rule for Remcos detection
4. ✅ Updated malware signatures in AV
5. ✅ Shared IOCs via MISP
6. ✅ Conducted full network sweep for lateral movement

---

🎓 Key Methodologies

NIST Cybersecurity Framework

This project follows the NIST CSF five-function structure:

1. Identify
   └─ Asset management, risk assessment

2. Protect
   └─ Access controls, security policies

3. Detect
   └─ IDS/IPS, SIEM, anomaly detection

4. Respond
   └─ Incident response, mitigation

5. Recover
   └─ Recovery planning, lessons learned

MITRE ATT&CK Mapping

Techniques Observed in Case Study:

Tactic	Technique	ID
Initial Access	Drive-by Compromise	T1189
Execution	User Execution	T1204
Persistence	Registry Run Keys	T1547
Defense Evasion	Obfuscated Files	T1027
Credential Access	Input Capture (Keylogging)	T1056
Discovery	System Information Discovery	T1082
Lateral Movement	Exploitation of Remote Services	T1210
Collection	Automated Collection	T1119
Command and Control	Standard Non-Application Port	T1571
Exfiltration	Exfiltration Over C2 Channel	T1041

Ethical Hacking Principles

• Authorized Testing: All demonstrations in controlled lab (TryHackMe, Security Onion)
• No Harm: Purpose-built vulnerable environments only
• Responsible Disclosure: Focus on defense and remediation
• Educational Purpose: Academic research and learning

---

📖 References

Official Documentation

• NIST Special Publication 800-30 (Risk Assessment)
• NIST Special Publication 800-150 (Threat Information Sharing)
• CVSS v3.1 Specification
• MITRE ATT&CK Framework
• OWASP Top 10

Tool Documentation

• Security Onion: https://securityonion.net/
• Elasticsearch: https://www.elastic.co/
• Snort: https://www.snort.org/
• Zeek: https://zeek.org/
• MISP: https://www.misp-project.org/
• OpenVAS: https://www.openvas.org/

Threat Intelligence

• Cisco Talos Intelligence: https://talosintelligence.com/
• VirusTotal: https://www.virustotal.com/
• CVE Database: https://cve.mitre.org/
• CWE Database: https://cwe.mitre.org/
• Exploit Database: https://www.exploit-db.com/

Training Platforms

• TryHackMe: https://tryhackme.com/
• Cisco NetAcad: https://netacad.com/

Books & Publications

• Cisco Cyber Operations Documentation
• Red Team Journals
• Ethical Hacking and Countermeasures v11
• NIST Cybersecurity Publications

---

📝 Developer Notes

Project Context

This is an academic research project completed for the M.Sc. IT IMS & CS program at Gujarat University. The study demonstrates defensive security operations through controlled lab environments.

Academic Details:

• Institution: Gujarat University
• Program: M.Sc. IT IMS & CS (Integrated) - Semester 7
• Mentor: Prof. Nirali Chavda
• Submission: December 31, 2022

Ethical & Legal Considerations

✅ Authorized Testing: All demonstrations conducted in isolated lab environments
✅ No Unauthorized Access: Testing performed on TryHackMe rooms and personal VMs
✅ Educational Purpose: Focus on defensive security and incident response
✅ Responsible Research: No exploitation of production systems

Limitations

• Lab environment may not reflect enterprise-scale SOC operations
• Limited threat hunting dataset (based on publicly available samples)
• Tool versions reflect 2022 deployment (may have updates)
• Case study uses documented malware from TryHackMe exercises

---

👤 Developed and Maintained By

Derick Dmello
M.Sc. IT IMS & CS (Integrated)
Gujarat University

Connect:

• GitHub: @mello-io
• LinkedIn: dmelloderick

---

About

A comprehensive academic project demonstrating Security Operations Center implementation, Network Security Monitoring, and defensive cybersecurity operations with real-world incident response.

License

This academic project report is submitted for educational purposes as part of the M.Sc. IT IMS & CS program at Gujarat University.

Copyright © 2026 Derick Dmello. All rights reserved.

---

Keywords: Cybersecurity SOC Security-Operations Network-Security-Monitoring Incident-Response SIEM ELK-Stack Threat-Intelligence IDS-IPS Malware-Analysis Vulnerability-Management Security-Onion Snort Zeek MISP YARA OpenVAS CVSS NIST MITRE-ATTACK