https://hoangtan09-afk.github.io/Tan Ho Hoang 2026-11-02T06:56:57+00:00 Ho Hoang Tan https://hoangtan09-afk.github.io/ Jekyll © 2026 Ho Hoang Tan /assets/img/favicons/favicon.ico /assets/img/favicons/favicon-96x96.png Boss of the SOC Version 1 (2015) - Ransomware2026-09-30T00:00:00+00:00 2026-09-30T00:00:00+00:00 https://hoangtan09-afk.github.io/posts/boss-of-the-soc-ransomware/ Ho Hoang Tan After the excitement of yesterday, Alice has started to settle into her new job. Sadly, she realizes her new colleagues may not be the crack cybersecurity team that she was led to believe before she joined. Looking through her incident ticketing queue she notices a “critical” ticket that was never addressed. Shaking her head, she begins to investigate. Apparently on August 24th Bob Smith (using... Andromeda Bot2026-09-10T00:00:00+00:00 2026-10-01T08:46:52+00:00 https://hoangtan09-afk.github.io/posts/Andromeda-Bot/ Ho Hoang Tan Phân tích bản sao bộ nhớ và logs bằng MemProcFS, EvtxECmd, và Timeline Explorer để xác định các IOC của Andromeda Bot, dựng lại chuỗi thời gian bị nhiễm, và liên kết các thuộc tính đó đến nhóm APT. Scenario As a member of the DFIR team at SecuTech, you’re tasked with investigating a security breach affecting multiple endpoints across the organization. Alerts from different systems suggest t... Phishing Report Guidance2026-08-26T00:00:00+00:00 2026-08-26T00:00:00+00:00 https://hoangtan09-afk.github.io/posts/Phishing-Report/ Ho Hoang Tan Scenario You have recently joined the security team at ABC Industries as a Junior SOC analyst within their security operations center (SOC). You are responsible for monitoring the SIEM platform, investigating and responding to security events, and protecting the organization from phishing attacks. You have just begun your shift, and in a new effort to proactively identify phishing emails that ... Network Analysis – Ransomware Incident Report2026-07-23T00:00:00+00:00 2026-07-28T00:56:50+00:00 https://hoangtan09-afk.github.io/posts/Network-Analysis-Ransomware/ Ho Hoang Tan 1. Executive Summary This report presents the findings of a network security incident investigation involving Ransomware at ABC Industries. The incident originated when a Windows 7 workstation downloaded and executed a malicious file. As a result, critical corporate bidding documents (in PDF format) were encrypted. Through Network Traffic Analysis (PCAP) and Static Analysis, the analysis team... Network Analysis – Malware Compromise2026-07-23T00:00:00+00:00 2026-07-26T09:03:53+00:00 https://hoangtan09-afk.github.io/posts/Network-Analysis/ Ho Hoang Tan Scenario A SOC Analyst at Umbrella Corporation is going through SIEM alerts and sees an alert for connections to a known malicious domain. The traffic is coming from Sara’s computer, an accountant who receives a large volume of emails from customers every day. Looking at the email gateway logs for Sara’s mailbox, there is nothing immediately suspicious, as the emails appear to be coming from c...