Event Log Cleared Alert on Legit PowerShell Binary — False Positive Triage | LetsDefend Alert Triage

Day 64 of Becoming a SOC Analyst — SOC130 Event Log Cleared (False Positive)
Exchange Server at 172.16.20.3 triggered a high-concern alert when powershell.exe (hash 7353f60b1739074eb17c5f4dddefe239) was detected — a hash that maps directly to a legitimate Microsoft PowerShell binary. No wevtutil.exe, no Clear-EventLog commands, no suspicious scripts, no malicious child processes — nothing to actually support the event log clearing hypothesis. The detection rule fired on PowerShell presence alone without any corroborating evidence of log tampering. Good example of why hash verification and command-line analysis matter before escalating — the alert name was alarming, the evidence wasn't. Walked through the full triage: hash verification, process activity review, log clearing command hunting, and classifying as false positive.

SOC130 - Event Log Cleared
Scenario sourced from LetsDefend.io — one of the best hands-on SOC analyst training platforms out there.
Highly recommend if you're on the same path. I'm documenting every day of my journey to landing a Level 1 SOC Analyst role — the wins, the grinds, and everything in between.

00:00 Day 64 intro
00:19 Alert Details
00:58 Investigation
03:19 Playbook Answers
04:48 5w Log
08:14 Result

🔵 What I Cover
Threat Detection · Alert Triage · SIEM Analysis · Log Analysis · Incident Response · Blue Team Tools
🚨 Open to Work — Seeking a Level 1 SOC Analyst role in Melbourne or Remote (AU)
📂 Portfolio → inksec.io
💼 LinkedIn → linkedin.com/in/tate-pannam-8b64b23a3
If you chose the red pill... 0x74617465.sh
#SOCAnalyst #BlueTeam #Cybersecurity #EventLogCleared #PowerShell #FalsePositive #AlertTriage #IncidentResponse #SIEM #Day64 #CyberSecurityJourney #Melbourne #LetsDefend #LetsDefendSOC #ThreatHunting #InfoSec #BlueTeamSecurity

Видео Event Log Cleared Alert on Legit PowerShell Binary — False Positive Triage | LetsDefend Alert Triage канала InkSec

Комментарии отсутствуют

Информация о видео

14 марта 2026 г. 2:45:00

00:09:36

InkSec

Правообладателям

Жалоба на материал Недопустимый материал Нарушение авторских прав

Комментарии

Другие видео канала

Event Log Cleared Alert on Legit PowerShell Binary — False Positive Triage | LetsDefend Alert Triage

sudo CVE-2025-32463 — chroot Privilege Escalation Confirmed on Linux Host | LetsDefend Alert SOC341

Wscript.exe LOLBin Executes VBS Dropper — C2 Comms on Non-Standard Port | LetsDefend Alert Triage

QBot Malware Memory Forensics — Tracing a Banking Trojan from Excel Macro to C2 | CyberDefenders Lab

Day 45 of Becoming a SOC Analyst | MSHTA Abused to Download Remote Payload — LOLBin Staging Attack

Obfuscated PowerShell Downloads Remote Script In-Memory — Fileless Malware | LetsDefend SOC102

SOC257 Investigation | VPN Login from Unauthorized Country (True Positive) | LetsDefend SOC

SQL Injection Attack Detected (Exploit Public-Facing App) | LetsDefend SOC Investigation

SOC Malware Analysis – Malicious DOC Dropper Investigation (LetsDefend Malware Challenge)

SOC Web Attack Challenge – Deep Log Analysis Walkthrough (LetsDefend)

LetsDefend ANY.RUN Question – Which File Is Malicious? (Sandbox Analysis Explained)

Phishing Reset Link Leads to Credential Theft | Let’s Defend SOC275 Investigation

SOC176 RDP Brute Force Detected (EventID 234) | Confirmed Compromise | LetsDefend SOC

CRITICAL Lumma Stealer Infection | ClickFix Phishing → DLL Side-Loading (SOC338 LetsDefend)

TryHackMe Night Shift Task 8 Walkthrough SOC Analyst Ransomware and Cloud Investigation

SQL Injection Alert on Authorized Pentest Activity — False Positive Triage | LetsDefend Alert Triage

Windows Defender Evasion — Brute Force Entry, Rundll32 LOLBin PoC | LetsDefend SOC321

SOC Investigation – Malicious Attachment Detected (Phishing Alert) (LetsDefend SOC114)

SOC101 Phishing Mail Detected — Emotet Macro Dropper via Fake UPS Notification | LetsDefend Alert

CRITICAL PAN-OS Exploited | CVE-2024-3400 Command Injection (LetsDefend SOC274)

Phishing Email — Emotet Attachment Blocked, C2 Infrastructure Identified | LetsDefend Alert Triage

Cryptojacking Alert on a bit.ly Shortened URL — Rickrolled by a False Positive | LetsDefend Alert