Completed Case Study
SOC Triage: Suspicious Download Investigation
A suspicious file triage scenario focused on documenting host details, user activity, file indicators, execution risk, and recommended follow-up checks.
Alert Review • IOC Capture • Escalation
Objective
Practice SOC-style triage by reviewing a suspicious double-extension file and deciding what evidence should be documented or escalated.
Work performed
Captured host/user context, suspicious file details, URL/domain indicators, hash value, execution status, severity reasoning, and recommended persistence and network checks.
Skills demonstrated
Alert triage, IOC review, severity assessment, endpoint investigation thinking, documentation, and escalation communication.
Outcome
Built repeatable habits for confirming evidence before assigning severity or recommending containment actions.