SOC Write-ups
Case notes and investigations from SOC analyst practice scenarios.
-
SOC336 - Windows OLE Zero-Click RCE Exploitation Detected (CVE-2025-21298)
Detection and investigation of a confirmed Windows OLE zero-click RCE exploitation via a malicious RTF email. OUTLOOK.EXE spawned cmd.exe which executed regsvr32.exe to retrieve a remote payload from a C2 server. The proxy permitted the outbound request. Host was isolated and escalated to L2.
May 16, 2026 Critical LetsDefend SOC - Endpoint & Proxy Logs (172.16.17.137) · SOC336
#cve-2025-21298#windows-ole#zero-click#rce#regsvr32#phishing#c2 -
RDP Brute Force Attack on WIN-SERVER - Triage #001
Detection and investigation of an automated RDP brute force attack targeting the Administrator account on WIN-SERVER, originating from an internal Kali Linux machine.
Apr 19, 2026 Medium Wazuh SIEM - Agent WIN-SERVER (192.168.10.102) · INC-2026-0001
#brute-force#rdp#windows-authentication#lateral-movement