InkSec

@UCoqepcwSKzfjZvFi1UDOsSA - 112 subscribers

Hands-on SOC-style security investigations and cyber security case studies. This channel focuses on practical analysis of real-world alerts, including phishing investigations, malware detonation, endpoint telemetry review, and network traffic analysis. Content is presented in a live analyst-style format, with clear end-of-video summaries covering findings, impact, and defensive actions. This content is created for educational and defensive security purposes only.

Home Videos Live Playlists

QBot Malware Memory Forensics — Tracing a Banking Trojan from Excel Macro to C2 | CyberDefenders Lab

QBot Malware Memory Forensics — Tracing a Banking Trojan from Excel Macro to C2 | CyberDefenders Lab InkSec

2 views - 9 hours ago

sudo CVE-2025-32463 — chroot Privilege Escalation Confirmed on Linux Host | LetsDefend Alert SOC341

sudo CVE-2025-32463 — chroot Privilege Escalation Confirmed on Linux Host | LetsDefend Alert SOC341 InkSec

9 views - 20 hours ago

WinRAR Zero-Day CVE-2025-8088 — Malicious DLL + Registry Persistence Confirmed | LetsDefend SOC343

WinRAR Zero-Day CVE-2025-8088 — Malicious DLL + Registry Persistence Confirmed | LetsDefend SOC343 InkSec

9 views - 1 day ago

Phishing Email — Emotet Attachment Blocked, C2 Infrastructure Identified | LetsDefend Alert Triage

Phishing Email — Emotet Attachment Blocked, C2 Infrastructure Identified | LetsDefend Alert Triage InkSec

7 views - 2 days ago

I Passed BTL1 — No Learning Path, Just Labs

I Passed BTL1 — No Learning Path, Just Labs InkSec

43 views - 3 days ago

Suspicious File (TI Match) — Legit Chrome Installer Clears on VT & Sandbox | LetsDefend Alert Triage

Suspicious File (TI Match) — Legit Chrome Installer Clears on VT & Sandbox | LetsDefend Alert Triage InkSec

1 views - 3 days ago

Phishing Email — Cobalt Strike Attachment Blocked Before Execution | LetsDefend Alert Triage

Phishing Email — Cobalt Strike Attachment Blocked Before Execution | LetsDefend Alert Triage InkSec

10 views - 4 days ago

SOC107 Privilege Escalation Detected — Linux Privesc Tool Delivered via Phishing | LetsDefend Alert

SOC107 Privilege Escalation Detected — Linux Privesc Tool Delivered via Phishing | LetsDefend Alert InkSec

11 views - 5 days ago

SOC104 Malware Detected — Malicious Word Doc with Active C2 Connections | LetsDefend Alert Triage

SOC104 Malware Detected — Malicious Word Doc with Active C2 Connections | LetsDefend Alert Triage InkSec

7 views - 6 days ago

SOC113 Suspicious hh.exe Usage — LOLBIN Alert on Legitimate WinRAR Help File | LetsDefend Alert

SOC113 Suspicious hh.exe Usage — LOLBIN Alert on Legitimate WinRAR Help File | LetsDefend Alert InkSec

7 views - 1 week ago

SOC101 Phishing Mail Detected — Emotet Macro Dropper via Fake UPS Notification | LetsDefend Alert

SOC101 Phishing Mail Detected — Emotet Macro Dropper via Fake UPS Notification | LetsDefend Alert InkSec

17 views - 1 week ago

SOC101 Phishing Mail Detected — PowerShell Dropper via Fake Credit Card Statement | LetsDefend Alert

SOC101 Phishing Mail Detected — PowerShell Dropper via Fake Credit Card Statement | LetsDefend Alert InkSec

10 views - 1 week ago

SOC102 Proxy Suspicious URL Detected — Malicious Executable Download Blocked | LetsDefend Alert

SOC102 Proxy Suspicious URL Detected — Malicious Executable Download Blocked | LetsDefend Alert InkSec

6 views - 1 week ago

Malicious Executable Download Attempt Blocked — User Click Confirmed | LetsDefend SOC121

Malicious Executable Download Attempt Blocked — User Click Confirmed | LetsDefend SOC121 InkSec

13 views - 1 week ago

Same Malicious Batch File Found Across Multiple Endpoints — Reverse Shell | LetsDefend SOC132

Same Malicious Batch File Found Across Multiple Endpoints — Reverse Shell | LetsDefend SOC132 InkSec

12 views - 1 week ago

Malicious Purchase Order EXE Establishes C2 Over Port 587 — Active Compromise | LetsDefend SOC104

Malicious Purchase Order EXE Establishes C2 Over Port 587 — Active Compromise | LetsDefend SOC104 InkSec

12 views - 1 week ago

Suspicious URL Alert on a Google Static Image — False Positive Triage | LetsDefend SOC102

Suspicious URL Alert on a Google Static Image — False Positive Triage | LetsDefend SOC102 InkSec

30 views - 2 weeks ago

LinEnum Post-Exploitation Enumeration Tool Downloaded & Executed — True Positive | LetsDefend SOC123

LinEnum Post-Exploitation Enumeration Tool Downloaded & Executed — True Positive | LetsDefend SOC123 InkSec

33 views - 2 weeks ago

Obfuscated PowerShell Downloads Remote Script In-Memory — Fileless Malware | LetsDefend SOC102

Obfuscated PowerShell Downloads Remote Script In-Memory — Fileless Malware | LetsDefend SOC102 InkSec

47 views - 2 weeks ago

Emotet Malware Detected — Malicious Doc Triggers C2 Connections & PowerShell Staging | LetsDefend

Emotet Malware Detected — Malicious Doc Triggers C2 Connections & PowerShell Staging | LetsDefend InkSec

25 views - 2 weeks ago

Suspicious New Domain Alert — Registered One Day Ago but No Malicious Indicators | LetsDefend Alert

Suspicious New Domain Alert — Registered One Day Ago but No Malicious Indicators | LetsDefend Alert InkSec

14 views - 2 weeks ago

Cryptojacking Alert on a bit.ly Shortened URL — Rickrolled by a False Positive | LetsDefend Alert

Cryptojacking Alert on a bit.ly Shortened URL — Rickrolled by a False Positive | LetsDefend Alert InkSec

8 views - 2 weeks ago

Wscript.exe LOLBin Executes VBS Dropper — C2 Comms on Non-Standard Port | LetsDefend Alert Triage

Wscript.exe LOLBin Executes VBS Dropper — C2 Comms on Non-Standard Port | LetsDefend Alert Triage InkSec

44 views - 2 weeks ago

Traffic to Malware Domain Blocked — But PowerShell Is Still Active on the Endpoint LetsDefend Alert

Traffic to Malware Domain Blocked — But PowerShell Is Still Active on the Endpoint LetsDefend Alert InkSec

36 views - 2 weeks ago

Blacklisted IP Downloads Malware — PowerShell Second Stage Attempted | LetsDefend Alert Triage

Blacklisted IP Downloads Malware — PowerShell Second Stage Attempted | LetsDefend Alert Triage InkSec

10 views - 3 weeks ago

Traffic to Malware Domain from Malicious Attachment — C2 Payload Download Confirmed | LetsDefend

Traffic to Malware Domain from Malicious Attachment — C2 Payload Download Confirmed | LetsDefend InkSec

13 views - 3 weeks ago

JuicyPotato Privilege Escalation via Malicious Excel Doc — Full Infection Chain | LetsDefend Alert

JuicyPotato Privilege Escalation via Malicious Excel Doc — Full Infection Chain | LetsDefend Alert InkSec

47 views - 3 weeks ago

FTP Brute Force Attack Using Default Credentials — No Successful Login | LetsDefend Alert Triage

FTP Brute Force Attack Using Default Credentials — No Successful Login | LetsDefend Alert Triage InkSec

20 views - 3 weeks ago

Malicious Executable Alert on BloodHound AD Download — False Positive | LetsDefend Alert Triage

Malicious Executable Alert on BloodHound AD Download — False Positive | LetsDefend Alert Triage InkSec

8 views - 3 weeks ago

DNS Hijacking via Hosts File — github.com Redirected to Attacker IP | LetsDefend Alert Triage

DNS Hijacking via Hosts File — github.com Redirected to Attacker IP | LetsDefend Alert Triage InkSec

73 views - 3 weeks ago

Scheduled Task Persistence Alert GoogleUpdate.exe — False Positive Triage | LetsDefend Alert Triage

Scheduled Task Persistence Alert GoogleUpdate.exe — False Positive Triage | LetsDefend Alert Triage InkSec

6 views - 3 weeks ago

Remote Access Software Alert on Legitimate TeamViewer Traffic — False Positive Triage | LetsDefend

Remote Access Software Alert on Legitimate TeamViewer Traffic — False Positive Triage | LetsDefend InkSec

15 views - 4 weeks ago

User Clicked, Endpoint at Risk | LetsDefend Alert Triage

User Clicked, Endpoint at Risk | LetsDefend Alert Triage InkSec

31 views - 4 weeks ago

SQL Injection Alert on Authorized Pentest Activity — False Positive Triage | LetsDefend Alert Triage

SQL Injection Alert on Authorized Pentest Activity — False Positive Triage | LetsDefend Alert Triage InkSec

17 views - 4 weeks ago

Confluence Zero-Day CVE-2023-22515 — Unauthorized Admin Account Created | LetsDefend Alert Triage

Confluence Zero-Day CVE-2023-22515 — Unauthorized Admin Account Created | LetsDefend Alert Triage InkSec

6 views - 1 month ago

Suspicious Rundll32 Activity — Emotet Phishing Infection Chain | LetsDefend Alert Triage

Suspicious Rundll32 Activity — Emotet Phishing Infection Chain | LetsDefend Alert Triage InkSec

12 views - 1 month ago

PowerShell IEX Download Cradle Executes Remote Trojan — C2 Confirmed | LetsDefend Alert Triage

PowerShell IEX Download Cradle Executes Remote Trojan — C2 Confirmed | LetsDefend Alert Triage InkSec

16 views - 1 month ago

Malicious Autorun Persistence Attempt Detected — Windows EXE on Linux Host | LetsDefend Alert Triage

Malicious Autorun Persistence Attempt Detected — Windows EXE on Linux Host | LetsDefend Alert Triage InkSec

35 views - 1 month ago

Mailbox Forwarding Credential Leak to External Yandex Address — Blocked | LetsDefend Alert Triage

Mailbox Forwarding Credential Leak to External Yandex Address — Blocked | LetsDefend Alert Triage InkSec

5 views - 1 month ago

Splunk It — Phishing to AD Takeover via DCSync | BTLO Lab

Splunk It — Phishing to AD Takeover via DCSync | BTLO Lab InkSec

69 views - 1 month ago

PHP Web Shell Uploaded & Executed — Full Command Access Confirmed | LetsDefend Alert Triage

PHP Web Shell Uploaded & Executed — Full Command Access Confirmed | LetsDefend Alert Triage InkSec

12 views - 1 month ago

Local File Inclusion Attempt via Directory Traversal — Attack Failed | LetsDefend Alert Triage

Local File Inclusion Attempt via Directory Traversal — Attack Failed | LetsDefend Alert Triage InkSec

11 views - 1 month ago

Event Log Cleared Alert on Legit PowerShell Binary — False Positive Triage | LetsDefend Alert Triage

Event Log Cleared Alert on Legit PowerShell Binary — False Positive Triage | LetsDefend Alert Triage InkSec

5 views - 1 month ago

Apache Tomcat Takeover — WAR File RCE & Cron Persistence | CyberDefenders Network Forensics

Apache Tomcat Takeover — WAR File RCE & Cron Persistence | CyberDefenders Network Forensics InkSec

17 views - 1 month ago

SSH Scan Alert on Internal Pentest Activity — False Positive Triage | LetsDefend Alert Triage

SSH Scan Alert on Internal Pentest Activity — False Positive Triage | LetsDefend Alert Triage InkSec

8 views - 1 month ago

Suspicious URL Alert on a Cybersecurity News Site — False Positive Triage | LetsDefend Alert Triage

Suspicious URL Alert on a Cybersecurity News Site — False Positive Triage | LetsDefend Alert Triage InkSec

10 views - 1 month ago

Cobalt Strike Shellcode Detected — Active C2 Confirmed & Host Isolated | LetsDefend Alert Triage

Cobalt Strike Shellcode Detected — Active C2 Confirmed & Host Isolated | LetsDefend Alert Triage InkSec

33 views - 1 month ago

Reverse TCP Backdoor via Python — Caught & Cleaned Before Execution | LetsDefend Alert Triage

Reverse TCP Backdoor via Python — Caught & Cleaned Before Execution | LetsDefend Alert Triage InkSec

23 views - 1 month ago

Day 57 of Becoming a SOC Analyst | Impacket WMI Abuse — Credentials Exfiltrated Over Port 4444

Day 57 of Becoming a SOC Analyst | Impacket WMI Abuse — Credentials Exfiltrated Over Port 4444 InkSec

38 views - 1 month ago

Day 56 of Becoming a SOC Analyst | FakeGPT Chrome Extension Steals Facebook Session Cookies

Day 56 of Becoming a SOC Analyst | FakeGPT Chrome Extension Steals Facebook Session Cookies InkSec

17 views - 1 month ago

Brute Force to Admin Takeover — Weak Creds Confirmed | LetsDefend Alert Triage

Brute Force to Admin Takeover — Weak Creds Confirmed | LetsDefend Alert Triage InkSec

5 views - 1 month ago

Day 55 of Becoming a SOC Analyst | SQL Injection to Web Shell to Reverse Shell Full Chain Compromise

Day 55 of Becoming a SOC Analyst | SQL Injection to Web Shell to Reverse Shell Full Chain Compromise InkSec

19 views - 1 month ago

Day 54 of Becoming a SOC Analyst | Certutil.exe LOLBin Abuse — Nmap & Exploit Suggester Downloaded

Day 54 of Becoming a SOC Analyst | Certutil.exe LOLBin Abuse — Nmap & Exploit Suggester Downloaded InkSec

21 views - 1 month ago

Day 53 of Becoming a SOC Analyst | Suspicious WMI Activity — Destructive Malware on Exchange Server

Day 53 of Becoming a SOC Analyst | Suspicious WMI Activity — Destructive Malware on Exchange Server InkSec

21 views - 1 month ago

Day 52 of Becoming a SOC Analyst — Malicious Macro Document Delivering PowerShell Downloader

Day 52 of Becoming a SOC Analyst — Malicious Macro Document Delivering PowerShell Downloader InkSec

16 views - 1 month ago

Day 51 of Becoming a SOC Analyst | HTML Password Stealer via Phishing Email — Credential Harvesting

Day 51 of Becoming a SOC Analyst | HTML Password Stealer via Phishing Email — Credential Harvesting InkSec

19 views - 1 month ago

Day 50 of Becoming a SOC Analyst | Splunk Enterprise RCE via Malicious XSLT Upload and Persistence

Day 50 of Becoming a SOC Analyst | Splunk Enterprise RCE via Malicious XSLT Upload and Persistence InkSec

28 views - 1 month ago

Day 49 of Becoming a SOC Analyst | Check Point Gateway File Read CVE-2024-24919

Day 49 of Becoming a SOC Analyst | Check Point Gateway File Read CVE-2024-24919 InkSec

46 views - 1 month ago

Day 48 of Becoming a SOC Analyst | Scheduled Task Persistence & Remote Payload Retrieval

Day 48 of Becoming a SOC Analyst | Scheduled Task Persistence & Remote Payload Retrieval InkSec

30 views - 1 month ago

Day 47 of Becoming a SOC Analyst | ProxyNotShell Exploitation Attempt — CVE-2022-41082

Day 47 of Becoming a SOC Analyst | ProxyNotShell Exploitation Attempt — CVE-2022-41082 InkSec

19 views - 1 month ago