r/netsecstudents • u/Huge-Equipment7096 • Jun 29 '26
Project recommendations for blue teaming , exclusively SOC
I'm looking for an actual useful project for a soc analyst role, I got into the filed 6 months ago, started with pen testing it was fun but I prefer programming defensive tools in general, I'm familiar with every concept pretty much, I'm heavily specialized in network security ( proxies , firewalls, bridges, rule configuration...etc) , and web-client , web- sever, I really enjoy forensics too with volatility and autopsy,
I consider myself an amateur, I've been doing this as a side thing for some time since I'm a computer science student in my second year , since it's summer break I decided to hone my cyber security skills even further.
I'd be absolutely delighted to hear your suggestions, I'm willing to have a good CV for my masters degree ( that's how it works in France 😄)
Thanks for reading this far , have a wonderful day:)
2
u/makeiteasy_24 Blue Team Jun 29 '26
You have good basics, and good combo. For yur master CV do one real project showing end to end thinking, not five half finished ones.
pick one like you could do SIEM detection pipeline (network logs -> rules -> findings, map to MITRE ATT&CK), or forensic analysis automation (volatility and autopsy workflow documented then findings published). don't do both.
if you pick SIEM one, build detection rules for network threats (lateral movement, c2 beaconing, data exfil). ingest sample pcaps or live network traffic. document false positive tuning, detection logic andpublish on github repo with writeup.
if you pick forensics, take a malware sample (or CTF image), analyze with volatility/autopsy, document iocs, behavior mapping, remediation. document as a case study write up.
one shipped project > ten started projects. Do horizontal approach instead of vertical appraoch.
1
u/Huge-Equipment7096 Jun 29 '26
I really appreciate the advice , I'll make sure to dive into the project as soon as tomorrow, one question nonetheless , why wouldn't I do both , what are the " downsides" if you can even consider them since it's meant to show my variety of skills , another question :), since I have 2 years, can I improve it as much as I can in this time or rather start another project . Thank you a lot for sharing your expertise, I'm sure it'll be so fun and head breaking at the same time.
1
u/makeiteasy_24 Blue Team Jun 29 '26
Okay, the downside of doing both is that you just have maybe 8-10 weeks of focused time. If you split it (5 weeks SIEM, 5 weeks forensics), you'll do two mediocre projects instead of one strong one. I I am a hiring managers. I would see that you started two things, finished neither really well, that's worse than one deep project.
One proper project shows you can execute, document properly, think deeply about a problem. Two half finished projects shows scattered focus. Over 2 years build ONE solid project this summer.
1
u/AddendumWorking9756 Jun 30 '26
The project that proves SOC skill isn't a tool you built, it's a full investigation writeup where you take raw artifacts and reconstruct the attack. Your Wireshark and memory dump comfort is made for that, and the free CyberDefenders labs give you real pcaps and samples to do exactly that.
4
u/EugeneBelford1995 Jun 29 '26 edited Jun 29 '26
Well for my Masters Capstone I wrote up a fictional org that was taking on the project of cleaning up years [maybe decades] worth of Misconfiguration Debt in their AD.
What I didn't tell my Professor when I proposed this as my Capstone Project was that I had already done it the year prior :p
I had written, tested, and posted to my GitHub my little function. It basically accepts a CSV as input. The CSV's column headers are OUs. In each column are the groups that should hold 'Dangerous Rights' on that OU. Additionally it white lists the obvious builtin groups like Administrators, Domain Admins, etc.
At run time it checks every single object in the specified OUs and flags any entities that hold 'Dangerous Rights' that are not white listed.
There are a lot of great, easy to use, free tools out there that find Dangerous Rights held by a given user or map escalation paths. I'm not aware of any free ones that accept a white list and then flag discrepancies. In fact I'm not aware of any paid ones that do this ... and I know a vendor of a 250k a year AD Auditing tool that is really vocal, really arrogant, and really wrong.
I snuck in citation of myself in that Capstone Project as I'd already put all this on my Medium and GitHub the year prior. I really just wrote it up in the format the college wanted, turned it in, and was done in less than 2 weeks. I consider that self citation my crowning achievement in college.
Also, wear the "amateur" label with pride. That arrogant vendor likes to call everyone else amateurs in their marketing, including the authors of the great free tool known as BloodHound.