TrueCustodian
SOC

Triaging Your First SOC Alert Without Losing Your Mind

Aisha Rahman3 min read

[SEED CONTENT — replace] This article is placeholder copy seeded to exercise the layout. Swap it for a real write-up before launch.

Your queue just lit up with a new alert: "Suspicious PowerShell Execution — Encoded Command." It's 2 a.m., the analyst on shift before you left no notes, and you have roughly ten minutes before the next alert lands. Here's the sequence that keeps triage fast without skipping the checks that actually matter.

Step 1 — Read the alert like a suspect, not a verdict

Detection rules fire on patterns, not intent. Before assuming compromise, pull the raw event and read every field: parent process, command line, user context, and the host's recent history. A base64-encoded PowerShell command from a software deployment tool looks identical, on the surface, to a dropper.

  • Confirm the parent-child process relationship — is winword.exe spawning powershell.exe? That's a different story than a scheduled task doing it.
  • Check the user account — service account or interactive login?
  • Note the host's baseline — has this exact command line fired before, from this host, on a schedule?

Step 2 — Decode before you escalate

# Decode a Base64 encoded PowerShell command for review
$DecodedText = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($EncodedCommand))
$DecodedText

Nine times out of ten, decoding the payload resolves the ambiguity immediately. If it's pulling a remote script from an unfamiliar domain, you have your answer. If it's a documented RMM tool checking in, you can close with confidence instead of a guess.

Step 3 — Scope before you contain

Containment feels productive, but an early, wrong isolation call on a production host causes its own incident. Before you touch anything:

  1. Identify every host that shows the same indicator in the last 24 hours.
  2. Check whether the account associated with the alert has authenticated elsewhere.
  3. Confirm whether EDR already has the process contained or just logged.

Step 4 — Write the note for the analyst after you

Future-you (or the next shift) inherits whatever you write. A good closing note includes: what triggered the alert, what you checked, why you closed or escalated it, and any host/account to keep an eye on. Vague notes like "benign, closing" are the single biggest cause of repeated re-triage on the same alert type.

Triage speed comes from pattern recognition, not shortcuts. The analysts who move fastest aren't skipping steps — they've just done this specific dance enough times that the checklist above happens in their head in under ninety seconds.