SOC Analyst Cheat Sheet: Ports, Event IDs, Queries

Updated October 2026 · Bookmark this page

A one-page reference for the facts SOC analysts look up most often. Use it while you study, during practice investigations and before interviews.

Common ports and protocols

Port	Protocol	Why it matters
20/21	FTP	File transfer; credentials sent in clear text
22	SSH	Remote administration; watch for brute force
23	Telnet	Legacy remote access; unencrypted
25	SMTP	Email delivery between servers
53	DNS	Name resolution; abused for tunneling
67/68	DHCP	Automatic IP addressing
80	HTTP	Unencrypted web traffic
88	Kerberos	Windows domain authentication
110 / 995	POP3 / POP3S	Email retrieval
123	NTP	Time synchronisation
135	RPC	Windows remote procedure calls
137–139	NetBIOS	Legacy Windows networking
143 / 993	IMAP / IMAPS	Email retrieval
389 / 636	LDAP / LDAPS	Directory queries (Active Directory)
443	HTTPS	Encrypted web traffic; most C2 hides here
445	SMB	Windows file sharing; lateral movement and ransomware
1433	MS SQL	Microsoft SQL Server
3306	MySQL	MySQL database
3389	RDP	Remote Desktop; never expose to the internet
5985 / 5986	WinRM	PowerShell remoting; used for lateral movement

Windows Security event IDs

These appear in the Windows Security log (7045 is in the System log). Some require audit policies to be enabled.

Event ID	Meaning	Investigation tip
4624	Successful logon	Check logon type, source IP and account
4625	Failed logon	Many in a short time suggests brute force or password spraying
4634	Logoff	Helps define session length
4648	Logon with explicit credentials	Can indicate runas or lateral movement
4672	Special privileges assigned	Admin-level logon
4688	Process created	Requires auditing; shows command lines if enabled
4697 / 7045	Service installed	Common persistence and lateral movement technique
4698	Scheduled task created	Common persistence technique
4720	User account created	Unexpected accounts are a red flag
4724	Password reset attempt	Check who reset whose password
4728 / 4732	Member added to security group	Watch privileged groups such as Domain Admins
4740	Account locked out	Often follows brute-force attempts
4776	Credential validation (NTLM)	Useful for spotting password spraying
1102	Audit log cleared	Highly suspicious: attackers hide their tracks

Windows logon types (in event 4624/4625)

Type	Name	Example
2	Interactive	Keyboard logon at the machine
3	Network	Access to a share or service over the network
4	Batch	Scheduled tasks
5	Service	Service start-up
7	Unlock	Workstation unlocked
10	RemoteInteractive	RDP session
11	CachedInteractive	Logon with cached credentials, e.g. offline laptop

Sysmon event IDs

Sysmon is a free Microsoft Sysinternals tool that adds detailed endpoint logging. These are the IDs analysts use most.

ID	Event	Why it is useful
1	Process creation	Full command line, hashes and parent process
3	Network connection	Which process connected where
7	Image loaded	DLLs loaded by a process
11	File created	New files, e.g. dropped payloads
13	Registry value set	Persistence via Run keys
22	DNS query	Which process looked up which domain

Email authentication: SPF, DKIM and DMARC

SPF — checks whether the sending server is allowed to send for the domain in the envelope sender (Return-Path).
DKIM — a cryptographic signature proving the message was not altered and was signed by the domain in the signature.
DMARC — tells receivers what to do when SPF/DKIM fail and checks that the visible From domain aligns with them.

A pass does not mean an email is safe: attackers can register look-alike domains with perfect SPF, DKIM and DMARC. Always check the actual domain.

Phishing analysis checklist

Who is the real sender? Compare the display name, From address, Reply-To and Return-Path.
Do SPF, DKIM and DMARC pass, and for which domain?
Is the sending domain new or a look-alike (for example micros0ft-support.com)?
Where do links really point? Hover or extract URLs without clicking; check reputation.
Are there attachments? Check file type, hash and reputation — never open them on your workstation.
How many users received it, and did anyone click, reply or enter credentials?
Act: remove the message, block indicators, reset affected credentials, document and notify.

Full walkthrough: how to analyze a phishing email.

Alert triage checklist

What triggered the alert, and what is the rule designed to detect?
Which user, host and IP addresses are involved? Are they critical?
Is the activity normal for this user or system? Compare with history.
What happened just before and just after? Build a short timeline.
Is there corroborating evidence in another source (identity, endpoint, network, email)?
Classify: true positive, benign true positive or false positive.
Set severity, act or escalate, and document your reasoning.

Starter SIEM queries

Field and table names vary between environments, so treat these as patterns to adapt.

KQL (Microsoft Sentinel): accounts with many failed sign-ins in the last hour

SigninLogs
| where TimeGenerated > ago(1h)
| where ResultType != "0"
| summarize Failures = count() by UserPrincipalName, IPAddress
| where Failures > 10
| order by Failures desc

SPL (Splunk): failed Windows logons by account and source

index=wineventlog EventCode=4625 earliest=-1h
| stats count by Account_Name, Source_Network_Address
| where count > 10
| sort - count

KQL: processes launched by Office applications

DeviceProcessEvents
| where InitiatingProcessFileName in~ ("winword.exe","excel.exe","outlook.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine

Quick severity guide

Severity	Typical examples
Critical	Active ransomware, confirmed domain admin compromise, data exfiltration in progress
High	Confirmed account compromise, malware executing on a host, successful phishing with credential entry
Medium	Suspicious activity needing investigation, malware blocked but user clicked, policy violations with risk
Low	Blocked attempts, informational alerts, clear false positives to tune

Every organization defines severity differently — always follow your team’s matrix.

SOC analyst cheat sheet