SOC-SIM // Introduction to Phishing
Analyst: whoopx Case Closed ✓
TryHackMe · SOC Simulator · SOC Level 1 Path

Introduction to Phishing
— case closed.

Five alerts hit the queue in under four minutes on November 20. Two turned out to be noise from a new HR vendor; three were a live phishing run aimed at three different inboxes. Here's how each one got triaged, alert by alert, and why.

SIEM: Splunk Window: 20:02 – 20:06 Alerts: 5 closed
95
Points earned
1st
Leaderboard place
60%
True positive rate
5
Alerts triaged

I ran this scenario inside TryHackMe's SOC Simulator — a training environment built to feel like a real alert queue instead of a quiz. I picked Splunk as my SIEM, started the clock, and watched five alerts land back to back. The brief was simple: close every true positive, leave the noise alone, and be able to justify each call with evidence, not a gut feeling.

Every alert below got the same treatment — read the raw evidence, check the sender and the link for anything spoofed or obfuscated, then pivot into the SIEM to see what actually happened when the message landed.

Alert Queue · 11/20, 20:02–20:06

Case files

Five alerts, in the order they arrived. Each one closed with a verdict and a reason.

#8814 11/20 · 20:02:00

"Action Required: Finalize Your Onboarding Profile"

Fromonboarding@hrconnex.thm
Toj.garcia@thetrydaily.thm
Linkhrconnex.thm/onboarding/15400654060/j.garcia
third-party vendor confirmed no urgency language domain not spoofed

First instinct: flag it — an unsolicited onboarding link is exactly the shape of a phishing email. But pivoting on hrconnex.thm in the SIEM turned up an internal message from HR describing it as a brand-new third-party onboarding partner, sent because Garcia's profile link genuinely hadn't arrived yet. No spoofed sender, no pressure tactics, and now a legitimate business reason for the email to exist at all.

False Positive
#8815 11/20 · 20:03:09

"Your Amazon Package Couldn't Be Delivered – Action Required"

Fromurgents@amazon.biz
Toh.harris@thetrydaily.thm
Linkbit.ly/3sHkX3da12340
lookalike domain shortened link 48-hr urgency click attempt logged

This one looked wrong before I even opened the SIEM. amazon.biz isn't Amazon, the bit.ly link hides where it actually goes, and the 48-hour deadline is textbook pressure. Pivoting on the link confirmed someone at TheTryDaily had already tried to click it — the firewall just got there first. No separate escalation needed here; that gets carried by the linked firewall event below.

True Positive
#8816 Firewall 11/20 · 20:04:23

Blocked connection to a blacklisted URL

↳ Same shortened link as #8815 — high severity

Src IP10.20.2.17
Dst IP67.199.248.11
URLbit.ly/3sHkX3da12340
ActionBlocked — Rule: Blocked Websites
blacklisted destination matches #8815 payload escalated

This is the other half of #8815 — the same host on the internal network attempting to reach the same malicious shortlink, this time caught at the firewall. It's already blocked, so there's no active compromise. I escalated it anyway: the blacklist only covers known threats, not new infrastructure, so threat intel still needs to confirm the domain and check whether related redirects need blocking too.

True Positive
#8817 11/20 · 20:05:27

"Unusual Sign-In Activity on Your Microsoft Account"

Fromno-reply@m1crosoftsupport.co
Toc.allen@thetrydaily.thm
Linkm1crosoftsupport.co/login
ClaimedSign-in from Lagos, Nigeria
typosquatted domain fear-based urgency credential harvesting link

The clearest one in the queue. m1crosoftsupport.co swaps a "1" for the "i" in Microsoft and isn't even a .com — real account security mail never comes from a domain like that. Pair the spoofed sender with a scare-location login alert and a link back to that same fake domain, and it's a straightforward credential-harvesting attempt. No internal correspondence backs this one up the way #8814 had — nothing legitimate ties to this domain at all.

True Positive
#8818 11/20 · 20:05:55

"Action Required: Finalize Your Onboarding Profile"

↳ Duplicate of #8814 — same sender, same context

duplicate alert already resolved context

Same subject, same sender, same onboarding link as #8814 — just a second copy landing a few minutes later. Since the legitimate third-party context was already confirmed, this closes the same way without needing to re-pivot through the SIEM.

False Positive
Analyst Notes

What the queue taught me

Five alerts is a small sample, but the pattern held up across all of them.

01

Domain literacy beats domain familiarity

Check the actual string, not the display name. hrconnex.thm looked exactly as "external" as amazon.biz and m1crosoftsupport.co — only one of the three was real.

02

Urgency is a signal, not a verdict

Pressure language matters most when it's stacked with a spoofed sender or an obfuscated link — not when it's sitting on its own.

03

Pivot before you decide

The email alert alone never told the full story. Firewall logs and internal correspondence supplied the missing context every single time.

04

A block isn't a close

#8816 was already stopped at the firewall, but the blacklist doesn't cover unknown domains — so it still went up for escalation.

Result

Case closed

All three true positives got escalated and their infrastructure flagged. Both false positives — the same HR onboarding notice, sent twice — got documented and released without touching the user. The queue cleared, and the scenario marked it a win: 95 points, 1st place, and a true positive rate of 60% across the five alerts.

Not a flawless run — the recap flagged that mean-time-to-resolve and dwell time ran a little long overall — but the fastest single close, a phishing case, landed at 0.07 minutes. Room for speed, not for accuracy.

View public summary ↗ Try the room ↗
TryHackMe SOC Simulator results screen: Victory, security breach prevented — 95 points, 1st place, true positive rate improved to 60%.

Final result — Introduction to Phishing, TryHackMe SOC Simulator.