COMPLETE AUDIO TRANSCRIPTS

SOC Operations, Phishing Incident Response & AI-Driven Cybersecurity Threats

Document Type: Complete Audio Transcription & Synthesis

Topics Covered: • Audio 1: SOC Analyst Role, Phishing & Incident

Response Workflow
• Audio 2: Data Security, AI Exploitation & Cyber
Strategy

Audio 1: A Day in the Life of a SOC Analyst

Topic: Understanding SOC Operations, Phishing Analysis & Incident Response Workflow

Audio 1 Key Highlights & Technical Concepts:

• Phishing & Social Engineering: Recognizing suspicious emails, fake payment requests, and manager
impersonation.
• Incident Response Policy: Step-by-step handling of security events reported via IT Helpdesk.
• Indicators of Compromise (IOCs): Identifying unusual login IP addresses, login locations, malware files,
and outbound traffic.
• Device Isolation & Scanning: Administrator-level device isolation (laptop/phone) and virus scanning.
• Sandbox Malware Analysis ([Link]): Detonating attachments in isolated cloud virtual machines to
safely extract file hashes, domains, and IP connections.
• Remediation & Documentation: Blocking senders, purging emails, firewall IP blocks, and formal post-
incident logging for compliance audits.

Transcript Text:
So, you're curious about what people do in cybersecurity. Maybe you've just graduated from school and
you're interested in this career path. Or you're simply curious and you want to know what it's all about.
Well, in this video, I'll explain to you guys what we do in cybersecurity in simple terms from a Security
Operations Center analyst or SOC.
Let's say you're at work, minding your own business, when all of a sudden, you received an email that
has your manager's name on it. In this email, he's asking you to download this PDF attachment so you
can fill out some details about payments. You look at the sender's email address, and you notice that it's
not your usual manager's email. The wording of the email is also a bit weird, like how he addresses you
as "hello friend".
This is what we call phishing. Specifically, a phishing email. Malicious people will use this type of
technique to trick people into thinking that they're talking to someone they know, when in fact, it's an
impersonation. As a SOC analyst, this is our bread and butter. We have to constantly stay on top of these
phishing email attempts and take actions against them. Actions like blocking the sender from our system
and removing all similar emails from everyone's mailbox so no one else falls victim to it.
All right, let's say you didn't know better. You believed that this is your manager, and you downloaded
the PDF to fill in the details. When you open up the PDF, you see a website link. Now you're on the
website, which doesn't really look that suspicious to you. You put in your login credentials, and then the
website crashes. You stare at it blindly, only to finally realize that you may have fallen victim to a
phishing website. You contact the IT helpdesk, in which they inform the security team that an incident
has happened.
This is what we call incident response. A Security Operations Center would have policies and procedures
in place for responding to different types of incidents. In this case, a team member would talk to you to
get as much information as possible about what happened. And in parallel, another team member
would run checks on your activity to see if there's anything suspicious. Let's assume I'm in charge of
checking your activity. This would be an investigation to look for IOCs, which stands for indicators of
compromise.
The first thing I would do is to isolate the device that you used. So that could be your laptop or your
phone. This can be done through certain software which only an administrator can access. The
indicators of compromise I would check are your logins. So whether the IP addresses are out of the
ordinary or from a totally different location. Then I would run a scan on your device to see if there's any
virus infection, followed by any unusual outbound activity which might indicate a data breach.
After that, I would obtain a copy of the original email and start the analysis. I would note down the
sender's email since it's an impersonation attempt, so I can block it off our system later. The next thing I
would do is to download the attachment for analysis. Keep in mind, it's okay to download files even if
they might contain a virus, as long as you don't open them, then the program won't be able to execute.
There are many ways you can check an attachment. I prefer opening it in a sandbox environment, which
is basically a virtual machine that is completely separate from your device. I'm going to use [Link] for
this because it's a really neat platform which allows us to extract the IOCs.
All right, so now we're on the sandbox environment on [Link]. And if this is your first time seeing a
sandbox environment, there's a lot going on, so you might be easily overwhelmed. So this particular
sandbox run is actually from a real incident response, so I thought it would be a good example for you
guys to see. On the bottom left, we can see more information on this sandbox session, so stuff like
connections, IP addresses, DNS requests, and different types of threats that were detected from these
connections.
So in this particular example, we can see it's part of a social engineering attempt on one of our
employees. We can see it's trying to mimic a Microsoft login page, and the easiest way to see that it's
not Microsoft is up in the website link. So we can see here up on the website link that there's no
mention of Microsoft anywhere, so that's a huge red flag. And on the right here, we can see that it's
been highlighted as malicious activity, so [Link] has automatically detected that this is a phishing
attempt. And on the bottom left here, we can see in the threats panel that [Link] has automatically
flagged this as a possible social engineering. So this confirms our suspicion even though it's pretty
obvious already.
So going back to the right side, we can click on IOCs, and it will give you a list of all the indicators of
compromises. So stuff like the file hashes, the domains, and all the IP connections that relate to the
website.
So now that I have enough IOCs, I would begin the next phase of the incident response, which is
remediation. The first thing I would do is to block the sender's email address from our system. Then I
would scan everyone's mailbox for similar email and delete them all off. Using the IOCs provided from
our sandbox environment, I would also block all the website links to prevent anyone from accessing
them. On top of that, I would do a check on all the IP addresses and block the malicious ones on our
firewall.
Once I've completed all the remediation steps, then the final step is documentation. This step is often
quite boring, but very necessary to make sure we have logs in case we get an audit. I would have to
document details like when the incident first happened, when it was first brought to our attention, how
long did it take to resolve this incident, and how we can prevent this from happening again in the future.
Once the documentation has been completed, then we can officially conclude this incident response.
Hope this video has been helpful in understanding more about the basics of cybersecurity. This is just a
small but common example of the job. There are other responsibilities in cybersecurity like handling
vulnerabilities, risk management, and so on. That's it from me. Hope you guys enjoyed this video.
Thanks for watching.

Audio 2: Data, AI, and Cybersecurity Threats

Topic: Keynote / Presentation on AI Exploitation, Polymorphic Malware & Defensive AI

Audio 2 Key Highlights & Technical Concepts:

• Data as 'The New Gold': Critical dependency of IoT, autonomous vehicles, smart AI, and Neuralink on
data flow.
• AI Dual-Use Problem: While AI enhances productivity (ChatGPT, Bard, Copilot), it acts as a 'hacker's best
friend'.
• Polymorphic Malware Generation: Demonstrating how generative AI can write self-encrypting,
signature-changing viruses in seconds.
• Corporate Vulnerabilities: Highlighting major data breach cases (e.g., Toyota May 2023 decade-long
breach).
• AI-Powered Social Engineering: Personalizing spear-phishing campaigns via OSINT, increasing attack
success rates from 18% to 51%.
• Defensive Countermeasures ('Fighting Fire with Fire'): Using generative AI to audit terms & conditions,
detect social engineering, and automate boilerplate code for security developers.
Transcript Text:
Ladies and gentlemen, data is the new gold. We are becoming more and more involved with it in our
daily lives. Whether it be the internet of things, self-driving cars, smart AI, or even the up-and-coming
Neuralink, all of them rely on the flow of data to operate. With increasing reliance on data to drive day-
to-day operations, this begs the question: How do we know that all of this data is secure and safe from
the hands of hackers? This is a question that goes mostly unanswered and will be the main focus of my
talk today.
With cyber attacks and data breaches escalating exponentially in size and severity, neglecting
cybersecurity is an issue that empowers hackers beyond anyone's wildest imaginations, and a mistake
that will cost us colossally in the long run.
Now, in order to truly go beyond the human, in order to truly move forward as a species, we must
ensure that the tools we use to do so are safe and secure for everyone to use.
Now, I would like to set the scene. I'm sure you've all seen the advanced AI models and their magical
capabilities: OpenAI's ChatGPT, Google's Bard, GitHub's Copilot, you name it. Some of you might have
even used it to increase your productivity tenfold. Ladies and gentlemen, what if I told you that you are
not the only people using these to increase your productivity? As it stands, like a dog is a man's best
friend, AI is a hacker's best friend, and it proves a surprisingly capable assistant in manipulating both the
human and the computer.
Now, this brings me to my first point, which is AI's ability to write malware and exploit code. Now, while
AI models are centuries, even millennia away from actually replacing programmers, that's not to say
that they aren't efficient at writing code—namely, dangerous code that can be used against internet
infrastructure and systems worldwide. To prove my point, I asked a non-descript AI to write me
malware. Now, disclaimers: do not under any circumstances do this; this is for educational purposes
only. That being said, this is its response, and here is what it returned.
Now, ladies and gentlemen, this right here is a polymorphic, self-encrypting virus. What this virus does,
for those of you who are unfamiliar with computer terminology, is it is a virus that can change its
appearance at will, which makes it very, very difficult to track and basically makes it go undetected by
most antivirus solutions today. Now, keep in mind, ladies and gentlemen, that this was created in
seconds by a bored high schooler. Imagine what a hacker with more ingenuity and more time on their
hands can do. Is this terrifying you yet? It gets worse.
Consider the fact that most companies nowadays neglect cybersecurity. Yes, even the major ones. For
example, Toyota in May 2023 released the fact that they had been the victim of a decade-long data
breach which compromised millions of user accounts. With cyber attacks increasing rampantly and
becoming much more savage, and companies stagnating and refusing to improve their cyber policies,
this stands to lead to a cataclysm, ladies and gentlemen, in which your data is the victim.
Now, the intrinsic value of AI to a hacker is not in its ability to write bad code; it is actually in its ability to
manipulate people. Social engineering is a class of attack that is becoming increasingly more prevalent,
with 41% of major breaches happening due to this type of attack. Now, it is an attack which involves a
hacker manipulating a human and coercing them into doing their bidding. So, AI can also help with this
in a very, very efficient manner. Now, let's take a look at this from the hands of a hacker, right?
So, here is our victim, John Doe. So, we want his bank details. The first step is we basically compile a list
of public information. So, we found online via social media and other forums that he's 23, he's a junior
analyst, he's a bit of a hustler, and he's kind of struggling with his finances. So, we use this and feed it to
this AI model (once again, non-descript for legal reasons), and it returns a very, very efficient, very, very
convincing script over here which would be sent in an email to him, which would get him to click on a
malicious link.
Now, this email prompt uses time urgency and introduces consequences in order to get him to click on a
link. Now, ladies and gentlemen, you might think that, "Oh yeah, this is just a simple scam email. I won't
fall for this." Well, I have two things to say to that. Both of them indicate that you are wrong. First off, it
is becoming increasingly harder for people to tell the difference between AI-generated content and real
content. And second off, a 2021 study conducted by IT firm AAG looked into phishing attacks and found
that the success rate jumped from 18% to 51% when the attacks were personalized, like we did here.
Now, ladies and gentlemen, that is a coin toss probability! Do you want the integrity of your data relying
on a coin toss?
Now, some of you might roll your eyes at the mention of your data, thinking it's completely different,
completely separate from who you are as a person, and think it has no bearing on your life. Well, let me
contextualize this, ladies and gentlemen. Let's play a game.
Raise your hands if you have bought something online at any point in time.
Raise your hands if you have private documents on your computer or if you have done something
private online.
Raise your hands, ladies and gentlemen, if you have a smart device such as an Amazon Alexa or Google
Home sitting in your house right now.
The majority of you said yes, ladies and gentlemen. All this data acts as strings to which a sufficiently
skilled hacker can control you like a puppet. As a result, security of your data matters.
Now, we've kind of looked at how exactly hackers can use modern technologies to kind of wreak havoc,
start chaos. But one thing I think that is even more important is: How do we fight back? Where do we go
from here? Simple: We fight fire with fire.
So, you can use these AI-generated models as well to read Kafkaesque, absurdly long terms and
conditions to actually make informed decisions based on how companies handle your data. This is a very
efficient tool as it allows you to get to what matters most. Furthermore, with the rise of social
engineering attacks, you can also use generative AI to detect these social engineering attacks, as these
models are very efficient at detecting what they have generated. Furthermore, if you are a programmer,
you can also use generative AI to write mundane boilerplate code and templates so you can focus on the
bigger picture as a whole: system security, scalability, and efficiency.
All of this combines to make a very, very, very robust cyber strategy and secure your data pretty
efficiently.
Now, ladies and gentlemen, as I've said before, in order to truly go beyond the human, cybersecurity
must be considered. It is something that is beyond every single one of us, and it is something that we
are all responsible for. In order to usher in a new age, we must make sure that the tools used to do so
are safe.
Thank you, ladies and gentlemen.

Summary Comparison: Audio 1 vs. Audio 2

Dimension Audio 1 (SOC Operations) Audio 2 (AI & Security Speech)

Primary Perspective Operational / Analyst Defense Level Strategic / Macro Threat & AI
Landscape

Core Vulnerability Focus Phishing emails impersonating Polymorphic malware & AI spear-
management phishing

Key Methodology Device isolation, [Link] AI-powered OSINT targeting & AI

sandboxing, IOC extraction, counter-defense ('fight fire with fire')
documentation

Target Audience Call to Action Understanding SOC workflow & Recognizing systemic data risk &
security procedures practicing defensive AI use