How I would run the 00:00 to 09:00 UTC leg of a follow-the-sun SOC for a stablecoin issuer, and a working shift desk that takes one full shift from the inbound handover to a checked handover out.
The largest stablecoin issuer, run by a remote team, plus mining, AI, P2P apps and a growing investment book. Tether also freezes illicit USD₮ for law enforcement at speed: over $1.5B within 30 minutes of the 29 October Binance hack.
00:00 to 09:00 UTC is the APAC leg. It receives from the Americas and hands to the EMEA lead in the 08:00 to 09:00 overlap. Twin postings cover Malaysia, Singapore, the Philippines, Indonesia and Vietnam.
A shift desk: acknowledge the inbound handover, triage, pivot across sources, act, hunt, tune with a regression check, and send a handover that a linter has passed. It runs on a fictional estate with live threat-intel lookups.
| Takeaway | Why it matters on this desk |
|---|---|
| The adversary has a name | North Korean operators target crypto staff with fake job interviews and malicious npm packages. The FBI attributed the October Binance hack to North Korea. A developer laptop running a "take-home test" is a first-hour incident. |
| The handover is the product | The JD names it twice. An item without an owner, a next action and a due time gets lost at 09:00 UTC. The demo lints every handover for exactly that. |
| Sources only make sense joined | In the demo the stolen AWS key, the C2 upload and the session replay each sit in a different tool. Each one alone looks low. Joined on user, host and IP they make three incidents. |
| Tuning needs proof | The Team Lead postings say the SOC is measured on false-positive rate. Every exclusion I propose is re-run over the data to show no confirmed true positive drops out. |
The threats a stablecoin issuer's SOC should expect, where each one first shows up, and the first move. Ranked by how likely they are to page this shift.
| Threat | First seen in | Signal | ATT&CK | First move |
|---|---|---|---|---|
| Fake job interview or take-home test | EDR, SSE | node or npm spawning curl or python; reads of wallet extension storage; raw-IP traffic on odd ports | T1195.002, T1059.007, T1555.003 | Isolate the host, block the package and C2, treat every secret on the machine as stolen, check cloud keys for use from new IPs |
| Infostealer, then session replay | EDR, then SIEM | Unsigned installer from Downloads reads browser cookies; later the same IdP session from a hosting ASN | T1539, T1550.004 | Revoke all sessions (a password change alone leaves the stolen one alive), reimage, review what the session touched |
| MFA push fatigue | SIEM | Repeated push denials from one source | T1621 | The password is already known: reset it and re-enrol MFA, confirm with the user out of band |
| Credential stuffing on customer-facing apps | WAF | Login bursts across many IPs in one proxy ASN, then a 200 and an account change | T1110.004, T1078 | Lock the account and hold withdrawals with Fraud; block the range; look for other successes |
| Cloud key misuse | SIEM (cloud) | Human IAM key calling GetCallerIdentity and listing buckets from a VPS | T1078.004, T1580, T1619 | Deactivate the key with the cloud owners; scope what it read |
| Sensitive data leaving | SSE | Labelled file to a personal storage tenant | T1567.002 | Escalate to data protection with the evidence; SOC does not close it alone |
| Brand and recruiter impersonation | Reports, SSE | Lookalike domains; fake recruiters off the official channels (the JD warns candidates about this) | T1583.001, T1566 | Block, report, warn staff; feed the IOCs back into SSE and email rules |
| Major market event (a large hack, a mass freeze) | Everywhere | Phishing and impersonation spike around the news; urgent requests to staff | varies | Raise the watch level, brief the next shift early, keep the incident lead's channel clear |
Tether's postings name categories and no vendors, so this plan stays vendor-neutral. The gaps sit at the joins between platforms.
| Platform | Sees | Misses | Join key to the others |
|---|---|---|---|
| EDR | Process trees, file reads, connections per host | What a stolen credential does after it leaves the host | Host to user (asset inventory), remote IP to SSE and SIEM |
| SSE | Web and private-app access per user, DLP, tenant controls | Traffic it was told not to inspect (in the demo: raw IP on port 1224) | User to IdP; destination IP and domain to EDR |
| WAF | Requests to public apps, bot and rate signals | Who the customer is, unless the app passes an account id | Customer id to back office; source ASN to IdP sign-ins |
| SIEM | IdP, cloud audit and everything forwarded | Anything not forwarded or not parsed | The place where the joins become correlation rules |
A human IAM key used outside corporate egress is a one-line hunt, H-01 in the demo. It belongs in the detection set.
If the SSE skips raw-IP non-standard ports, the EDR is the only witness to exfiltration. Raise it as a policy change.
One session id seen from two ASNs is the cleanest replay signal. It needs the session id kept in the SIEM.
The SOC Shift Desk plays one APAC shift on a fictional company. Move the shift clock and alerts arrive when their condition is met. All events are synthetic. The malicious npm package (OSV MAL-2024-8847) and the VPS owners are real, so the live lookups return true answers.
| UTC | What arrives | What the desk shows | Right call |
|---|---|---|---|
| 00:00 | Handover from AMER: MFA push fatigue on a finance user, reset ticket pending | Acknowledge, and the case, the pending IT action and two watch items become yours | Chase the reset; the case stays open until IT confirms |
| 00:20 | Unsigned installer reads Chrome cookies on an SRE workstation | EDR alert; the pivot shows the download in the SSE log | True positive, high; isolate |
| 01:05 | Developer runs npm install on a recruiter's take-home repo | Three EDR alerts; the host timeline exposes ethersscan-api; live OSV says BeaverTail | Critical incident: isolate, block, rotate, notify the IR lead |
| 01:21 | Two more push denials from the AMER source IP | Linked to the carried-in case by user and IP | True positive; proves the reset has not landed |
| 01:40 | Encoded PowerShell on two hosts in the same second | Parent is the device-management agent, signed | Benign true positive; propose a scoped exclusion |
| 02:05 | SQLi and XSS blocks against staging | Source is the approved scanner inside its change window | False positive; exclusion scoped to the scanner and host, with a review date |
| 03:09 | Login burst from a proxy pool, then a 200 and a new withdrawal address | Correlation alert with the customer id | Account takeover: lock and hold withdrawals with Fraud |
| 04:11 | The SRE's IdP session used from a VPS | Same session id from two ASNs; RDAP names the hosting company | Revoke all sessions; joins the 00:20 incident |
| 06:15 | Confidential reserve file to a personal Drive | SSE DLP hit | Escalate to data protection with an owner and due time |
| Hunt | No alert covers cloud audit | H-01 finds the stolen developer key used from a VPS at 02:41 | Add to the critical incident; cloud team deactivates the key |
| 08:40 | Handover to EMEA | The note builds itself; the linter lists any item missing an owner, next action or due time | Send a note that lints clean |
| JD duty | How I would do it | Shown in |
|---|---|---|
| Monitor and triage SIEM, EDR, SSE, WAF alerts | Every verdict carries a reason the next shift can check: what I looked at, what it showed. Four verdicts: true positive, benign true positive, false positive, escalate. | Demo: Alert queue |
| Investigate end to end | Pivot on every entity across all sources before deciding scope. Write one line of what happened, then the timeline. | Demo: entity panel, Incidents |
| Scope, severity, impact; escalate | Severity from asset value and how far the attacker got. Critical means the IR lead hears from me before I finish typing the case. | Demo: Incidents, handover check |
| Response actions | Isolate, block, disable and revoke when I own the control. When another team owns it, raise it and track it as pending until they confirm. | Demo: response log |
| Structured handover across regions | Open items each get an owner, a next action and a due time; pending actions and watch items carry over; the inbound handover is acknowledged first thing. | §04, Demo: Handover out |
| Threat hunting with ATT&CK | One hypothesis per hunt, written as a query that runs again next week. Hunts that find something become detections. | Demo: Hunt |
| Detection tuning feedback | Proposals built from the fields that separate noise from confirmed hits, re-run over the data, with a review date on every exclusion. | §05, Demo: Tuning |
| Threat intelligence enrichment | Live lookups with source and time recorded. Track the campaigns aimed at crypto staff (fake interviews, malicious packages) and feed their IOCs into SSE and EDR. | Demo: Enrich IOC |
| SOPs and playbooks | A short playbook for each repeat incident type, starting with the six in §01. | §06 |
| Work with IT, infra, app and engineering teams | Ask for the action I need, with the evidence attached and a time. Confirm when it is done and close the loop in the case. | Demo: pending actions |
| Vulnerability management, posture | Read exposure against CISA KEV first. Turn each recurring incident into one posture fix. | Demo: KEV lookup |
The checks the demo runs on every handover note, and the failure each one prevents.
| Check | Weight | Prevents |
|---|---|---|
| Inbound handover acknowledged | high | An item the last shift left open with nobody holding it |
| Every open incident has a next action and an owner | high | The next shift re-investigating from scratch |
| High and critical incidents have a response action | high | A confirmed incident left to run overnight |
| Critical incidents have the IR lead notified | high | The lead hearing about it at the 08:00 overlap |
| No untriaged high alerts | high | A real alert ageing into the next region |
| Due times in the future, or ownership moved | medium | An overdue item quietly owned by a shift that has gone home |
| Carried-in pending actions still named | medium | A ticket with another team that nobody chases |
| True positives linked to an incident | medium | Related alerts worked as separate cases |
| Every closed alert has a reason | low | A false-positive call nobody can check later |
The Team Lead postings name alert volume, mean time to detect, mean time to respond and false-positive rate. Here is how an analyst on this shift moves each one.
| Number | What I would do on shift | What I would feed back |
|---|---|---|
| Alert volume | Group by rule and entity so one host makes one alert | Rules that fire on known-good automation, with the separating fields |
| False-positive rate | Close with a reason; tag benign true positives apart from false positives | Scoped exclusions re-run over past data, with zero confirmed hits lost and a review date |
| Mean time to detect | Hunt the joins (cloud, session, ports) the rules miss | Each hunt with a hit, proposed as a detection |
| Mean time to respond | Act on the controls I own in the first minutes; raise the rest with evidence | Which response steps waited on another team, and for how long |
Built from the public job posting (2026), its twin postings and Tether's other current postings, Tether's newsroom, MITRE ATT&CK v19.2, OSV and CISA KEV. The demo is my own tool, built for this application. It runs on a fictional company's synthetic events and holds no Tether data. Detections run on the open Sigma engine I built for pwnsy.com/tools/detect. Unsolicited interview homework; happy to walk through any section.
Tether: careers · Binance hack freeze, 2 Nov 2026 · FASE Foundation
Threat intel: OSV MAL-2024-8847 · OpenSSF malicious packages · CISA KEV
Frameworks: MITRE ATT&CK · Sigma
Lookups: RDAP · Cloudflare DoH · Tor exit list
Demo: tether-soc.pages.dev
Independent homework for the Tether SOC Analyst role · 2026 · edwardtay.com