Learning CTI and SOC Skills for Free: A Student Roadmap

The bottleneck is not money, it is direction

There is more free, high-quality blue team material available today than anyone could finish. Students rarely fail for lack of resources. They fail because they bounce between twenty half-finished courses, collect badges, and arrive at an interview unable to explain one investigation end to end.

So this guide is opinionated: a short list of free resources, an order to use them in, and a way to turn the work into evidence. If you want the bigger picture of the job itself first, read our SOC analyst career roadmap.

The free resource shortlist

Free tiers and catalogues change over time, so check what each platform currently offers rather than relying on a list that was accurate when someone wrote it.

MITRE ATT&CK: learn it as a language

Do not try to memorize the matrix. Instead:

• Pick five techniques you will see constantly as a junior analyst: phishing (T1566), command and scripting interpreter (T1059), valid accounts (T1078), scheduled task/job (T1053), and ingress tool transfer (T1105).
• For each, read the description, the detection notes and two or three procedure examples from real groups.
• Then read a public threat report and tag every behaviour you recognize with a technique ID.

That last exercise is the core skill of CTI: turning prose into structured, comparable data. Our guide on how to read a CTI report walks through the process, and /mitre/map is a convenient way to visualize what you tagged.

CyberDefenders and BTLO: do investigations, not quizzes

These platforms give you artefacts and questions. The trap is to answer the questions and move on. Instead, for each lab you finish, write a short report as if a manager asked "what happened?":

Summary:        Initial access via malicious Office attachment, PowerShell
                download cradle, persistence via scheduled task.
Timeline:       09:14 email received -> 09:16 macro execution -> 09:17 C2 beacon
Indicators:     198.51.100.23, hxxp://update-check[.]example/a.ps1, SHA-256 ...
ATT&CK:         T1566.001, T1059.001, T1053.005, T1071.001
Detection gap:  No alert on Office spawning PowerShell
Recommendation: Rule for winword.exe -> powershell.exe parent/child

Ten of these, written well, are worth more than fifty completed labs with no write-up.

TryHackMe free rooms: fill the fundamentals gaps

If you cannot comfortably explain TCP handshakes, DNS resolution, Windows logon types or what a process tree is, start here. Fundamentals are what interviews test, and they are what make every later lab make sense. Pair this with our glossary and the cheatsheets when terms come up that you do not recognize.

SANS posters: revision, not reading

Print or save the posters on Windows forensics, hunting and network analysis. Use them as a checklist while you work a lab ("did I check prefetch? amcache? scheduled tasks?") rather than reading them cover to cover.

A 12-week plan

Consistency beats intensity. Here is a sequence that fits around coursework at roughly five to six hours a week.

• Weeks 1 to 3: networking, Windows and Linux basics, log types. Free introductory rooms. One simple write-up.
• Weeks 4 to 6: first real investigations (PCAP, phishing email, Windows event logs). Start your ATT&CK tagging habit.
• Weeks 7 to 9: CTI focus. Read one public report a week, extract indicators and techniques, compare two reports about the same actor.
• Weeks 10 to 12: build the home lab, write detections, polish the portfolio.

Build a home lab without spending money

You do not need a server rack. A laptop with 16 GB of RAM can run a useful lab with free software:

• One Windows VM (evaluation images are available from Microsoft) with Sysmon installed and a sensible community configuration.
• One Linux VM as an attacker or log collector.
• A free log platform: Elastic's free tier, Wazuh, or Security Onion are common choices.
• An isolated virtual network with no route to your home network or the internet when you run anything suspicious.

Then generate activity yourself: run benign admin commands, create scheduled tasks, perform failed logons, and go find each one in the logs. Knowing what normal looks like in event ID 4688 or Sysmon event 1 is the foundation of everything a SOC does.

Practise enrichment on real indicators

CTI work is mostly pivoting: from an indicator to context to related infrastructure. Take indicators from public reports and practise:

• look up a domain on /domain/ and read its registration, DNS and reputation data
• check a file hash on /hash/
• pull every indicator out of a report's text with the IOC extractor
• decode suspicious strings with /tool/base64

Write down what each lookup told you and what it did not tell you. Knowing the limits of an indicator is as important as knowing how to enrich it. The learn section has more structured material on these workflows.

Free access to mlab for students and schools

mlab runs a student programme that gives students and schools free access to the platform for learning. Check that page for eligibility and how to apply. It is a practical way to work through real enrichment, case and reporting workflows while you build the habits described above.

Turning it into a portfolio

Hiring managers for junior roles skim. Make it easy for them.

What to include:

• Five to ten investigation write-ups in the format above, each one page.
• Two or three detection rules you wrote and tested in your lab (Sigma is a good portable format), with a note on false positives you hit.
• One CTI piece: a short profile of a threat group built from public reports, with ATT&CK mapping and sources cited.
• A one-page description of your home lab with a diagram.

Where to host it: a public Git repository or a simple static site. Keep it clean: a README index linking to each write-up.

What to leave out:

• Badge screenshots with no explanation.
• Copy-pasted walkthroughs of public rooms (many platforms ask you not to publish answers anyway).
• Anything containing real data from an employer, internship or university network.

Find the community

Learning alone is slow. Join student cybersecurity clubs, local security meetups, and CTF teams (blue team and forensics CTFs exist, not just offensive ones). FIRST and many national CERTs publish material and run events that students can follow. Asking a precise question ("my Sysmon config is not logging network connections from this process, here is what I tried") gets far better help than "how do I get into cyber?".

Takeaways

• Pick a small set of resources and finish things, rather than sampling everything.
• Learn ATT&CK as a language you apply to reports, not a matrix you memorize.
• Write up every investigation; the write-up is the skill.
• Build a free, isolated home lab and learn what normal looks like.
• Publish a small, clean portfolio of investigations, detections and one CTI profile.
• Use free programmes such as mlab's student access to practise on real tooling.

Six months of steady, documented practice will put you ahead of most entry-level candidates. Not because you know more tools, but because you can show how you think.