CSA (312-39) SOC Simulation Lab

Welcome to the SOC. In this interactive simulation, you will analyze a real-world incident response scenario. You will learn how to prioritize containment actions during an active malware outbreak, aligning with industry-standard incident response frameworks.

Scenario Context

You are a Tier 2 SOC Analyst monitoring alerts for a mid-sized financial institution. A high-severity alert triggers from the CrowdStrike Falcon EDR on the endpoint FIN-WKST-BONNEY. Bonney, a financial analyst, called the IT helpdesk in a panic, stating her screen flashed black, new files with a .locked extension are appearing on her desktop, and she sees a ransom note text file.

The L1 Helpdesk agent has you on an emergency bridge and asks: "I have Bonney on the other line right now. What should I tell her to do immediately?"

Security Environment

Recent telemetry from the SIEM (Splunk) shows active execution and attempts at lateral movement originating from the host.

Time: 2026-04-08T14:15:22Z Event_Type: ProcessRollup2 CRITICAL Hostname: FIN-WKST-BONNEY User: FINSERVE\bonney.m Parent: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE Process: C:\Windows\System32\cmd.exe Command_Line: "cmd.exe /c powershell.exe -w hidden -enc JABzAD0ATgBlAHcALQBPAGIAagBl..." MITRE_Tactic: Execution (TA0002) MITRE_Technique: Command and Scripting Interpreter: PowerShell (T1059.001) Time: 2026-04-08T14:15:25Z Event_Type: NetworkConnect Dest_IP: 185.143.172.50 (Threat Intel: Known Ryuk/Conti C2) Dest_Port: 443 Time: 2026-04-08T14:15:30Z Event_Type: FileCreate Target_File: \\FIN-FILESERVER\Finance_Share\Q3_Report.xlsx.locked

Question

Bonney's system has been compromised by a gruesome malware. What is the primary step that is advisable to Bonney in order to contain the malware incident from spreading?

SOC Hint: Think about the immediate physical actions an untrained end-user can take when an attack is happening in real-time. Which action immediately stops network traffic and disk writes?

Senior SOC Analyst Debrief

Situation Report

We have active ransomware execution resulting from a malicious macro in an Excel file. The telemetry shows the malware establishing a C2 connection and beginning to encrypt files on a mounted network share (\\FIN-FILESERVER). Time is critical. Every second the machine remains active, more organizational data is destroyed or exfiltrated.

Why Option B is Correct

Turn off the infected machine. In an active, destructive malware outbreak (like ransomware or wipers), the immediate priority for an end-user is Containment. While SOC analysts and Incident Responders prefer to disconnect from the network but leave the machine powered on to preserve volatile memory (RAM) for forensic analysis, advising a panicked non-technical user (Bonney) to simply "turn it off" or "pull the plug" is the most surefire, foolproof way to halt the malware's execution, stop network encryption, and sever C2 communications instantly.

Why the Others Fail

A & D (Police / Legal): These are administrative and compliance steps that occur later in the incident lifecycle (Notification/Eradication/Recovery phases). Engaging them while the malware is actively encrypting data guarantees massive data loss.

C (Leave to Network Admins): Malware operates in milliseconds. Waiting for L1 to generate a ticket, assign it to a network admin, and for the admin to log in and disable the switch port takes minutes or hours. By that time, the entire domain could be compromised.

Mini Lesson: The Containment Phase Trade-offs

According to the NIST SP 800-61 Incident Response Lifecycle, Containment has two components: stopping the bleeding and preserving evidence.

The SOC/IR Standard: Use EDR (e.g., CrowdStrike "Network Contain") to logically isolate the host. This blocks all IPs except the EDR console, keeping the machine running so we can pull memory dumps (to extract malware keys) and MFT records.
The End-User Standard: When EDR isolation isn't immediate, physical containment is required. Pulling the network cable is best. Powering off is acceptable if pulling the cable isn't feasible (e.g., integrated Wi-Fi). You sacrifice volatile memory to save the network.

Ready to level up your SOC skills?

Practice more real-world threat hunting and incident response scenarios based on the EC-Council CSA framework.

Explore More CSA Simulations