CSA (312-39) SOC Simulation Lab
Master early-stage threat detection. Learn to identify attacker behaviors before they execute an exploit by analyzing perimeter telemetry in a real-world SOC scenario.
Scenario Context
You are a Senior SOC Analyst reviewing the morning shift's escalated alerts. A junior analyst noticed an unusual volume of dropped packets on the external edge firewall and a simultaneous spike in 404 Not Found errors on the public-facing customer portal (Nginx).
No successful logins or data exfiltration events have been detected, and system performance is normal. You pull the logs from Splunk to determine the adversary's intent.
Security Environment
You pivot to the SIEM and run a query against the source IP 198.51.100.44 across both firewall and web server indexes:
10:02:14 SRC=198.51.100.44 DST=203.0.113.10 PROTO=TCP DPT=21 FLAG=SYN ACTION=DROP
10:02:14 SRC=198.51.100.44 DST=203.0.113.10 PROTO=TCP DPT=22 FLAG=SYN ACTION=DROP
10:02:15 SRC=198.51.100.44 DST=203.0.113.10 PROTO=TCP DPT=23 FLAG=SYN ACTION=DROP
10:02:15 SRC=198.51.100.44 DST=203.0.113.10 PROTO=TCP DPT=25 FLAG=SYN ACTION=DROP
# index=web_proxy src_ip=198.51.100.44 status=404
10:05:22 GET /admin/login.php HTTP/1.1 404 - User-Agent: Go-http-client/1.1
10:05:22 GET /.git/config HTTP/1.1 404 - User-Agent: Go-http-client/1.1
10:05:23 GET /backup.zip HTTP/1.1 404 - User-Agent: Go-http-client/1.1
10:05:23 GET /phpinfo.php HTTP/1.1 404 - User-Agent: Go-http-client/1.1
Question
Expert Insight
What is happening: The telemetry shows two distinct mapping behaviors. First, a vertical port scan (attempting multiple ports on a single IP) to see what services are exposed. Second, a directory brute-force attack (dirbusting) looking for misconfigured or hidden web assets. The attacker is mapping the attack surface.
Why Reconnaissance Attack is correct: This is the textbook definition of Reconnaissance (mapping to MITRE ATT&CK TA0043). The attacker is actively probing the target network to discover open ports, services, operating systems, and hidden directories before weaponizing an exploit payload.
Why the others are wrong:
- DoS Attack: A Denial of Service aims to exhaust resources and crash the system (availability). The web server is responding normally with 404s.
- Man-In-Middle Attack: A MitM involves intercepting communications between two parties (e.g., ARP spoofing). This requires existing network positioning, not external probing.
- Ransomware Attack: This is a late-stage payload execution involving data encryption and extortion. We are at the very beginning of the kill chain.
SOC Mini-Lesson: Active vs. Passive Reconnaissance
As a SOC Analyst, you must understand what you can and cannot see in your SIEM during the Recon phase:
Passive Reconnaissance: The attacker uses public sources (OSINT, Shodan, WHOIS, LinkedIn). You will almost never see this in your logs because they are not touching your infrastructure.
Active Reconnaissance: The attacker interacts directly with your systems (Nmap scans, Nikto, DirBuster). You will see this as firewall drops, WAF blocks, and 404 errors. While active recon is noisy, SOCs typically automate the response (like using AWS WAF rate-limiting or Fail2Ban) to prevent alert fatigue, only escalating if the recon is followed by a 200 OK response indicating a successful find.