CSA (312-39) SOC Simulation Lab

Welcome to the SOC. In this interactive simulation, you will practice tracking lateral movement and network file exfiltration by analyzing Windows Event Logs within a SIEM environment.

Scenario Context

You are a SOC Analyst investigating a potential lateral movement incident at MediCare Health. A Tier 1 analyst flagged suspicious SMB traffic originating from a compromised developer workstation (DEV-WKST-04) targeting a sensitive production file server (PRD-FS-01).

The attacker has authenticated over the network, and you need to determine exactly which directories and file shares they are attempting to enumerate or access. You are querying Splunk to pull the relevant Windows Security Event logs from the file server.

Security Environment

Review the chronological sequence of logs collected from the targeted file server (PRD-FS-01).

### INDEX: wineventlog | SOURCETYPE: WinEventLog:Security TimeGenerated: 2026-04-08T10:14:22Z EventCode: 4624 (Successful Logon) Logon_Type: 3 (Network) Account_Name: svc_backup Source_Network_Address: 10.50.2.14 (DEV-WKST-04) ### INDEX: wineventlog | SOURCETYPE: WinEventLog:Security TimeGenerated: 2026-04-08T10:14:23Z EventCode: [REDACTED] TaskCategory: File Share Account_Name: svc_backup Share_Name: \\*\IPC$ Share_Path: Access_Mask: 0x1 ### INDEX: wineventlog | SOURCETYPE: WinEventLog:Security TimeGenerated: 2026-04-08T10:14:25Z EventCode: [REDACTED] TaskCategory: File Share Account_Name: svc_backup Share_Name: \\*\Patient_Records_2026

Question

Which of the following Windows Event Id will help you monitors file sharing across the network?

SOC Hint: You need an event ID that specifically logs when a network share object (like IPC$ or a mapped folder) is accessed. It falls under the "Object Access" audit category, not the "Logon/Logoff" category.

Senior SOC Analyst Debrief

Situation Report

In our Splunk telemetry, we observed a sequence of events indicating lateral movement via SMB. First, the attacker authenticated from the compromised workstation to the file server over the network (Logon Type 3). Immediately after, they began enumerating and accessing network shares, starting with the administrative hidden share (IPC$) and moving to Patient_Records_2026. We need the specific Event ID that captures this share access to track what data they are targeting.

Why Option C is Correct

5140 (A network share object was accessed). Event ID 5140 is generated every time a user successfully connects to a network share. This is the cornerstone log for tracking data exfiltration via SMB, ransomware encrypting mapped network drives, or attackers mapping administrative shares (like C$ or ADMIN$) for lateral movement.

Why the Others Fail

D (4624 - Successful Logon): While 4624 proves the attacker successfully authenticated to the machine (especially Type 3 for network logons), it does not tell you what files or shares they accessed post-authentication.

B (4625 - Failed Logon): This is used to track brute-force attacks or expired credentials. It has no relation to file sharing.

A (7045 - Service Installed): This indicates a new service was installed on the system. It is highly valuable for detecting persistence or the execution phase of lateral movement (e.g., PsExec creating a service), but it does not monitor file share access.

Mini Lesson: The "Lateral Movement Triad" in Windows Logs

When hunting for tools like PsExec, Impacket (wmiexec/smbexec), or general SMB lateral movement, SOC analysts look for a specific sequence of three Event IDs occurring in rapid succession:

1. Authentication (4624): Look for Logon Type 3 (Network logon) originating from the attacker's IP.
2. Share Access (5140): Look for access to administrative shares like IPC$ (used for named pipes) or ADMIN$ (used to drop binaries).
3. Execution (7045): Look for a new service being installed dynamically to execute the dropped binary or command.

Pro Tip: To get granular file-level read/write/delete logs within that share, you must also enable Object Access auditing for Event ID 5145 (A network share object was checked to see whether client can be granted desired access).

Ready to level up your SOC skills?

Practice more real-world threat hunting and incident response scenarios based on the EC-Council CSA framework.

Explore More CSA Simulations