CSA (312-39) SOC Simulation Lab

Welcome to the Tier 3 SOC Simulation. In this scenario, you will apply threat hunting concepts to map observed telemetry to the correct phase of the APT lifecycle. Analyze the logs, evaluate the context, and make your determination.

Scenario Context

You are a SOC Administrator at a mid-sized financial institution. Over the past week, infrastructure teams reported intermittent network slowdowns and unexplained high memory usage across multiple core processing servers during off-peak hours (02:00 - 04:00 AM local time). Standard AV and EDR signature scans returned clean.

You initiated a proactive threat hunt. A timeline analysis using Sysmon and native Windows Event Logs uncovered anomalies in the Windows Task Scheduler. You also correlated this with proxy logs showing encrypted outbound connections to an uncategorized external IP address occurring simultaneously with the task execution.

Security Environment

Below is a sanitized extraction of the telemetry driving your investigation:

[Windows Security Event Log - DC01]
EventID: 4698
Task_Name: \Microsoft\Windows\AppID\PolicyConverter
SubjectUserSid: S-1-5-18 (NT AUTHORITY\SYSTEM)
Action: powershell.exe -nop -w hidden -enc JABzAD0ATgBlAHcAL...
Trigger: Daily at 02:00 AM

[EDR / Sysmon Event ID 1 - Process Creation]
UtcTime: 2023-10-24 02:00:01.034
Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
CommandLine: powershell.exe -nop -w hidden -enc JABzAD0ATgBlAHcAL...
ParentProcessId: 1404 (svchost.exe -k netsvcs)

[Perimeter Firewall Log]
Timestamp: 2023-10-24 02:00:05
SrcIP: 10.10.50.12 (DC01)
DstIP: 198.51.100.44
DstPort: 443
BytesOut: 412
BytesIn: 1050
Action: ALLOW (Rule: Default_Outbound_HTTPS)

IR Context Note: Historical authentication logs from your SIEM indicate that the initial access vector occurred 4 months ago via a compromised VPN account (stolen credentials from a targeted phishing campaign).

Question

As a SOC Administrator at a mid-sized financial institution, you noticed intermittent network slowdowns and unexplained high memory usage across multiple critical systems. Your initial analysis found no traces of malware, but a forensic investigation revealed unauthorized scheduled tasks that executed during off-peak hours. These tasks ran obfuscated scripts that connected to an external C2 server. Further investigations showed that the adversary had gained access months ago through a compromised VPN account, leveraging stolen credentials from a phishing campaign. Which phase of the Advanced Persistent Threat (APT) lifecycle does this scenario align with?

SOC Hint: The adversary is using Windows Task Scheduler to run a script every day. Think about why an attacker schedules a task rather than just running a script once. What objective does surviving a server reboot achieve?

Expert Insight

1. Situation Report (SITREP)

We are observing a classic "Living off the Land" (LotL) technique. The attacker is utilizing native Windows administrative tools (Task Scheduler and PowerShell) to execute a fileless payload. By encoding the PowerShell command (Base64) and running it hidden, they bypassed traditional file-based AV signatures. The regular 02:00 AM outbound HTTPS connections are beaconing signals to their Command and Control (C2) infrastructure.

2. Why "A" is Correct (SOC Reasoning)

Persistence (MITRE ATT&CK T1053 - Scheduled Task/Job) is the phase where attackers modify the system to maintain their foothold across restarts, changed credentials, or other interruptions. Creating a Scheduled Task ensures the malicious obfuscated script re-executes automatically without requiring the attacker to re-exploit the network. The scenario explicitly mentions "unauthorized scheduled tasks," which is a primary indicator of persistence.

3. Comparing Detection Logic (Why others are wrong)

  • B. Search and Exfiltration: While C2 communication exists, the telemetry shows small byte counts (BytesOut: 412, BytesIn: 1050), indicative of C2 heartbeats/beaconing, not large-scale data staging or exfiltration (T1041).
  • C. Cleanup: Cleanup (T1070) involves anti-forensics—deleting tools, clearing Event Logs (e.g., Event ID 1102), and removing scheduled tasks. Creating a scheduled task generates heavy log artifacts (Event ID 4698), which is the exact opposite of hiding tracks.
  • D. Initial Intrusion: The scenario explicitly states the initial access occurred "months ago through a compromised VPN account." The current activity is post-exploitation.

4. SOC Mini-Lesson: Hunting Persistence (ASEPs)

As a Tier 3 analyst, you shouldn't just wait for alerts; you must hunt for AutoStart Extensibility Points (ASEPs). Adversaries need their code to run automatically.

Hunting Playbook for Scheduled Tasks:

  • SIEM Query Focus: Monitor Windows Security Event 4698 (A scheduled task was created) and 4699 (A scheduled task was deleted).
  • Anomaly Detection: Look for tasks created by SYSTEM but triggering binaries from user profiles (e.g., C:\Users\Public or AppData).
  • Command Line Analysis: Alert on Scheduled Tasks executing powershell.exe, cmd.exe, cscript.exe, or mshta.exe with arguments like -enc, -WindowStyle Hidden, or reaching out to external URLs.
  • Tooling: Use Sysinternals Autoruns during forensic response to quickly dump all ASEPs on a suspected host.

Sharpen your SOC analysis skills

Master the EC-Council CSA and real-world threat hunting with our comprehensive lab environments.

Explore more CSA simulations