CSA (312-39) SOC Simulation Lab

Welcome to the SOC Forensics lab. In this module, you will learn how SOC teams and forensic analysts track malware persistence mechanisms and state changes by utilizing baseline analysis.

Scenario Context

You are an analyst at a national cybersecurity agency monitoring critical infrastructure servers. The initial EDR (Endpoint Detection and Response) sensors flagged anomalous behavior originating from a legitimate Windows process (svchost.exe).

Because traditional AV signatures did not catch the payload, the incident response team suspects a sophisticated fileless or stealthy malware variant designed for data exfiltration. To map the exact scope of the compromise—including registry persistence and scheduled tasks—the forensic team pulls historical state data for comparison.

Security Environment

The forensic team provides the following output generated from their monitoring agent. Review the artifact to understand their methodology:

[ALERT] INTEGRITY VIOLATION DETECTED Agent: SRV-GRID-CTRL-01 Operation: System State Delta Analysis Comparison: Baseline_Snap_V2 (T-minus 48hrs) vs Current_Live_State ### MODIFIED FILES ### [+] C:\Windows\System32\drivers\tcpip.sys - Previous SHA256: 8a7b9c... - Current SHA256: f1e4d2... (MISMATCH) ### REGISTRY ANOMALIES ### [+] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run - Value Added: "WinUpdateSvc" = "C:\Users\Public\svchost_ext.exe" STATUS: 2 Unauthorized changes identified via snapshot comparison.

Question

The SOC analyst at a national cybersecurity agency detected unusual system behavior on critical infrastructure servers. Initial scans flagged potential malware activity. Due to the sophisticated nature of the suspected attack, which included registry key modifications, process injection, and unauthorized tasks, the case was escalated to the forensic team. The forensic team suspects the malware is designed for stealthy data exfiltration. To fully assess the compromise, they captured system snapshots before and after suspected infection to identify unauthorized changes and anomalies. Which process is the forensic team following by capturing and comparing system snapshots to detect unauthorized changes and anomalies?

SOC Hint: The keyword here is "capturing and comparing system snapshots". What do we call the process of ensuring a file, registry, or system hasn't been altered from its known-good baseline?

Senior SOC Analyst Insight

What is happening here?

Advanced Persistent Threats (APTs) rarely drop massive, easily detectable executable files on a disk anymore. Instead, they "live off the land" (LotL). They inject malicious threads into legitimate processes (like svchost.exe) and modify existing registry keys to ensure they maintain access upon reboot. Because these changes are subtle, traditional AV won't catch them. To detect this, SOCs rely on taking cryptographic baselines (snapshots) of critical system states and continuously comparing the live state against that baseline.

Why A (Host integrity monitoring) is the Correct Answer

Host Integrity Monitoring (often known as File Integrity Monitoring or FIM) specifically defines the process of capturing a known-good system snapshot (baseline) and comparing subsequent snapshots against it to detect unauthorized changes, such as modified system files, unauthorized registry keys, or unexpected scheduled tasks.

Why the others are incorrect

B (Digital forensics): While the forensics team is performing the action, digital forensics is the umbrella discipline encompassing data recovery, legal preservation, and timeline analysis. The specific, technical process of comparing state snapshots is integrity monitoring.
C (Threat intelligence gathering): This involves collecting external data about adversary infrastructure, TTPs (Tactics, Techniques, and Procedures), and IoCs (Indicators of Compromise) via feeds like STIX/TAXII. It does not involve comparing internal system snapshots.
D (Signature-based detection): This relies on matching files against a database of known bad strings or hashes (like traditional AV). It evaluates a file in a vacuum, rather than comparing a system's current state to its previous baseline.

MINI LESSON: FIM in the Modern SOC

In SOC operations, Host/File Integrity Monitoring (tools like Tripwire, OSSEC, or EDR native features) is a critical layer of defense-in-depth:

The Mechanism: FIM tools calculate cryptographic hashes (e.g., SHA-256) of critical files (like \System32\ contents) and back up critical registry hives (like HKLM\Software\Microsoft\Windows\CurrentVersion\Run).
The Detection: If an attacker modifies tcpip.sys or adds a persistence mechanism, the hash changes. The FIM tool generates a delta report (as seen in the log snippet above) triggering an alert in the SIEM.
NIST Context: FIM directly supports the "Detect" function of the NIST Cybersecurity Framework, specifically in identifying anomalies and events.

Mastered this concept? Take your skills further.

Explore more CSA simulations at ExamRange