CSA (312-39) SOC Simulation Lab

Welcome to the tier-3 SOC threat hunting module. In this lab, you will analyze the proper sequence of incident response and threat hunting methodologies following the discovery of a high-volume credential stuffing attack.

Scenario Context

It is 3:00 AM on a Sunday. You are the on-call L2 SOC Analyst for an e-commerce platform. The SIEM generates a critical alert for "Abnormal Authentication Spikes."

You pivot to the raw telemetry and observe a classic credential stuffing profile: thousands of failed logins originating from a single external VPS provider IP, systematically testing different usernames. Crucially, you notice that several of the usernames being tested match active, highly privileged employee accounts.

Security Environment

Review the initial Splunk output that triggered your investigation. This is your "trigger" or starting point for the hunt:

SPLUNK> index=auth sourcetype=linux_secure eventtype=authentication src_ip="198.51.100.77" | stats count by user, action | sort - count TIME RANGE: -60m@m to now SOURCE IP: 198.51.100.77 (ASN: Cloud/Hosting Provider) ACTION USER COUNT failure j.smith 45 failure m.jones 45 failure admin 45 failure root 45 failure svc_backup 45 ... (showing 1 to 5 of 8,402 distinct users)

Context: The alert acts as the initial indicator of compromise (IoC). At this stage, you know an attack is happening, but you do not yet know the blast radius—specifically, whether any of these attempts were successful.

Question

A SOC analyst monitoring authentication logs detects a sudden and significant spike in failed login attempts targeting multiple critical servers during non-business hours. These repeated authentication failures appear abnormal compared to typical login activity. Upon deeper inspection, the analyst finds that all attempts are originating from a single external IP address, indicating a targeted attack rather than random scanning. What raises further concern is that some login attempts involve legitimate employee usernames, suggesting the possibility of a credential-stuffing attack using previously compromised credentials or an ongoing brute-force attempt. Given the nature of this suspicious activity and its potential to escalate into unauthorized access, the analyst must determine the appropriate next step in the threat-hunting process to assess the situation further.

SOC Hint: You have found the starting point (the spike). Before taking containment actions (like blocking the IP), you need to figure out exactly what the attacker has achieved. Did they successfully log into any of those accounts?

Expert Insight

1. What is happening

The SOC has detected a credential stuffing or password spraying attack. The attacker is using a list of known usernames (and likely leaked passwords from third-party breaches) to systematically authenticate against your public-facing infrastructure. The alert serves as the "trigger" for a threat hunt.

2. Why the correct answer is correct

C. Investigate and Analyze is correct. In the threat hunting lifecycle, once an anomaly or trigger is identified, the immediate next phase is to investigate the scope. You must pivot off the initial indicator (the attacker's IP: 198.51.100.77) to answer critical questions: Were any of the login attempts successful? Did this IP interact with other services (O365, VPN)? You cannot respond effectively without knowing the blast radius.

3. Why the other options are wrong

Rapid Response (A): Premature. If you immediately block the IP without checking for successful logins, you might leave an already-established attacker inside your network via a compromised account. Containment comes after analysis.
Continuous Improvement (B): This is the final phase of the lifecycle, where you tune SIEM rules and update playbooks after the incident is completely resolved.
Establish a Baseline (D): This is a prerequisite step done during peacetime. The analyst already knows this activity is "abnormal compared to typical login activity," meaning a baseline already exists.

MINI LESSON: The Threat Hunting Pivot

Junior analysts often make the mistake of "playing whack-a-mole"—blocking an IP the moment they see brute-force activity and closing the ticket. A Senior Analyst performs a Pivot Investigation:

Pivot 1 (The Success Check): index=auth src_ip="198.51.100.77" action=success. Determine if the attacker guessed a correct password.
Pivot 2 (The Account Check): If j.smith was successfully compromised, pivot to the user: index=* user="j.smith". What did this user do immediately after the successful login? Did they run suspicious commands?
Pivot 3 (The Infrastructure Check): Did the attacker IP hit any other external interfaces (VPN logs, Web Application Firewalls, Office 365 logs) using different tools?

Only after answering these questions do you move to the Rapid Response (Containment) phase.

Ready to master more real-world SOC concepts?

Explore more CSA simulations