CSA (312-39) SOC Simulation Lab

Master the detection of lateral movement (MITRE ATT&CK TA0008). In this simulation, you will analyze Windows Event Log correlations and network behavioral anomalies to identify active adversary expansion in an enterprise network.

Scenario Context

You are a Tier 3 SOC Analyst at MediCore Health. It is 2:15 AM on a Sunday. There are no authorized IT maintenance windows or vulnerability scans scheduled. Your Splunk SIEM triggers a high-severity correlation alert titled: [Behavioral] 1:N Excessive Network Authentications.

The alert indicates that a single host in the nursing workstation subnet is suddenly authenticating to dozens of other endpoints across the hospital network.

Security Environment

You pivot into the SIEM and run a search against the offending source IP. You see the following log pattern occurring repeatedly over a 45-second window:

[Splunk] index=windows src_ip="10.50.2.14" ======================================================== Event 1 (System Log): Time: 02:15:01 AM EventCode: 7036 Message: The TCP/IP NetBIOS Helper service entered the running state. Event 2...50 (Security Log): Time: 02:15:02 AM - 02:15:46 AM EventCode: 4624 Message: An account was successfully logged on. Subject: Security ID: MEDICORE\svc_helpdesk Logon Type: 3 [Network Logon] Workstation Name: NURSE-WS-04 Source Network Address: 10.50.2.14 Destination Addresses: [10.50.2.15 through 10.50.2.65] [Analyst Note]: The compromised account is authenticating to the ADMIN$ and IPC$ shares of 50 different machines via SMB (Port 445). ======================================================== Required Action: Determine the threat tactic in progress.

Question

A SIEM alert is triggered due to unusual network traffic involving NetBIOS. The System log shows that "The TCP/IP NetBIOS Helper service entered the running state". Concurrently, Event Code 4624: "An account was successfully logged on" appears for multiple machines within a short time frame. The logon type is identified as 3 (Network logon). Which of the following security incidents is the SIEM detecting?

SOC Hint: Logon Type 3 means the authentication came over the network (like accessing a file share or using PsExec). When a single source machine generates an unnatural burst of Type 3 logons to dozens of different destination machines, what phase of the kill chain is occurring?

Expert Insight

What is happening?

An attacker has compromised NURSE-WS-04 and stolen the credentials for svc_helpdesk. They are now using tools like PsExec, WMI, or BloodHound/SharpHound over SMB (which utilizes NetBIOS) to probe and authenticate to other machines on the subnet. This 1-to-Many authentication pattern in a very short timeframe is a classic signature of adversary expansion.

Why A is correct

Lateral Movement (MITRE ATT&CK TA0008) is the act of an attacker pivoting from an initially compromised host to other systems in the network. Event ID 4624 with Logon Type 3 (Network) across multiple disparate machines is the definitive Windows Event Log footprint for this activity. The attacker is mapping the network and verifying administrative access on secondary targets.

Why the other options are wrong

B. User connecting to shared files: A normal user might connect to one or two file servers (Logon Type 3). A human user does not successfully authenticate to 50 different workstations within 45 seconds.

C. Admin maintenance: While an admin script (like a vulnerability scanner or SCCM) might look exactly like this, the SOC must treat sudden, unapproved 1:N network logons at 2 AM as an incident until it is definitively linked to an approved change ticket.

D. Malware spreading via SMB: While a worm (like WannaCry) spreads via SMB, the prompt explicitly focuses on successful *account logons* (Event 4624). Worms typically exploit vulnerabilities (like MS17-010) rather than relying on successful Windows auth logons. The broader, more accurate term for this auth-based pivoting is lateral movement.

MINI LESSON: Decoding Windows Logon Types

As a SOC analyst, Event ID 4624 (Successful Logon) is useless unless you check the Logon Type field. Memorize these three critical types for threat hunting:

Type 2 (Interactive): A user physically sat at the keyboard and logged in. (Hunt: Check for impossible travel or off-hours physical access).
Type 3 (Network): A user or service connected to this machine from across the network (e.g., accessing a mapped drive, PsExec, WMI). (Hunt: 1 source IP to many destinations = Lateral Movement).
Type 10 (RemoteInteractive): A user connected via Remote Desktop Protocol (RDP). (Hunt: Look for Type 10 logons originating from external IP addresses or unexpected internal subnets).

Ready to validate more SOC engineering and operational concepts?

Explore more CSA simulations