CSA (312-39) SOC Simulation Lab

In this lab, you will learn how to track unauthorized file modifications. You will evaluate the purpose of various system logs to identify insider threats and compromised accounts within a corporate file-sharing environment.

Scenario Context

Bob, a SOC analyst at GlobalFinance Corp, is investigating a potential insider threat. The Finance Director reported that the highly confidential Q3_Earnings_Draft.xlsx on the central Windows File Server was altered. The file's metadata shows the modification occurred at 03:14 AM local time, well outside normal business hours. Bob needs to run a query in the SIEM to figure out exactly which user account modified the file.

Security Environment

SIEM Alert Trigger - Windows Object Access Event (Filtered by Bob):

Log Name: Security Source: Microsoft-Windows-Security-Auditing Event ID: 4663 Task Category: File System Level: Information Keywords: Audit Success Date: 10/24/2023 03:14:22 AM Description: An attempt was made to access an object. Subject: Security ID: CORP\j.doe Account Name: j.doe Account Domain: CORP Object: Object Type: File Object Name: E:\Shares\Finance\Q3_Earnings_Draft.xlsx Access Request Information: Accesses: WriteData (or AddFile) AppendData (or AddSubdirectory)

Analyst Note: Object Access auditing must be enabled via Group Policy (GPO) and SACLs must be applied to the folder for these logs to generate.

Question

Bob is a SOC analyst in a multinational corporation that relies on a centralized file-sharing system for storing confidential project documents. One morning, he notices that few critical financial records stored on the shared server appear to have been altered without authorization. Upon further analysis, he discovers that the version history confirms unexpected changes made outside of business hours. Now he must investigate by inspecting the logs. Which log should he check to determine who accessed the files and when the modifications occurred?

Analyst Hint: Which specific log within a Windows operating system records "Object Access" (like reading, writing, or deleting files) as part of its auditing policy?

Expert Insight

1. What is Happening

A file has been altered anomalously on a centralized file server. To identify the culprit, the SOC analyst must look at operating-system-level audit trails that record granular interactions with the filesystem. In enterprise environments (predominantly Windows), tracking file reads, writes, and deletes relies heavily on local auditing configurations.

2. Why Option D is Correct

Security logs are the correct answer. In Windows Server environments, the Windows Security Event Log is responsible for recording auditing events. Specifically, when a file server is configured to audit file access via SACLs (System Access Control Lists), actions like opening, modifying, or deleting a file generate Event ID 4656 (Handle Requested) and Event ID 4663 (Attempt made to access an object). These logs contain the exact Account Name, timestamp, and Accesses requested (e.g., WriteData).

3. Why the Other Options are Wrong

A (Network logs): Network logs (PCAP, NetFlow) show traffic volume and IP conversations. While they might show SMB traffic between a client and the file server, they do not inherently decode the payload to show which user modified which file.
B (Firewall logs): Firewalls inspect traffic at the perimeter or between network segments. They show allowed/blocked connections (IPs and Ports) but lack context regarding application-layer file operations or local user identities manipulating files.
C (Authentication logs): While critical for IR, authentication logs (e.g., Event ID 4624 Logon) only tell you when and from where a user logged into the network or server. They do not record what the user did (like modifying a spreadsheet) after the session was established.

Mini Lesson: Correlation in the SIEM

A single log rarely tells the whole story. As a SOC analyst, you must chain events together.

The Investigation Playbook:
1. Identify the modification: Query the Security Log for Event ID 4663 (Object Access) targeting *Q3_Earnings_Draft.xlsx. You find user j.doe performed WriteData at 03:14 AM.
2. Identify the origin: Query the Security Log for Event ID 4624 (Successful Logon) for user j.doe shortly before 03:14 AM. Look at the Logon Type. Was it a Type 3 (Network Logon)? If so, what is the Source Network Address?
3. Trace the attacker: If the source IP belongs to a VPN pool, pivot to your VPN logs to find where in the world the connection originated, and confirm if j.doe's credentials were compromised.

Looking to master more SOC scenarios and exam topics?

Explore more CSA simulations