CSA (312-39) SOC Simulation Lab

Welcome to the SOC. Today, we're investigating a major data exfiltration event. You will learn how to correlate network egress anomalies with non-technical attack vectors that bypass traditional perimeter defenses.

Scenario Context

Your team received a high-severity Data Loss Prevention (DLP) alert indicating that a large archive of sensitive employee data (W-2s and PII) was uploaded to an external file-sharing site from the HR subnet.

The endpoint logs show that the HR Manager authenticated normally and manually initiated the file transfer. There are no signs of malware, unauthorized remote access, or endpoint compromise. You pivot to the email security gateway to understand the context surrounding the HR Manager's actions.

Security Environment

Review the correlated logs tracking the incident timeline:

// Microsoft 365 Defender - Email Flow Logs Time: 2023-11-14T08:12:05Z Sender_IP: 198.51.100.45 (External VPS) Sender_Address: ceo@g1obaltech-corp.com (Lookalike Domain) Recipient_Address: hr.manager@globaltech.com Subject: URGENT: Q4 Tax Data Verification Required Attachment: Authorization_Directive.pdf Authentication: SPF (Fail), DKIM (None), DMARC (Fail) // Splunk SIEM - DLP / Endpoint Data Exfiltration Alert Time: 2023-11-14T08:45:22Z Rule: High Volume of PII Data Egress User: globaltech\hr.manager Process: msedge.exe Destination_URL: hxxps://file-drop.external-share.com/upload Bytes_Out: 45.2 MB Action: ALLOWED (User Override)

Note: The HR manager bypassed the DLP warning prompt because they believed the "CEO's" instructions were urgent and legitimate after calling the fake phone number in the email.

Question

You are working with a team of SOC analysts in a large corporation company, the HR department receives an urgent email from someone impersonating a high-level executive, requesting immediate transfer of sensitive employee data. The email includes an official-looking document and a phone number for verification. Feeling pressured, the HR manager calls the number and confirms the request. After transfer of the data, you notice this unusual data transfer and your team investigates to discover that the email was fraudulent, and the executive had no knowledge of the request. What type of attack did your HR department face in this scenario?

Expert Insight: Senior SOC Analyst

What is happening here?
This is a classic Business Email Compromise (BEC) scenario, specifically CEO Fraud, augmented with Voice Phishing (Vishing). The attacker registered a lookalike domain ("g1obaltech" instead of "globaltech") to bypass visual inspection. By providing a fake phone number, the attacker controlled the verification channel, entirely bypassing technical security controls by manipulating the human element.
Why Option C is Correct:
This is a textbook Social Engineering Attack. Social engineering relies on psychological manipulation (urgency, authority) rather than technical exploitation to trick users into making security mistakes or giving away sensitive information.
Why the Others are Wrong:
A (Web-Based Intrusion) & B (Application Exploit): The attacker didn't hack the HR systems or exploit a software bug. The system functioned exactly as intended; the user was the one who was compromised.
D (Credential Theft): While social engineering is often used to steal credentials (e.g., via a phishing login page), in this specific scenario, the attacker didn't steal the HR manager's password. The HR manager used their own valid credentials to willingly export and send the data.

SOC Mini-Lesson: Detecting the "Human Exploit"

As a SOC analyst, detecting social engineering requires correlating technical telemetry with human behavior anomalies. Here is how we build defense-in-depth against BEC:

  • Email Authentication (DMARC/DKIM/SPF): Look at the logs above. The SPF and DMARC checks failed. The Email Gateway should have been configured to quarantine or reject emails failing DMARC rather than just delivering them.
  • Lookalike Domain Detection: Implement SIEM rules to alert when newly registered domains with high Levenshtein distance similarity to your corporate domain send emails inbound.
  • Data Loss Prevention (DLP): The DLP caught the event, but the policy allowed a "User Override". For highly sensitive data (W-2s), DLP policies should enforce strict blocking, requiring a secondary approval from IT/Security, removing the sole burden from the pressured employee.

Learn how to detect and mitigate advanced persistent threats.

Explore more CSA simulations →