CSA (312-39) SOC Simulation Lab

Welcome to the Windows Artifacts Lab. In this simulation, you will learn how SOC analysts triage native Windows Event Logs to track down malicious lateral movement and unauthorized software installations.

Scenario Context

You are a Tier 3 SOC Analyst investigating a potential breach on a high-privilege jump server used by your infrastructure team. EDR telemetry flagged a generic suspicious binary executing from C:\Program Files (x86)\, but the EDR sensor was momentarily offline during the actual drop.

To build a timeline for the Incident Response ticket, you need to determine exactly when this unauthorized application was installed and which user account initiated the installation outside of business hours.

Security Environment

You pivot to your SIEM (Splunk) to query the native Windows Event Logs forwarded from the compromised server. You are preparing to write a query to find the installation footprint.

# SOC INVESTIGATION QUERY PREPARATION index=windows host=SRV-JUMP-01 # You need to filter by the correct Event Log channel to find: # ProviderName="MsiInstaller" OR EventID=1033 OR EventID=11707

* Note: To execute this query efficiently and find the exact installation package, you must specify the correct Windows Event Log channel (source).

Question

David is working as a SOC analyst in an institution, responsible for monitoring the security of critical infrastructure. During routine system monitoring, he detects several unauthorized applications running on a high-privilege Windows server that is only accessible by a restricted set of users. These applications were not part of any approved software deployment, and no users have admitted to installing them. He noticed that the installations occurred outside of business hours, and the affected server logs indicate potential system configuration changes around the same timeframe. He suspects that an attacker may have exploited misconfigurations or gained unauthorized access to install malicious software. Which log file should he examine to determine when and how these installations occurred?

SOC Hint: While the Security log tracks *who* logged in, the actual events generated by software installation packages (like MSI installers throwing Event ID 11707 "Installation completed successfully") are dumped into the log specifically designated for non-OS software and user-level programs.

🛡️ Expert Insight: Tier 3 Analysis

What is happening: An attacker has bypassed preventative controls and dropped an unauthorized application (likely a Remote Access Trojan or persistence mechanism packaged as an MSI/EXE). To trace the root cause, we must find the telemetry generated by the Windows installation framework.

Why C is correct: The Application Event log is the correct repository. When a user or attacker installs software (especially via Windows Installer / msiexec.exe), the resulting telemetry (such as Event ID 11707 for a successful install or Event ID 1033 for product installation) is written directly to the Application log. This log contains the exact timestamp, the package name, and the user context under which the installation was executed.

Why other options are wrong:

Security Event log (A): Crucial for IR, but it tracks authentication (logons, privilege escalation) and audit events (Process Creation - 4688), not the rich metadata of a software package installation.
System Event log (D): Tracks core OS components. If the malware installed a new Windows Service, it would generate Event ID 7045 here, but the installation of the *application* itself resides in the Application log.
Setup Event log (B): Exclusively tracks major OS-level updates, Windows feature installations, and domain role promotions. It does not track standard 3rd-party application installations.

Real-world SOC application: During a breach, "Shadow IT" or malicious tool installations are common. SOC analysts frequently run SIEM queries looking for source="WinEventLog:Application" AND EventCode IN (11707, 1033, 1040) to build an exact timeline of when an attacker dropped their toolkit onto a compromised asset.

Mini Lesson: Windows Event Log Triage

When hunting on a Windows endpoint, memorize these core channels:

Security: Focus here for "Who" and "Access". (Logons 4624, Process Creation 4688).
System: Focus here for "OS Changes". (Service installed 7045, Driver loaded).
Application: Focus here for "Software". (Crashes, MSI installs, SQL/IIS errors).

Ready to validate more SOC detection and response concepts?

Explore more CSA simulations →