Mission brief · H-301

Tier 3 analyst on the incident response bench, working a confirmed breach

Tier 3 — deep host and forensics

Business important

You are acting as

the break-glass IR account `svc-ir`, checked out of the vault at the start of this incident. You are deliberately *not* authenticating as `svc-portal`, the service account the attacker already used.

How you got here

01:40 — the EDR detection on nw-portal01 escalated to you from Tier 2 after they confirmed the upload bypass. You opened a live-response session on the host from that detection using `svc-ir`. Your shell rides the EDR agent channel, not the corporate network, so containment will not cut your session.

Your access

EDR console — detection NW-4471 on nw-portal01
Endpoint detection & response
- Read the detection, process tree and network connections
- See host criticality, business owner and data classification
- Open a live-response session
- Contain the host (agent channel stays up)
- Not yours: Disable `svc-portal` yourself — the identity team owns that
Live-response shell on nw-portal01
Host shell session
- Read the web root, access logs, cron and auth logs
- Hash and collect artifacts
- Not yours: Modify or delete anything on the host — this is now evidence
Incident record NW-INC-118
Ticketing / ITSM
- Attach evidence
- Write the post-incident record

What's at stake

nw-portal01 — Northwind customer portal (internet-facing)

Owner: Portal engineering, on-call: R. Okafor. Finance DB owner is a separate escalation.

The portal takes live customer transactions. Containing it stops them. The finance database it reached is mission-critical — containing *that* without the owner is a much bigger call than containing the portal.

Rules of engagement

You may act alone

Investigate from the live-response session
Collect and hash evidence
Contain nw-portal01 once you've confirmed it's the compromised host

Ask a human first

Containing or blocking the finance database — mission critical, owner approval first
Disabling `svc-portal` — identity team; it will break the portal for legitimate traffic too
Any customer-facing statement — legal and communications

Where this sits in a real SOC

This is Tier 3 work. If your Tier 1/2 analysts are working out of an EDR or SIEM queue, this is the lab that shows them what happens after they escalate.

How much help do you want?

Objectives stay open and every step explains why it matters before it tells you what to run. Hints are free.

Graded case walkthrough

Open a lab as a live case and advance it one node at a time. The score beside each step is the lab rubric re-evaluated against what the engine actually did.

Lab

The customer portal was compromised through an upload bypass at 01:12, the portal service account reached the finance database, and 1.4GB left the building. Work the box, prove the breach, contain what the evidence implicates, then write the post-incident record.

Range guide

Guided

Every step explains why it matters before it tells you what to do. Reasoning is free in guided mode.

Prove it

1. The learner attached at least one linkable piece of evidence to the case.
Why this step: The learner attached at least one linkable piece of evidence to the case. It carries 10 points on the investigation dimension.
2. Nothing was changed in the estate before evidence had been gathered.
Why this step: Nothing was changed in the estate before evidence had been gathered. It carries 10 points on the investigation dimension.
3. The analyst worked the compromised server directly instead of grading the alert.
Why this step: The analyst worked the compromised server directly instead of grading the alert. It carries 10 points on the investigation dimension.
4. Initial access was located on disk: the web shell in the upload directory.
Why this step: Initial access was located on disk: the web shell in the upload directory. It carries 10 points on the investigation dimension.
5. The external peer was read off the host's own socket table and its access log.
Why this step: The external peer was read off the host's own socket table and its access log. It carries 10 points on the investigation dimension.
6. Lateral movement was proven: the portal account reached the finance database.
Why this step: Lateral movement was proven: the portal account reached the finance database. It carries 10 points on the investigation dimension.
7. The staged archive was found, so the scope of the loss can be stated rather than guessed.
Why this step: The staged archive was found, so the scope of the loss can be stated rather than guessed. It carries 10 points on the investigation dimension.
8. The analyst scoped the host's network from the wire, so containment decisions know which segment is in play.
Why this step: The analyst scoped the host's network from the wire, so containment decisions know which segment is in play. It carries 5 points on the investigation dimension.
9. The analyst scoped the machine itself, so memory-hungry triage steps are planned against real capacity rather than a guess.
Why this step: The analyst scoped the machine itself, so memory-hungry triage steps are planned against real capacity rather than a guess. It carries 3 points on the investigation dimension.
10. Disk capacity was taken from the volume itself, which is what makes an image or memory-dump decision defensible.
Why this step: Disk capacity was taken from the volume itself, which is what makes an image or memory-dump decision defensible. It carries 3 points on the investigation dimension.

Decide and act

1. The workflow reached a terminal success state on the graded run.
Why this step: The workflow reached a terminal success state on the graded run. It carries 20 points on the behavior dimension.
2. A consequential action passed through a human approval gate.
Why this step: A consequential action passed through a human approval gate. It carries 15 points on the safety dimension.
3. No non-idempotent operation was retried without an idempotency key.
Why this step: No non-idempotent operation was retried without an idempotency key. It carries 10 points on the efficiency dimension.
4. Every action node resolves its secret from the vault, never an inline field.
Why this step: Every action node resolves its secret from the vault, never an inline field. It carries 10 points on the configuration dimension.
5. No innocent asset in the alert batch was contained, disabled or revoked.
Why this step: No innocent asset in the alert batch was contained, disabled or revoked. It carries 15 points on the behavior dimension.
6. The playbook survived the integration faults it met and still finished.
Why this step: The playbook survived the integration faults it met and still finished. It carries 15 points on the configuration dimension.
7. The live transfer was identified by PID before anything was contained.
Why this step: The live transfer was identified by PID before anything was contained. It carries 10 points on the behavior dimension.
8. The compromised portal server is isolated at end state.
Why this step: The compromised portal server is isolated at end state. It carries 15 points on the behavior dimension.
9. The service account the attacker used is disabled pending credential rotation.
Why this step: The service account the attacker used is disabled pending credential rotation. It carries 10 points on the behavior dimension.

Write it up

1. The case carries an analyst closure note explaining the outcome.
Why this step: The case carries an analyst closure note explaining the outcome. It carries 10 points on the explanation dimension.
2. Root cause is recorded as the unpatched application version, not as analyst error.
Why this step: Root cause is recorded as the unpatched application version, not as analyst error. It carries 10 points on the explanation dimension.
3. A post-incident timeline was filed: initial access, lateral movement, exfiltration, containment.
Why this step: A post-incident timeline was filed: initial access, lateral movement, exfiltration, containment. It carries 15 points on the explanation dimension.

Your cases

No cases opened yet.