Someone else's memory Start this lab

Why this matters

Injection breaks the assumption that a process's behavior belongs to its own code, so process names stop being evidence.

Concepts

Objectives graded

• Name the module that was written into the trusted process
• Tell attacker memory access apart from the endpoint sensor's own
• Isolate the machine rather than killing the host process

MITRE ATT&CK coverage

Code written into a trusted process, so the outbound session belongs to something nobody questions.

What each rubric rule proves

• The workflow reached a terminal success state on the graded run.

  behavior · weight 20

• A consequential action passed through a human approval gate.

  safety · weight 15

• No non-idempotent operation was retried without an idempotency key.

  efficiency · weight 10

• Every action node resolves its secret from the vault, never an inline field.

  configuration · weight 10

• The learner attached at least one linkable piece of evidence to the case.

  investigation · weight 10

• The case carries an analyst closure note explaining the outcome.

  explanation · weight 10

• No innocent asset in the alert batch was contained, disabled or revoked.

  behavior · weight 15

• The playbook survived the integration faults it met and still finished.

  configuration · weight 15

• Nothing was changed in the estate before evidence had been gathered.

  investigation · weight 10

• The learner named the injected module rather than the host process it landed in.

  investigation · weight 20 · T1055.001 Process Injection: Dynamic-link Library Injection (Defense Evasion)

• Memory access by the attacker was told apart from the sensor's own scanning.

  investigation · weight 15 · T1070.004 Indicator Removal: File Deletion (Defense Evasion)

• The machine was isolated while the injected thread was still running.

  behavior · weight 20 · T1071.001 Application Layer Protocol: Web Protocols (Command and Control)

Common mistakes

• Blocking the signed system binary the code was injected into.
• Treating the deletion of the launcher as the end of the intrusion.

Same idea, three vendors

Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.

The same concepts in shipping products

The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.