SOC Capstone: End-to-End Investigation from Alert to Report

Prerequisites

All COA-C01 and COA-C02 cards completed.

Why This Lesson Matters

Everything learned in COA comes together here: a realistic multi-stage incident delivered as a SIEM log set. You will receive logs, work through the investigation, produce a timeline, map to ATT&CK, write an investigation report, and make an escalation decision. This is the format of a real L2 SOC investigation.

1. Investigation Methodology: The SOC Diamond

A structured investigation follows four axes simultaneously:

              What happened?
              (Timeline)
                  |
What tools?  ─────+───── What was impacted?
(Artefacts)       |       (Scope)
                  |
              Who did it?
              (Attribution / context)

Work all four axes in parallel. A timeline without scope assessment is incomplete. Attribution without timeline is speculation.

2. The Log Set

Context: At 14:30 UTC, a SIEM composite rule fired: "Brute force success + lateral movement detected." The event set covers one host (WS-042) and one server (SRV-001) over a 45-minute window.

Available logs: - auth.log from WS-042 (SSH) - Windows Security EVTX export from SRV-001 (Events 4624, 4625, 4672, 7045) - Sysmon operational log from SRV-001 (Events 1, 3, 11) - Nginx access.log from the internal web server on SRV-001

3. Investigation Steps

Step 1: Characterise the brute force

# auth.log: count failed logins by source
grep "Failed password" auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -rn

# Result: 
# 47  185.220.101.5  ← external IP, 47 failures
#  3  10.0.0.1       ← internal, normal

# Find the success
grep "Accepted" auth.log | grep "185.220.101.5"
# Jun 8 14:30:48: Accepted password for alice from 185.220.101.5

Finding 1: SSH brute force from 185.220.101.5 — 47 failures, 1 success. Account: alice.

Step 2: Track activity post-login

# What did alice do after SSH login?
awk '/14:30:48/,/14:35/' auth.log | grep alice
# 14:30:49 sudo: alice → root: /bin/bash
# → alice immediately escalated to root

Finding 2: Privilege escalation to root within 1 second of login. T1548.003 — Sudo and Sudo Caching.

Step 3: Check lateral movement to SRV-001

# Windows Security log: find Type 3 logon from WS-042 to SRV-001
Get-WinEvent -Path .security.evtx | Where-Object {
  $_.Id -eq 4624 -and $_.Properties[8].Value -eq 3   # Type 3
} | Select-Object TimeCreated, @{n='User';e={$_.Properties[5].Value}},
  @{n='Src';e={$_.Properties[19].Value}}

# Result:
# 14:31:15  Administrator  10.0.0.42 (= WS-042 internal IP)

Finding 3: Lateral movement from WS-042 (compromised) to SRV-001 using Administrator account. T1021.002 — SMB/Windows Admin Shares.

Step 4: Check persistence on SRV-001

Get-WinEvent -Path .system.evtx -FilterHashtable @{Id=7045} |
  Select-Object TimeCreated, @{n='Name';e={$_.Properties[0].Value}},
  @{n='ImagePath';e={$_.Properties[1].Value}}

# Result:
# 14:32:41  WindowsUpdateHelper  C:UsersPublicDocumentsupdate.exe

Finding 4: Service persistence installed on SRV-001. T1543.003. Binary in public Documents directory (red flag).

Step 5: Trace the web shell

# Nginx access.log: find POST requests followed by suspicious GETs
grep "POST" access.log | grep "200" | awk '{print $7}'
# /upload.php

grep "update.php|update.exe|cmd=" access.log
# 14:33:02 GET /uploads/update.php?cmd=id 200
# 14:33:05 GET /uploads/update.php?cmd=cat+/etc/passwd 200

Finding 5: Web shell deployed at /uploads/update.php. T1505.003.

4. Enrichment

185.220.101.5 → VirusTotal: 31/90, tagged "brute-force", "Tor exit node"
update.exe SHA256 → Malware Bazaar: CobaltStrike Beacon loader
C2 IP (from Sysmon 3) → 203.0.113.55 → already known (see COA-K005 scenario)

5. ATT&CK Mapping

6. Investigation Report Structure

INCIDENT REPORT — COA-CAPSTONE-001
Severity: P1 — Critical
Date: 2026-06-08 14:30–15:02 UTC
Analyst: [Name]

EXECUTIVE SUMMARY
External attacker brute-forced SSH credentials for account alice on WS-042,
escalated to root, moved laterally to SRV-001, installed persistence via
Windows service, deployed a web shell, and established C2 communication.
Active compromise confirmed. Immediate containment required.

TIMELINE
14:30:02  Brute force begins from 185.220.101.5 (T1110.001)
14:30:48  SSH login success — account alice
14:30:49  Sudo → root escalation (T1548.003)
14:31:15  Lateral movement to SRV-001 as Administrator (T1021.002)
14:32:41  Service persistence installed: WindowsUpdateHelper (T1543.003)
14:33:02  Web shell deployed and executed: /uploads/update.php (T1505.003)
14:34:XX  C2 beacon to 203.0.113.55 (T1071.001)

SCOPE
- WS-042: confirmed compromised (initial access, privilege escalation)
- SRV-001: confirmed compromised (lateral movement, persistence, web shell)
- Unknown: other hosts reached from SRV-001 during 14:32–15:02 window

IOC SUMMARY
- Source IP: 185.220.101.5 (Tor exit node, known brute-force source)
- C2 IP: 203.0.113.55 (TrickBot C2, known)
- Malware hash: a3f9b2... (CobaltStrike Beacon loader)
- Web shell: /uploads/update.php
- Persistence service: WindowsUpdateHelper (C:UsersPublicDocumentsupdate.exe)

RECOMMENDED ACTIONS
1. IMMEDIATE: Isolate WS-042 and SRV-001 from the network
2. Reset alice password; audit all accounts on both hosts
3. Remove web shell: delete /uploads/update.php
4. Remove persistence: Stop/delete WindowsUpdateHelper service, delete update.exe
5. Block 185.220.101.5 and 203.0.113.55 at perimeter firewall
6. Hunt for 203.0.113.55 connections in full network log (last 30 days)
7. Initiate forensic imaging of both hosts before remediation

7. Common Mistakes

Mistake 1: Stopping investigation after finding the first compromise. WS-042 was the initial entry point but SRV-001 was the primary target. Always follow the chain to its furthest point before scoping.

Mistake 2: Recommending remediation before imaging. If you remove the web shell before forensic imaging, you destroy evidence. Always image first, remediate second.

Mistake 3: Omitting the "unknown scope" acknowledgement. You do not know what else SRV-001 reached after compromise. Acknowledging this in the report drives the hunt activity that may find additional compromised hosts.

8. Lab

Assessment mode: ctf

challenge_spec_id: 207 — Brute → pivot

You are given the full log set described in this lesson (auth.log, EVTX, Sysmon, access.log).

Task: 1. Confirm the brute-force source IP 2. Identify the account compromised 3. Identify the service name used for persistence on SRV-001 4. Identify the web shell filename 5. Submit: PREFIX{src_ip:account:service_name:shell_filename}

9. Framework Alignment

10. Further Reading

• SANS FOR508 — Advanced Incident Response and Threat Hunting course
• The DFIR Report — https://thedfirreport.com — Real-world incident reports using the same methodology
• Google Chronicle Security Operations — Case study of enterprise SOC investigation workflows
• Atomic Red Team — https://github.com/redcanaryco/atomic-red-team — Simulated attacker techniques for SOC validation

["Apply the four-axis SOC investigation diamond to structure a multi-stage incident investigation across auth, Windows Security, Sysmon, and web access logs", "Produce a complete P1 incident report including executive summary, UTC timeline with ATT&CK mappings, scope statement, IOC list, and prioritised remediation actions", "Submit a correctly formatted multi-field CTF flag derived from correlated evidence across four log sources"]

Prerequisites → Why this matters → SOC investigation methodology (Diamond model) → Log set context → Five investigation steps (brute force, privilege escalation, lateral movement, persistence, web shell) → Enrichment → ATT&CK mapping table → Full incident report template → Common mistakes → CTF lab (spec 207) → Framework alignment → Further reading