Mission brief · H-307

Tier 3 analyst on the incident response bench

Tier 3 — deep host and forensics

Business important

Track default

You are acting as

the break-glass IR account `svc-ir`, checked out of the vault for this incident — never the compromised identity

How you got here

The detection fired in the EDR console. You opened a live-response session from that detection, so your shell rides the EDR agent channel — containing the host will *not* cut you off, which is exactly why you contain from here rather than over SSH.

Your access

EDR console (detections + live response)
Endpoint detection & response
- Read the detection and process tree
- Look up host criticality, owner and VIP flags
- Open a live-response session on the host
- Contain the host over the agent channel
- Not yours: Disable user accounts (that's the identity team)
- Not yours: Delete evidence
Live-response shell on the affected host
Host shell session
- Read the filesystem, logs and running state
- Collect a triage package
- Not yours: Reboot or reimage without owner approval

What's at stake

The affected host

Owner: The system's business owner, named on the asset record

Containing a host you haven't identified can stop revenue. Check criticality and owner before you isolate anything.

Rules of engagement

You may act alone

Investigate from the live-response session
Collect evidence and triage packages
Contain a standard-criticality host

Ask a human first

Containing a mission-critical host — asset owner and on-call manager first
Disabling a user identity — identity team, and HR/legal if it looks like an insider

How much help do you want?

Objectives stay open and every step explains why it matters before it tells you what to run. Hints are free.

Graded case walkthrough

Open a lab as a live case and advance it one node at a time. The score beside each step is the lab rubric re-evaluated against what the engine actually did.

Lab

At 04:18 an account was created on the Northwind domain controller and added to Administrators, a service followed, and at 04:41 the Security log was cleared by that same account. Reconstruct what the clearing was meant to hide, contain the controller, and record the anti-forensics.

Range guide

Guided

Every step explains why it matters before it tells you what to do. Reasoning is free in guided mode.

Prove it

1. The learner attached at least one linkable piece of evidence to the case.
Why this step: The learner attached at least one linkable piece of evidence to the case. It carries 10 points on the investigation dimension.
2. Nothing was changed in the estate before evidence had been gathered.
Why this step: Nothing was changed in the estate before evidence had been gathered. It carries 10 points on the investigation dimension.
3. The analyst worked the domain controller directly instead of grading the alert text.
Why this step: The analyst worked the domain controller directly instead of grading the alert text. It carries 10 points on the investigation dimension.
4. The analyst can name the event that proves the audit log was cleared.
Why this step: The analyst can name the event that proves the audit log was cleared. It carries 10 points on the investigation dimension.
5. The rogue administrator account was identified from creation and group-add events.
Why this step: The rogue administrator account was identified from creation and group-add events. It carries 10 points on the investigation dimension.
6. The external peer was proven from the controller's own socket table.
Why this step: The external peer was proven from the controller's own socket table. It carries 10 points on the investigation dimension.
7. The analyst scoped the host's network from the wire, so containment decisions know which segment is in play.
Why this step: The analyst scoped the host's network from the wire, so containment decisions know which segment is in play. It carries 5 points on the investigation dimension.
8. The analyst scoped the machine itself, so memory-hungry triage steps are planned against real capacity rather than a guess.
Why this step: The analyst scoped the machine itself, so memory-hungry triage steps are planned against real capacity rather than a guess. It carries 3 points on the investigation dimension.
9. Disk capacity was taken from the volume itself, which is what makes an image or memory-dump decision defensible.
Why this step: Disk capacity was taken from the volume itself, which is what makes an image or memory-dump decision defensible. It carries 3 points on the investigation dimension.

Decide and act

1. The workflow reached a terminal success state on the graded run.
Why this step: The workflow reached a terminal success state on the graded run. It carries 20 points on the behavior dimension.
2. A consequential action passed through a human approval gate.
Why this step: A consequential action passed through a human approval gate. It carries 15 points on the safety dimension.
3. No non-idempotent operation was retried without an idempotency key.
Why this step: No non-idempotent operation was retried without an idempotency key. It carries 10 points on the efficiency dimension.
4. Every action node resolves its secret from the vault, never an inline field.
Why this step: Every action node resolves its secret from the vault, never an inline field. It carries 10 points on the configuration dimension.
5. No innocent asset in the alert batch was contained, disabled or revoked.
Why this step: No innocent asset in the alert batch was contained, disabled or revoked. It carries 15 points on the behavior dimension.
6. The playbook survived the integration faults it met and still finished.
Why this step: The playbook survived the integration faults it met and still finished. It carries 15 points on the configuration dimension.
7. The live beacon was identified by PID before anything was contained.
Why this step: The live beacon was identified by PID before anything was contained. It carries 10 points on the behavior dimension.
8. The scheduled task that re-arms the implant was found despite its plausible name.
Why this step: The scheduled task that re-arms the implant was found despite its plausible name. It carries 10 points on the behavior dimension.
9. The compromised domain controller is isolated at end state.
Why this step: The compromised domain controller is isolated at end state. It carries 15 points on the behavior dimension.
10. The rogue administrator account is disabled at end state.
Why this step: The rogue administrator account is disabled at end state. It carries 10 points on the behavior dimension.

Write it up

1. The case carries an analyst closure note explaining the outcome.
Why this step: The case carries an analyst closure note explaining the outcome. It carries 10 points on the explanation dimension.
2. The machine-wide Run key persistence was recorded, so eradication is complete.
Why this step: The machine-wide Run key persistence was recorded, so eradication is complete. It carries 10 points on the explanation dimension.
3. A post-incident timeline was filed: stolen session, account creation, promotion, service install, log clear, containment.
Why this step: A post-incident timeline was filed: stolen session, account creation, promotion, service install, log clear, containment. It carries 15 points on the explanation dimension.

Your cases

No cases opened yet.