Prove it before you isolate: hands-on containment Start this lab

Why this matters

Automation is only as honest as the facts it fires on. This lab hands you the host itself — the same simulated estate, filesystem and network a VM lab boots into — and refuses to record a finding you cannot point at in your own command output, so the playbook you then build is scoped by evidence rather than by the alert's guesswork.

Concepts

Objectives graded

• Work the host directly in the range console, on the same estate and network the VM labs use
• Prove the beacon: PID, peer address and the unit file that keeps it alive
• Build a containment playbook that only touches what the evidence implicates

MITRE ATT&CK coverage

A systemd service unit keeps an unsigned binary alive on a finance workstation while it beacons out over HTTPS; the analyst enumerates processes and sockets on the host itself before anything is contained.

What each rubric rule proves

• The workflow reached a terminal success state on the graded run.

  behavior · weight 20 · T1489 Service Stop (Impact)

• A consequential action passed through a human approval gate.

  safety · weight 15 · T1489 Service Stop (Impact)

• No non-idempotent operation was retried without an idempotency key.

  efficiency · weight 10 · T1049 System Network Connections Discovery (Discovery)

• Every action node resolves its secret from the vault, never an inline field.

  configuration · weight 10 · T1049 System Network Connections Discovery (Discovery)

• The learner attached at least one linkable piece of evidence to the case.

  investigation · weight 10 · T1049 System Network Connections Discovery (Discovery)

• The case carries an analyst closure note explaining the outcome.

  explanation · weight 10 · T1049 System Network Connections Discovery (Discovery)

• No innocent asset in the alert batch was contained, disabled or revoked.

  behavior · weight 15 · T1489 Service Stop (Impact)

• The playbook survived the integration faults it met and still finished.

  configuration · weight 15 · T1049 System Network Connections Discovery (Discovery)

• Nothing was changed in the estate before evidence had been gathered.

  investigation · weight 10 · T1057 Process Discovery (Discovery)

• The analyst actually worked the host in the range console.

  investigation · weight 15 · T1057 Process Discovery (Discovery)

• The beaconing process was identified by PID from the live process table.

  investigation · weight 10 · T1057 Process Discovery (Discovery)

• The command-and-control address was read off the host's own socket table.

  investigation · weight 10 · T1071.001 Application Layer Protocol: Web Protocols (Command and Control)

• The persistence mechanism was located on disk, not guessed from the alert.

  behavior · weight 10 · T1543.002 Create or Modify System Process: Systemd Service (Persistence)

• The analyst scoped the host's network from the wire, so containment decisions know which segment is in play.

  investigation · weight 5

• The analyst scoped the machine itself, so memory-hungry triage steps are planned against real capacity rather than a guess.

  investigation · weight 3

• Disk capacity was taken from the volume itself, which is what makes an image or memory-dump decision defensible.

  investigation · weight 3

Common mistakes

• Filing values read off the alert instead of values proved on the host.
• Isolating everything in the batch, including the finance peer that is not involved.
• Stopping the process and leaving the service unit enabled on disk.

Same idea, three vendors

Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.

The same concepts in shipping products

The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.