Follow a breach across the subnets it crossed Start this lab

Why this matters

Intrusions that stay inside one subnet are the easy ones. Real damage happens when an intruder crosses a boundary the estate deliberately built, usually through the one port that boundary permits, and then leaves through a path that was already approved. Following that route is what turns a single alerting host into an accurate incident scope.

Concepts

Objectives graded

• Trace an intrusion across three zones using host logs, sockets and the rule base
• Explain a crossing by the permit that allowed it rather than by the tool that made it
• Scope lateral reach inside the server farm and contain the compromised host

MITRE ATT&CK coverage

An intruder enters through the published web host, crosses into the server farm on the single permitted port, mounts a file share and exfiltrates over the egress path the rule base already allows.

What each rubric rule proves

• The workflow reached a terminal success state on the graded run.

  behavior · weight 20 · T1190 Exploit Public-Facing Application (Initial Access)

• A reversible action passed through a human approval gate.

  safety · weight 15 · T1190 Exploit Public-Facing Application (Initial Access)

• No non-idempotent operation was retried without an idempotency key.

  efficiency · weight 10 · T1071.001 Application Layer Protocol: Web Protocols (Command and Control)

• Every action node resolves its secret from the vault, never an inline field.

  configuration · weight 10 · T1041 Exfiltration Over C2 Channel (Exfiltration)

• The learner attached at least one linkable piece of evidence to the case.

  investigation · weight 10 · T1210 Exploitation of Remote Services (Lateral Movement)

• The case carries an analyst closure note explaining the outcome.

  explanation · weight 10 · T1190 Exploit Public-Facing Application (Initial Access)

• No innocent asset in the alert batch was contained, disabled or revoked.

  behavior · weight 15 · T1041 Exfiltration Over C2 Channel (Exfiltration)

• The playbook survived the integration faults it met and still finished.

  configuration · weight 15 · T1071.001 Application Layer Protocol: Web Protocols (Command and Control)

• Nothing was changed in the estate before evidence had been gathered.

  investigation · weight 10 · T1210 Exploitation of Remote Services (Lateral Movement)

• The host was worked live rather than triaged from the perimeter alert alone.

  investigation · weight 10 · T1210 Exploitation of Remote Services (Lateral Movement)

• The seat was placed in the estate before the crossing was described.

  investigation · weight 10 · T1016 System Network Configuration Discovery (Discovery)

• The crossing was attributed to a specific DMZ host from the server's own logs.

  investigation · weight 10 · T1190 Exploit Public-Facing Application (Initial Access)

• The port used for the crossing was identified, which explains how it passed the perimeter.

  investigation · weight 10 · T1210 Exploitation of Remote Services (Lateral Movement)

• The live outbound channel was found and attributed to a process.

  behavior · weight 10 · T1071.001 Application Layer Protocol: Web Protocols (Command and Control)

• The exfiltration path is described by the rule that allowed it, which is what gets changed.

  behavior · weight 15 · T1041 Exfiltration Over C2 Channel (Exfiltration)

• The compromised application server is isolated at end state.

  behavior · weight 15 · T1190 Exploit Public-Facing Application (Initial Access)

• Lateral reach inside the server farm was recorded, so scoping is complete.

  explanation · weight 10 · T1021.002 SMB/Windows Admin Shares (Lateral Movement)

• A cross-subnet timeline was filed: entry, crossing, staging, egress, containment.

  explanation · weight 10 · T1041 Exfiltration Over C2 Channel (Exfiltration)

• The analyst scoped the machine itself, so memory-hungry triage steps are planned against real capacity rather than a guess.

  investigation · weight 3

• Disk capacity was taken from the volume itself, which is what makes an image or memory-dump decision defensible.

  investigation · weight 3

Common mistakes

• Reporting the alerting host and stopping, without the zone the intrusion entered from.
• Describing the exfiltration by the process name rather than by the path that permitted it.
• Missing the file-share mount because the socket table was read but the process list was not.
• Containing before the crossing is documented, losing the evidence that scopes the incident.

Same idea, three vendors

Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.

The same concepts in shipping products

The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.