Cybrary ForgeCYBRARY / FORGE
Back to SOAR Range

SOAR console

The incident as a response desk holds it: one playbook per technique on the run, each step with its owner, its clock, its approval gate and the evidence it has to leave behind. Back to the breach timeline.

Seeded breach — the whole chain

The intrusion this range seeds into the estate, step by step, in the order it runs. Every step below puts real frames on the wire of Reps: The Whole Breach, so the capture tools, the alerts and these playbooks all describe the same breach.

  1. 00:00Exploit Public-Facing ApplicationT1190The internet-facing application is exploited on an unpatched version.alerts: Unauthenticated request to a management path
  2. 03:00Command and Scripting Interpreter: Unix ShellT1059.004A payload is run on the exploited host from the web process.graded case C-341alerts: Shell fetched and ran a remote script
  3. 06:00Application Layer Protocol: WebT1071.001The host starts calling out on a fixed interval to an address nobody has seen.alerts: Fixed-interval outbound check-in
  4. 10:00Create or Modify System Process: Systemd ServiceT1543.002A scheduled task is written so the foothold survives a reboot.alerts: New service unit enabled outside change control
  5. 14:00Domain Account DiscoveryT1087.002The directory is read for accounts, groups and service names.graded case C-342alerts: Bulk directory read
  6. 19:00AS-REP RoastingT1558.004A service ticket is requested for an offline crack.graded case C-343alerts: Pre-authentication not required
  7. 25:00Remote Services: RDPT1021.001The cracked account is used to reach a second machine.alerts: Remote session between machines that never talk
  8. 29:00Impair Defenses: Disable or Modify ToolsT1562.001Endpoint protection is turned down on the second machine.alerts: Endpoint protection stopped
  9. 33:00Data from Network Shared DriveT1039A file share is read end to end with the service account.graded case C-344alerts: Share read outside the machine's history
  10. 38:00Local Data StagingT1074.001The interesting files are collected into one archive.graded case C-345alerts: Large archive built from many shares
  11. 42:00Inhibit System RecoveryT1490An attempt to remove the recovery points — turned away, and it alerts.graded case C-346alerts: Backup catalog deleted
  12. 46:00Data from Cloud StorageT1530The archive leaves the estate to external storage.alerts: Object store emptied by one token

All 12 steps raise an alert (100%).

New to this chain? Read the breach theory — how intrusions unfold, the ATT&CK tactic behind each step, and where a playbook fits.