Labs
Labs
Standalone hands-on practice. Every lab is graded on the server against real evidence.
Analyze Your First PCAP
A SOC analyst received a packet capture from a workstation that contacted a suspicious web server. Investigate the traffic and identify what happened.
Where Does This Packet Go?
A Meridian workstation is configured 192.168.10.25 / 255.255.255.0 (a /24), gateway 192.168.10.1. For each destination it wants to reach, you must decide — from the addressing alone — whether the packet is delivered locally or handed to the gateway, and then diagnose why one destination is unexpectedly failing.
The Layered Troubleshoot
Three Meridian users each report 'I can't reach the reporting site'. You have each machine's diagnostics. Apply the bottom-up method — address, gateway, DNS, route, port — and name, for each case, the first failing layer and the fix. The three failures are at different layers; do not assume they share a cause.
Boss Lab: Read the Capture
Meridian reports intermittent 'suspicious network activity' and hands you an hour of captured traffic from one office segment, summarised as conversations plus the DNS log. The capture is mostly normal — DNS lookups, web browsing, internal ARP, ICMP, healthy TCP handshakes — with ONE communication pattern that does not belong. Investigate it the way lesson 8.3 taught: filter, group, compare, and reach an evidence-based conclusion. Claim only what the packets support.
Who Can Read the Salaries?
Aldar's HR keeps confidential salary files on the share \\FS-01\HR. A review asks you to work out, from the ACL and group memberships alone, exactly who can reach that data and to find any over-broad grant. Claim only what the permissions actually show — access can arrive through a group, and an explicit Deny can override an Allow.
Reading the Logon Trail
Aldar's Security log shows the day's logons for several accounts. Using logon type and source — not just the account name — work out which activity is routine and which one entry doesn't fit the account's role. Read account + type + source + time together.
Boss Lab: The Server That Won't Behave
Aldar's application server SRV-APP07 started misbehaving this morning: a key service keeps failing, and something looks off in its autostart configuration. You have the System log, the Security log, and an autostart/process snapshot. Apply the troubleshooting method — scope, localize, read the evidence, find the earliest cause — and reach an evidence-based conclusion about what happened and what to fix. Claim only what the evidence supports.
Trace the Loop, Find the Bug
Orbit has a short script meant to sum a list of daily sales, but it prints the wrong total. Read the code as the interpreter would — line by line, tracking state — predict what it actually prints, identify the bug, and give the fix and the corrected result. Reason from the code, not from what it was 'supposed' to do.
Why the Total Came Out Wrong
Orbit reads amounts from a data file and sums them, but the result is nonsense. Read the data and the code together, work out what type the values really are, predict the buggy output, and give the fix. This is the everyday reality of parsing real files.
Boss Lab: Verify the Pipeline
Orbit's per-region sales pipeline runs with no errors and prints a plausible report — but is it correct? You have the pipeline code and a small test input whose answer you can compute by hand. Work out the correct output, predict what the pipeline actually produces, locate the stage with the bug, give the fix, and reason about an edge case. Prove correctness — don't assume it because it ran.
Files, Users & Permissions
A web app on a Jisr server cannot read its config, and a private key looks wrong. Read the ownership and permission bits and fix the access without weakening security.
Services, Networking & Logs
The web service on a Jisr server is down. Use the service state, the listening sockets and the journal to find the cause — one process is holding the port.
Troubleshoot a Linux Server
A Jisr application server is slow and its nightly job did not run. Use performance tools, systemd and logs to localize the bottleneck and the failed job — evidence, not guesses.
Path Exam — Secure & Fix a Production Server
A small Jisr production Linux server has several operational and security misconfigurations at once. Review the evidence and identify the corrective actions across permissions, service state, network exposure, logs and a failed scheduled job. Reason from the evidence — this is the capstone of the path.
Know What You Protect
Aurora Dates Trading Co. has never kept a proper asset inventory. The new IT lead hands you a network scan and a half-finished asset sheet and asks: what do we actually own, which asset would hurt most if lost, and is anything on the network that nobody is managing?
What Is Listening?
Aurora's firewall was configured years ago and never reviewed. You are given the current inbound rule set and a connection snapshot from the edge. Identify what each rule actually exposes, and find the one exposure that should never face the internet.
The Process That Should Not Be
Endpoint protection on WS-07 — the finance manager's workstation at Aurora — flagged 'unusual child process' and captured a process snapshot plus a connection list, then auto-closed the alert as low severity. Review the evidence yourself and decide whether the auto-close was right.
One Password, Many Doors
Aurora's identity provider logged a burst of failed sign-ins overnight. The IT lead wants three answers before the morning stand-up: what attack pattern is this, did any account actually fall, and did MFA do its job anywhere?
Two Emails, One Verdict Each
Two employees forwarded emails to Aurora's new 'report suspicious mail' address within an hour of each other. Triage both. One deserves an incident; treating the other as one would teach staff that reporting mail is a waste of time.
The Alert That Cried Wolf
Aurora's new SIEM fired 'Service account interactive burst — possible abuse' at 02:00, for the third night running. The on-call engineer is tired of it. Triage the alert properly: validate it against context before you decide, and recommend what should happen to the rule.
Scope the Marasi Intrusion
You are the responder on the Marasi svc-fleet incident. Validation is done; now you must scope it. You have the service account's authentication log and the map of what that account can reach. Separate confirmed scope from the blast radius that still needs checking.
The Containment Board
Three items land on your containment board during the Marasi response. Two are attacker footholds needing action; one is a legitimate emergency change a panicking admin made that LOOKS hostile. Contain what must be contained — and do not take down the business over a false alarm.
Reconstruct the Movement
Lateral movement is suspected in a fresh Marasi incident. From authentication and endpoint evidence, reconstruct where the attacker went, in what order, and where they stopped. Bound the scope with evidence — including the boundary a failed attempt provides.
Hunt the Qasr Finance Endpoint
Intelligence describes a campaign that delivers macro documents to finance staff. You are hunting Qasr's finance workstations with a hypothesis: an office document spawned a shell chain and established persistence. You have process-creation telemetry and a scheduled-task export. Read the lineage — do not judge by process name.
The Anomaly That Wasn't
Your hunt flagged three anomalies on Qasr's servers this week. Leadership wants to know if Qasr is breached. Your job is NOT to find a breach — it is to reach the honest verdict. Investigate each anomaly against the baseline and change records. Not every hunt ends in compromise, and calling a benign event an incident is its own failure.
Trace the Qasr Beacon
A threat-informed hunt looks for C2 beaconing on Qasr's network. You have aggregated outbound connection data and authentication logs. Separate real beaconing from legitimate periodic traffic, then pivot to establish the full scope response will need.
Grade the Sources
Four inputs about a possible threat to Sahab's billing portal land on your desk. Before any of it becomes intelligence, apply sourcing discipline: grade reliability and credibility, and spot the reports that are only echoing one original.
The Breach That Wasn't
A forum post claims Sahab's entire customer database is for sale, and leadership is alarmed. Your job is to assess the claim honestly, not to confirm it. Apply structured analysis to the 'evidence' offered. Sometimes the correct, valuable intelligence product is: this claim is not credible.
Profile the Adversary
A confirmed intrusion set targets Sahab. Build an adversary profile: map the behavior to ATT&CK, pivot the shared infrastructure with the Diamond Model to find related activity, and prioritize what to deliver using the Pyramid of Pain.
The Vanished Executable
A suspicious tool was reported on Wadi Logistics workstation WD-OPS-04, but the file is no longer on disk. You have a Prefetch parse, an Amcache excerpt and the account's browser/shell history. Establish what ran, when, its identity, and where it came from — and claim only what each artifact supports.
The Persistence Sweep
After an intrusion on Wadi server WD-APP-02, you must find every mechanism the attacker planted to survive a reboot. You have an autostart sweep (registry + services + tasks) and the Security event log. The eradication plan will contain exactly what you find — miss one and the incident restarts.
The Accusation That Failed
HR believes a departing Wadi employee, n.rashid, mass-deleted project files and copied them to USB on their last day. You have the MFT/USN record, the LNK evidence and the change calendar. Your job is NOT to confirm the accusation — it is to reconstruct what actually happened. A forensic analyst clears people as often as they implicate them.
Static Triage of a Suspicious Attachment
Badr Engineering's mail filter quarantined an attachment named quote.pdf. You have its static analysis output only — magic bytes, hashes, strings, imports and the PE section table. Without ever running it, decide what it really is and what it is capable of. Claim only what static evidence supports.
The Sample That Wasn't Malware
An EDR alert flagged bkupagent.exe on a Badr server as 'suspicious'. The SOC wants a malware verdict. You have the sandbox behavior report, the file's signature status and the change records. Your job is the honest verdict — a suspicious-looking sample is not the same as a malicious one, and calling benign software malware has its own cost.
From Behavior to Detection
You have finished detonating a confirmed-malicious Badr sample and captured its behavior report and network trace. Now turn the analysis into defensive value: extract the durable IOCs, map the behavior to ATT&CK, and choose the behavior worth handing to detection engineering. Prefer what survives infrastructure rotation.
Build a Durable Detection
Jisr Bank confirmed an intrusion: a phishing document spawned encoded PowerShell that dropped and persisted an implant. You have the incident's process telemetry and the available fields. Design a detection that catches this behavior durably — not one tied to the specific hash or IP that the attacker will rotate.
The Rule That Cried Wolf
A Jisr detection fires 180 times a day, and the SOC has started auto-closing it. Leadership asks whether the bank is under sustained attack. Your job is NOT to escalate an incident — it is to determine the truth. Analyze the alerts against the baseline and change records, and reach the honest verdict. A flood of alerts on legitimate activity is a tuning problem, not a breach.
Validate the Detection
A Jisr detection for DNS-tunneling exfiltration is ready for review. Before it ships, you must validate it against labeled fixtures — malicious cases it must catch and benign cases it must ignore — and measure whether it is production-ready. Firing on the attack is only half the test.
Trace the Fanar Endpoint
An EDR alert fired on powershell.exe on Fanar Hotels workstation FANAR-FD-02. You have the process tree, authentication events and the account context. Run the investigation loop: trace the lineage up to the root cause and down to the impact, establish the identity scope, and review persistence. Read lineage and command lines, not process names.
The Alert That Wasn't
An EDR alert fired on FANAR-IT-05: 'PsExec used to run a process on a remote host'. The SOC wants to know if an attacker is moving laterally. Your job is NOT to declare an incident — it is to reach the honest verdict. Investigate the alert against the identity context and change records. Not every EDR alert is an attack, and isolating a production host over a false positive has its own cost.
The Containment Call
A Fanar Hotels host is confirmed compromised: a partly-fileless implant is beaconing to C2, a domain-admin credential was exposed, and lateral movement to an internal server has begun. Leadership wants it 'shut down now'. Your job is to choose the right containment sequence — one that stops the spread, preserves evidence, and addresses every part of the intrusion.
The Midnight Login
It is 02:40 on a Saturday at Nexa Digital. An alert fires on SRV-FIN-02, a finance file server. The rule that triggered is 'Multiple failed logons followed by success'. Nobody from the finance team is scheduled to work tonight. You have the server's authentication log and the account directory.
The 03:00 Sweep
An alert fires at Nexa Digital: 'Host contacting unusually large number of internal systems'. The source is 10.20.7.9, which reached 214 internal hosts in eleven minutes. The pattern resembles internal reconnaissance. Determine whether it is.
Challenge: Three Alerts, One Shift
You have taken over the Nexa Digital queue at 09:00. Three alerts fired overnight and nobody has touched them. The outgoing analyst left no notes. Two of these alerts describe parts of the same activity. One is unrelated. Work out which is which, and decide what the shift lead needs to know.
Module 01 Assessment — Part B: The Recurring Lockout
An employee has reported being locked out four times this week. The service desk escalated it to the SOC as possible account attack. Three explanations are consistent with a repeated lockout: an attacker guessing the password, a stale credential cached on a device, or the user mistyping. Decide which the evidence actually supports.
Reading the Perimeter Log
You have one hour of firewall records from the Nexa Digital perimeter. Nothing has alerted. Your shift lead wants to know whether anything in this window deserves a ticket. Read the evidence and answer precisely.
Two Hosts, One Problem
Two workstations were flagged by a weekly review for unusual DNS volume. Only one of them is actually a problem. You have the DNS records for both. Decide which host needs a ticket, and be able to say why the other does not.
Password Spraying Against the Domain
Overnight, authentication failures across the domain rose from a typical 40 to just over 900. No single account was locked out, which is why nobody was paged. The morning shift has asked you to establish whether this was an attack and, if so, whether it succeeded.
Four Services, One Problem
An EDR alert fired on WS-118 for 'unsigned binary registered as a service'. Four services were installed on this host in the last 24 hours. Three of them are routine. Your job is to say which is not, and to prove it from the evidence rather than from the name.
Three Clocks, One Incident
An intrusion is confirmed on WS-090 and your job is the timeline. The catch: the domain controller logs in UTC, the workstation logs in UTC+3, and the cloud mail service logs in UTC-5. Get the order wrong and the report will claim the response happened before the attack.
Three Sources, One Aggregation
It is a normal shift and your SIEM dashboard shows three summaries: failed logins by source, outbound connections by destination, and a data-transfer view. Nothing here is a raw event — your job is to read the aggregations correctly and decide which rows are noise, which is a spray, and which is a beacon. Reading count without its second dimension is the trap the whole lab is built around.
Triage the Indicator Set
An EDR alert on WS-114 produced a batch of indicators, and a threat-intel feed match arrived at the same time. Your job is not to block everything — it is to decide which indicator is worth acting on, which is a shared service you must not block, and which single indicator to pivot on to scope the incident. Enrichment and local telemetry are provided.
Behaviour Over Content: Beacon, Tunnel, Exfil
An NDR flagged 'unusual outbound activity' on the 10.20.4.0/24 subnet. There is no full PCAP — only flow records, a DNS aggregation, and TLS metadata. Read behaviour, not content: find the beacon, the DNS tunnel and the exfiltration, decide which single host is compromised, and map what you found to MITRE ATT&CK. Encryption hides payloads here; it does not hide the shapes.
Tune a Noisy Detection Without Going Blind
A password-spray detection is firing so often that analysts have started ignoring it — and a real spray may be hiding in the noise. Here is the rule and the three sources it fired on this hour, with context. Your job is detection work, not just triage: find the true positive, find the benign cause of the noise, choose the tuning that silences the noise without losing the attack, confirm the tuned rule still fires on the spray, and map it to ATT&CK.
First Moves on a Confirmed Incident
EDR has CONFIRMED a compromise on WS-042: a finance user clicked a phishing link, PowerShell ran, and the host is beaconing to an external controller right now. The user has access to the payment system. The incident is real — your job is the first moves. Make each response decision in the right order: what to preserve, how to contain without destroying evidence, what NOT to do yet, and how urgently to escalate.
The Integrated Shift: One Incident, Every Pillar
It is your shift. A single alert — a failed-login spike — is at the top of the queue, and it is about to become a full incident. Walk it end to end: read the SIEM aggregation to find the host, follow the network to what it is talking to, assess the destination, and decide the response. Each step is a different question answered by a different source; hold the thread from the first alert to the final decision.
Correlating a Multi-Source Intrusion
Tier-1 escalated an alert they could not close: a successful logon that looked routine. You have four sources for the same window — an authentication summary, a SIEM detection, an endpoint chain and outbound network flows. Read them together, not one at a time.
Module 1 Assessment — Part B: Correlate and Decide
A fresh case, no Tier-1 notes. Three sources cover one window on a database server. Correlate them, judge whether the order is even possible, and decide.
Hunting a Scheduled-Task Persistence Hypothesis
Your hypothesis: 'A non-admin account created a scheduled task from a user-writable path in the last 7 days — possible persistence (ATT&CK T1053.005).' You pulled every Event 4698 (task creation) for the window. Work the hypothesis: pivot, rule out the benign explanation, judge confidence, and decide.
Module 2 Assessment — Part B: Hunt a Beaconing Hypothesis
Hypothesis: 'A host is beaconing to command-and-control at a fixed sub-5-minute interval to a rare external destination.' You have outbound-flow summaries and enrichment for the window. Hunt it: pivot, rule out the benign update-check explanation, judge confidence, decide.
Deep-Dive a Compromised Workstation
An EDR alert flagged 'unusual process on FIN-WS-09'. Tier-1 could not tell attacker from admin. You have the host's process telemetry, its persistence-creation events, and its logon record. Read the host deeply and reconstruct what happened.
Module 3 Assessment — Part B: Read the Host and Decide
A fresh host case. You have process telemetry, a persistence entry and a logon record for SRV-APP-05. Read the ancestry, triage the persistence, and decide the response.
Trace a Beacon Across the Wire
A proxy anomaly flagged repeated outbound connections from the finance segment. You have the NetFlow records, the TLS metadata, and the endpoint-to-connection mapping. Find the command-and-control channel and name the host that owns it.
Module 4 Assessment — Part B: Trace the Traffic and Decide
A fresh network case on host SRV-DB-04. You have its outbound flows, the destination context, and the host's data-access role. Read the traffic, rule out the benign twin, and decide the response.
Triage a Sample From Its Behaviour
A user opened invoice.pdf.exe and your EDR quarantined it, but the static scan says 'no detection'. You have the synthetic detonation report — the actions the sample took when run in an isolated environment. Read the behaviour, extract the indicators, and triage it.
Module 5 Assessment — Part B: Triage and Decide
A fresh sample detonated from HR-WS-14. You have its synthetic detonation report and the host context. Read the behaviour, extract the indicator to scope with, classify it, and decide the response.
Turn an Alert Into Intelligence
An alert fired on a finance workstation that opened an invoice-lure attachment and then beaconed out. Your CTI platform enriches the indicators against a synthetic actor profile. Read the enrichment, judge the attribution, and decide the next action.
Module 6 Assessment — Part B: Prioritise and Act on Intelligence
You hold one priority intelligence requirement (PIR) and a limited budget of attention. Several intelligence items arrive at different reliability levels. Classify, filter, and turn the right one into an action.
Engineer a Detection From a Confirmed TTP
Threat intelligence handed you a confirmed TTP: an Office application spawning an encoded PowerShell child. A junior analyst drafted a rule that alerts on all PowerShell. You have the TTP, the draft rule, a real attack event and a sample of benign activity. Turn the draft into a detection you can trust.
Module 7 Assessment — Part B: Diagnose and Tune a Detection
You inherit a noisy detection and a set of complaints. Diagnose its weaknesses, apply the right tuning, make it durable, and decide how to keep it working over time.
Hunt a Living-off-the-Land Execution at Scale
No alert fired, but intelligence says an actor executes payloads via living-off-the-land binaries your rules don't cover. Your hypothesis: an Office app should never spawn a scripting host. You have millions of process-creation events aggregated by parent-child pair. Hunt the gap.
Module 8 Assessment — Part B: Run an Anomaly Hunt to Its Close
You have a baseline of how the finance team's accounts normally authenticate. Intelligence suggests credential misuse. Hunt for the account or host that deviates from its peers, then close the loop.
Run the Incident From Escalation to Closure
Module 8's hunt escalated a live intrusion: WINWORD spawned mshta.exe on FIN-WS-12, which is beaconing to C2 now, and the same foothold appears on other hosts. You are the incident responder. Drive the lifecycle without destroying evidence or leaving the attacker a way back.
Module 9 Assessment — Part B: Command the Incident
Ransomware is encrypting files on a live host and spreading to a file share; a domain credential is exposed and scoping shows more affected hosts. You are the incident commander. Take the right actions in the right order, and close the incident properly.
Run One Case Through the Whole Workflow
A single alert lands on a busy shift: an unusual process on FIN-WS-12, one event, no rule matched the full pattern. Take it through the integrated SOC workflow — correlate, hunt, respond, and close the loop — while a full queue waits behind it.
Module 10 Assessment — Part B: Operate the Floor
You are the analyst on a busy shift with a full queue. Prioritise, run the top case through the workflow, and hand over cleanly at shift end.
Filter to the Truth
An alert at Jisr Bank flags 'authentication anomalies' overnight. You are handed a slice of the auth sourcetype in Splunk. Millions of events, one question at a time: use field filters and boolean logic to isolate which account was actually taken over — not merely which had noise.
Spray or Brute Force?
Two sources are hammering Jisr's VPN portal. Leadership wants a name for what is happening before they choose a response — blocking one source, resetting one account, or forcing a org-wide reset are very different actions. Use stats to let the numbers classify the technique. Do not guess from the word 'failure'.
The Steady Heartbeat
A Jisr workstation is talking to an unfamiliar domain. The traffic volume is tiny, so it never tripped a bandwidth alert — but something about the rhythm looks wrong. Use timechart to decide whether this is a human browsing or a machine calling home.
Ten Minutes to a Verdict
A single alert — 'foreign login, j.rai' — lands in your queue. On its own it means little. You pull auth, endpoint and proxy events for that user into one timeline. Your job is a defensible verdict: is this an incident, and if so, what is the evidence chain? Do not escalate on one scary line, and do not dismiss a real chain because each link looks small.
Write the Query
Jisr Bank's Elastic Security flags overnight authentication anomalies. You are in Discover on the auth data view. Use KQL — field:value and boolean logic, not free text — to isolate which account was actually taken over, and prove it from the fields.
Aggregate the Answer
Two sources are hammering Jisr's VPN portal. Before leadership chooses a response, name the technique from the aggregation, not the word 'failure'. You have an Elastic aggregation of failed logins split by source.ip, with both a count and a unique count of user.name.
Correlate on the Timeline
An Elastic Security alert — 'foreign login, j.rai' — lands in your queue. Alone it means little. You pull auth, endpoint and proxy events for that identity onto the Timeline. Reach a defensible verdict: is this an incident, and what is the evidence chain? Do not escalate on one alert, and do not dismiss a real chain because each link looks small.
The Service That Shouldn't Be There
You scanned the Jisr user VLAN (10.20.4.0/24) before a change. Most hosts look normal, but one exposes a service that has no business on a user segment. Find it and say why.
Open, Closed, or a Wall?
A single host returned a mix of port states. Leadership asks whether a service is exposed. Read the states correctly — one of them means a firewall, not an absent service.
Prioritize the Exposure
A version scan of a DMZ host returned several services. Pick the one that most needs action and write the conclusion — the version, not the open state, decides.
Follow the Lineage
An alert fired on encoded PowerShell on FIN-07. You have the Sysmon Event ID 1 (process create) excerpt. Trace the lineage and name the malicious parent that started the chain.
One GUID, the Whole Action
You have a mix of Sysmon events correlated by ProcessGuid for one process. Reconstruct what it did: where it connected and what persistence it installed.
Signal or Noise?
Two process chains fired similar-looking events. One is a benign admin tool; the other is an intrusion. Use lineage and context to tell them apart — not every PowerShell is an attack.
Authentication Investigation
Overnight Security-log events from a Jisr host. Determine which account was brute-forced into and how the attacker connected.
Account & Privilege Investigation
After a suspected compromise, review account-management events on a Jisr domain controller. Find the persistence the attacker created.
Windows Incident Timeline (Exam)
Multiple Windows events span one account across two hosts. Build the timeline and answer who, where, whether it succeeded, and what the attacker did to cover tracks. This is the academy's final assessment.
Build a Process Detection
A confirmed intrusion spawned encoded PowerShell from a Word document. Choose the selection that catches this behaviour durably — not the attacker's specific hash or IP.
Detect Suspicious Authentication
You need a Sigma rule for password spraying (one source, many accounts, failed logons). Choose the correct logsource and the field pattern that captures the behaviour.
Tune a Noisy Detection (Exam)
A Sigma rule for encoded PowerShell fires 180 times a day and the SOC auto-closes it. Determine the benign cause and the disciplined fix — the rule should keep catching attacks, not be deleted. This is the academy's final assessment.
Your First YARA Rule
You extracted the strings from a safe synthetic sample. Choose the patterns and condition that would classify this family durably.
Reduce False Positives
A candidate YARA rule matches the target sample but also several legitimate installers. Identify why and how to fix it — without losing the true detection.
Artifact Classification (Exam)
Three safe synthetic files: two are the target family, one is a benign lookalike that shares a common string. Design the rule that catches the family and rejects the benign file, and justify it. This is the academy's final assessment.
Decode the Evidence
A suspicious log field holds an encoded value. Identify the encoding, read the decoded indicator, and prepare it for the report — safely.
Multi-Layer Transformation (Exam)
A payload field is obfuscated in several layers. Follow the transformation chain step by step, identify each layer from the intermediate output, and recover the final indicator. This is the academy's final challenge.