Browser LabLD-SOC1-LAB-004Medium
Browser LabLD-SOC1-LAB-004Medium30 min
Two Hosts, One Problem
Two workstations were flagged by a weekly review for unusual DNS volume. Only one of them is actually a problem. You have the DNS records for both. Decide which host needs a ticket, and be able to say why the other does not.
What you will be able to do
- Apply the DNS tunnelling signals to two candidates and eliminate one.
- Justify clearing a host as firmly as escalating one.
- Recommend a next step proportionate to the finding.
Network AnalysisIOC AnalysisIncident TriageAnalyst ReportingT1071.004 — Application Layer Protocol: DNS
Sign in to start this lab.
Sign in