Browser LabLD-SOC2-LAB-005Hard
Browser LabLD-SOC2-LAB-005Hard22 min
Triage a Sample From Its Behaviour
A user opened invoice.pdf.exe and your EDR quarantined it, but the static scan says 'no detection'. You have the synthetic detonation report — the actions the sample took when run in an isolated environment. Read the behaviour, extract the indicators, and triage it.
What you will be able to do
- Read the detonation report and identify the persistence and C2 behaviours.
- Extract a durable IOC and classify the sample's capability.
- Map a behaviour to its ATT&CK technique and choose the triage action.
IOC AnalysisIncident TriageT1055 — Process InjectionT1547.001 — Boot or Logon Autostart Execution: Registry Run KeysT1555.003 — Credentials from Web Browsers
Sign in to start this lab.
Sign in