Scribd
Upload
2 views2 pages

Module 5.7 Practical Task

The document outlines a simulation scenario for students to analyze a suspicious file named invoice.pdf.exe on an endpoint. Students will work with sample logs, modify a Sigma rule, and understand how the event appears in a SIEM, while also writing a triage summary as SOC analysts. Key tasks include identifying the user who created the file, the time, directory, and investigating the behavior's suspiciousness.

Uploaded by

doehoctap
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
2 views2 pages

Module 5.7 Practical Task

The document outlines a simulation scenario for students to analyze a suspicious file named invoice.pdf.exe on an endpoint. Students will work with sample logs, modify a Sigma rule, and understand how the event appears in a SIEM, while also writing a triage summary as SOC analysts. Key tasks include identifying the user who created the file, the time, directory, and investigating the behavior's suspiciousness.

Uploaded by

doehoctap
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd

Objective:

Simulate a scenario where a suspicious file named [Link] is created on an endpoint.


Students will:
 Analyze logs (you’ll provide sample log entries)
 Use or modify a Sigma rule
 Understand how this would show up in a SIEM
 Write a triage summary as a Level 1/2 SOC analyst
A basic Sigma rule template:
title: Double Extension File Created
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|endswith:
- ………
- ………
condition: selection
Check:
 Which user created the file?
 What time?
 Which directory?
 Was the file executed (look for a [Link] or [Link] in Event ID 4688)?
Students to answer:
1. Is this behavior suspicious? Why?
2. What would you do next as an L1 analyst?
3. If you were L2, how would you investigate deeper? (e.g., check DNS logs, user behavior, file
hash reputation)
title:
id:
status:
description: Detects file creation events with suspicious double file extensions that may indicate
masquerading.
author:
date:
references:
- [Link]
logsource:
product:
category:

detection:
selection:
TargetFilename|endswith:
-
-
condition:

falsepositives:
- Users renaming legitimate files manually
level:
tags:
- attack……………..
- attack.t…………

You might also like