Skip to main content

We use cookies to ensure you get the best user experience. For more information see our cookie policy.

Room Banner
Back to all walkthroughs
Room Icon

Defensive Security Intro

Practice your skills by experiencing a SOC workflow in this interactive scenario

easy

10 min

64

User profile photo.

To access material, start machines and answer questions login.

Fundamentals

You already know the core concepts of defensive security - detection, triage, containment and remediation being the backbone to any successful defensive security team.

This room runs you through a simulated workflow:

  • Alert triage
  • Attack classification
  • Containment

To prepare you for the remainder of this pathway.

Answer the questions below

What stage best describes stopping an attack from ongoing?

Alert Triage - Identify the

The simulated dashboard has a live queue of events. A web enumeration attack has just triggered. Investigate the alert and find identifying information about the attacker.

This room simulates a security dashboard.

These security dashboards contain all sorts of information. Defenders call these alerts, and can tell the defender what is happening on the company computers. The skill of a good defender is being able to recognise the important alert out of the noisy ones.

Character
 
 
 
 

You'll need to...

1. Look at the Security Dashboard on the right.
2. Review the recent alerts on the dashboard.
3. Extract identifying information of the attacker from the web enumeration alert.
Why you're doing this

Collecting IOCs is one of the first steps when investigating an alert. By extracting identifiable information about the attacker, we can look up the reputation and history of the attacker from both internal and external sources.

Answer the questions below

What is the IP address the attacker is using to perform the web enumeration attack?

Attack Chain Analysis

Now let's investigate the attack, and more importantly, the events leading up to the alert being triggered. Using the alert, we can see what other types of URLs the attacker is searching for, with the error codes indicating what was found, blocked, or not existing.

This room simulates a security dashboard.
Character
 
 
 
 

You'll need to...

1. Review the information within the alert.
2. Look at the pages the attacker has enumerated.
3. Find the most recent page that the hacker has attempted to find.
Why you're doing this

By understanding the things that a hacker is after, and how they think, can help us better understand what to defend.

Answer the questions below

What host was the attacker scanning?

Begin Containment

After clicking "Proceed to Investigate" the alert, it's now time to use internal tooling to implement containment:

  • IP blocking
  • Rate limiting
  • Web Application update

This maps to the Framework.

This room simulates a security dashboard.
Character
 
 
 
 

You'll need to...

1. Block the attacker's IP address (32.122.195.63).
2. Implement rate limiting on the web application. For sensitive pages, having a strict limit is ideal.
3. Push updated rules to the Web Application . In this case, enabling "Directory brute-force protection".
Why you're doing this

While we can see the attacker currently enumerating our systems, now is the time to strike and stop them in their tracks, before they find what they are truly looking for and begin their hacks.

Hackers also use noisy scans like this to overwhelm the defensive security team. If we can cut out this noise, we might find the attacker is already within our systems, being stealthy.

Answer the questions below

Copy the flag that appears when the attacker has been contained