Lab 20 — SOC Analyst Capstone Investigation

Mission Information

Item	Details
Lab	20
Lab Name	SOC Analyst Capstone Investigation
Track	CompTIA CySA+
Difficulty	Advanced
Estimated Time	180–240 minutes
Primary Role	Cybersecurity Analyst / SOC Analyst
Environment	Enterprise SOC Investigation Lab
Primary Systems	SIEM + Windows Endpoint + Linux Server + Web Server + Analyst Workstation
Primary Data Sources	Windows Logs, Linux Logs, Zeek, Suricata, Web Logs, Authentication, Endpoint Telemetry, Threat Intelligence
Skills	Alert Triage, Incident Investigation, Log Correlation, Threat Hunting, IOC Analysis, Timeline Reconstruction, Incident Scoping, ATT&CK Mapping, Containment, Reporting

Capstone Rule: You are not told exactly what happened. Treat every initial assumption as a hypothesis until supported by evidence.

Lab Safety: Perform all investigation activities only inside the authorized GoHackersCloud CySA+ lab environment. Do not execute suspicious files or interact directly with malicious infrastructure.

Mission Scenario

You are beginning your shift as a SOC Analyst at GHC Enterprise.

During the overnight period, several alerts were generated across different security systems.

Individually, they appear unrelated.

The SIEM contains:

Multiple Authentication Failures

Successful Authentication

Suspicious PowerShell Activity

Endpoint Malware Alert

Unusual DNS Query

Suricata Network Alert

Unexpected Web Request

Outbound Network Connection

No incident has yet been declared.

The overnight analyst left the following note:

“Multiple alerts occurred between 01:00 and 04:00. Possible relationship between authentication, endpoint, and network events. Requires investigation.”

You are assigned:

Case:
GHC-SOC-2026-020

Priority:
Unassigned

Status:
Investigation Required

Your responsibility is to determine what actually happened.

You must answer:

Was there a compromise?

How did it begin?

Which identity was involved?

Which endpoint was affected?

What executed?

Did malware run?

Was persistence established?

Did the attacker obtain elevated privileges?

Was lateral movement attempted?

Was a web application involved?

What external infrastructure was contacted?

How many systems are affected?

What data may have been exposed?

Is the threat still active?

What should be contained?

What should happen next?

Mission Objective: Conduct an end-to-end SOC investigation using multiple telemetry sources, reconstruct the complete attack story, determine organizational impact, and produce defensible technical and executive incident reports.

Mission Objectives

By completing this capstone, you will be able to:

• triage multiple security alerts

• establish an investigation strategy

• correlate security telemetry

• investigate authentication anomalies

• analyze Windows security logs

• investigate Linux security logs

• analyze process execution

• investigate PowerShell activity

• analyze endpoint malware evidence

• investigate DNS activity

• analyze network connections

• correlate Zeek telemetry

• investigate Suricata alerts

• analyze web application activity

• enrich indicators with threat intelligence

• identify persistence

• investigate privilege activity

• detect lateral movement

• identify potential command-and-control activity

• investigate possible data exfiltration

• collect and preserve evidence

• reconstruct an attack timeline

• determine incident scope

• map observed behavior to MITRE ATT&CK

• assign incident severity

• recommend containment

• recommend remediation

• produce technical findings

• produce an executive incident summary

1. Understand the Capstone Investigation Model

Unlike previous labs, you will not investigate one predefined security problem.

You will begin with:

Raw Alerts

and work toward:

Raw Alerts
    ↓
Triage
    ↓
Evidence Collection
    ↓
Correlation
    ↓
Hypothesis
    ↓
Validation
    ↓
Attack Timeline
    ↓
Scope
    ↓
Impact
    ↓
Containment
    ↓
Recovery Recommendations
    ↓
Reporting

Your job is to reconstruct the incident from evidence.

2. Start the Enterprise Lab

Start:

CYSA-ANALYST
10.10.10.10

CYSA-WIN01
10.10.10.20

CYSA-LINUX01
10.10.10.30

CYSA-SIEM
10.10.10.40

CYSA-WEB01
10.10.10.50

Verify connectivity only where required for investigation.

3. Verify Telemetry

Confirm the SIEM contains data from:

Windows

Linux

Zeek

Suricata

DNS

Authentication

Web Server

Endpoint Security

Do not begin by searching random indicators.

First understand what evidence is available.

4. Create the Case Workspace

On CYSA-ANALYST:

mkdir -p ~/CySA-Lab/Investigations/LAB20/{Alerts,Evidence,Windows,Linux,Network,Web,IOCs,Timeline,ATTACK,Screenshots,Reports}

Create:

touch ~/CySA-Lab/Investigations/LAB20/investigation-notes.md

Use:

Case ID:
GHC-SOC-2026-020

5. Record the Initial Case Information

Document:

Case ID:
GHC-SOC-2026-020

Analyst:
<your name>

Investigation Start:
<timestamp>

Initial Priority:
Unassigned

Known Investigation Window:
01:00–04:00

Current Status:
Triage

Do not assign a final severity yet.

6. Create an Alert Inventory

Collect every potentially related alert.

Create:

Alert ID	Time	Source	Host	User	Severity
A001	<time>	Authentication	<host>	<user>	Medium
A002	<time>	Endpoint	<host>	<user>	High
A003	<time>	Suricata	<host>	N/A	High
A004	<time>	Web	<host>	N/A	Medium

Your actual values should come from the lab.

7. Sort Alerts Chronologically

Arrange alerts:

Earliest
   ↓
Authentication
   ↓
Endpoint
   ↓
DNS
   ↓
Network
   ↓
Web
   ↓
Latest

Do not assume alert order equals attack order.

Some detections may occur long after the underlying activity began.

8. Identify the First Investigation Pivot

Select the alert containing the strongest combination of:

Specific Host

Specific User

Specific Indicator

High-Fidelity Detection

Good pivots include:

Username

Hostname

Source IP

Destination IP

Domain

File Hash

Process

9. Create Initial Hypotheses

For example:

H1:
Account compromise led to endpoint access.

H2:
Malware executed on CYSA-WIN01.

H3:
Network alerts are related to endpoint activity.

H4:
Web activity is part of the same incident.

H5:
The alerts are unrelated.

You must test these hypotheses.

10. Investigate Authentication Failures

Search:

Event ID 4625

Determine:

Target User

Source IP

Destination Host

Logon Type

Failure Reason

First Attempt

Last Attempt

Number of Attempts

11. Identify Authentication Patterns

Look for:

One User
   +
Many Password Attempts

or:

Many Users
   +
One/Few Attempts Each

or:

Multiple Failures
      ↓
Successful Login

Classify the pattern based on evidence.

12. Investigate Successful Authentication

Search:

Event ID 4624

for the affected identity.

Compare:

Source IP

Destination Host

Logon Type

Timestamp

with the failed attempts.

13. Investigate Privileged Authentication

Search:

Event ID 4672

Determine whether special privileges were assigned.

Ask:

Was this expected?

Was the account normally privileged?

Did privilege occur shortly after suspicious authentication?

14. Build the Authentication Timeline

Example:

Time	Event	User	Source
01:13	Failed login	user01	Source A
01:14	Failed login	user01	Source A
01:17	Successful login	user01	Source A
01:18	Privileged session	user01	CYSA-WIN01

Do not conclude compromise from chronology alone.

Correlate additional evidence.

15. Pivot on the User

Search the affected username across all available telemetry.

Determine:

Which hosts?

Which logons?

Which processes?

Which applications?

Which alerts?

Which network events?

16. Pivot on the Endpoint

If evidence points to:

CYSA-WIN01
10.10.10.20

search the host across:

Windows Logs

Endpoint Telemetry

DNS

Zeek

Suricata

SIEM Alerts

17. Investigate Process Creation

Search:

Event ID 4688

where available.

Identify processes executed shortly after suspicious authentication.

Record:

Process

Parent Process

Command Line

User

Timestamp

18. Build the Process Tree

Create:

Parent Process
      ↓
Child Process
      ↓
Grandchild Process

Look for unexpected relationships.

For example:

Office Application
       ↓
PowerShell
       ↓
Unknown Executable

or:

Browser
   ↓
Downloaded File
   ↓
Script Interpreter

19. Investigate PowerShell

Search:

Event ID 4104

where available.

Review for:

Encoded Commands

Obfuscation

Unexpected Downloads

Discovery

Security Configuration Changes

Suspicious Script Execution

Do not execute any commands found in the telemetry.

20. Identify Suspicious Files

Document:

Filename

Path

Creation Time

Modification Time

Execution Time

Associated Process

User

Pay special attention to files appearing shortly before suspicious execution.

21. Calculate File Hashes

For safe lab artifacts:

sha256sum <file>

Record:

SHA-256:
<hash>

Do not execute the suspicious file.

22. Investigate the Hash

Use approved threat-intelligence sources.

Determine:

Known / Unknown

Classification

Malware Family

First Seen

Related Infrastructure

Confidence

Remember:

Unknown Hash
≠
Benign File

23. Investigate Endpoint Malware Alerts

Review:

Detection Name

File

Hash

Process

User

Action

Timestamp

Determine whether the security product:

Blocked

Quarantined

Detected Only

Failed to Remediate

24. Investigate Persistence

Look for:

Scheduled Tasks

Services

Startup Items

Registry Run Keys

New Accounts

Modified Configuration

Determine whether persistence was actually established.

25. Investigate Account Creation

Search for:

Event ID 4720

where relevant.

Record:

New Account

Creating Account

Timestamp

Host

26. Investigate Scheduled Tasks

Review suspicious tasks.

Document:

Task Name

Action

Executable

User

Trigger

Creation Time

Do not delete anything during investigation.

27. Investigate Services

Look for unexpected:

New Services

Changed Services

Unusual Executables

User-Writable Paths

Correlate service activity with the attack timeline.

28. Investigate Linux Authentication

If the evidence reaches:

CYSA-LINUX01

review:

sudo grep -i "failed\|accepted" /var/log/auth.log

or:

sudo journalctl -u ssh

Look for:

Failed SSH

Successful SSH

Source IP

Username

Timestamp

29. Investigate Linux Activity

Review relevant:

Authentication

sudo

Processes

Services

Cron

File Changes

Do not assume the Linux server is compromised merely because it was contacted.

30. Investigate DNS Activity

Pivot on the compromised endpoint.

Search for:

Queried Domain

Timestamp

Source Host

Response IP

Identify unusual or newly observed domains.

31. Enrich Suspicious Domains

For each suspicious domain, investigate:

Reputation

Registration Context

Associated IPs

Historical Activity

Malware Associations

Assign confidence.

32. Investigate Zeek Network Telemetry

Search:

CYSA-WIN01

or:

10.10.10.20

Review:

conn.log

dns.log

http.log

ssl.log / tls.log

where available.

33. Analyze Network Connections

Record:

Source IP

Destination IP

Destination Port

Protocol

Duration

Bytes Sent

Bytes Received

Look for unusual external and internal communications.

34. Investigate Suricata Alerts

Search for alerts involving the affected systems.

Record:

Signature

Category

Severity

Source

Destination

Timestamp

Determine whether Suricata evidence supports your endpoint findings.

35. Correlate Endpoint and Network Evidence

Example:

02:14:03
Suspicious Process Executes

02:14:06
DNS Query

02:14:07
External Connection

02:14:08
Suricata Alert

This is stronger than any individual event.

36. Investigate Possible Command-and-Control Activity

Look for:

Repeated Connections

Rare External Destinations

Unexpected Ports

Periodic Communication

Suspicious DNS

Connections from Unexpected Processes

Do not classify traffic as C2 from timing alone.

37. Investigate Internal Connections

Determine whether the suspected compromised endpoint contacted:

CYSA-LINUX01

CYSA-WEB01

Other Internal Systems

Record:

Destination

Protocol

Port

Timestamp

User

Authentication

38. Investigate Lateral Movement

Look for evidence involving:

SMB

RDP

SSH

WinRM

Remote Services

Administrative Shares

Remote Authentication

Your task is to detect lateral movement, not reproduce it.

39. Validate Lateral Movement

A network connection alone does not prove compromise.

Look for:

Internal Connection
      +
Authentication
      +
Remote Process / Session

before declaring successful lateral movement.

40. Investigate the Web Server

If:

CYSA-WEB01

appears in the incident, review:

Access Logs

Error Logs

Authentication

Application Logs

File Activity

Processes

Network Activity

41. Review Web Requests

Look for:

Suspicious Source IP

Unusual URI

Authentication Attempts

Unexpected POST

Injection Indicators

File Uploads

Determine whether web activity is related to the primary incident.

42. Investigate Web Server File Activity

Look for recently created files.

For example:

sudo find /var/www -type f -mmin -180 -ls

Adjust the path and time to your environment.

Do not execute suspicious files.

43. Investigate Potential Web-Shell Evidence

Look for:

Unexpected Script

Repeated Requests to Script

Web Process Spawning OS Process

Outbound Connection

Recently Modified Web File

Require corroborating evidence before declaring a web shell.

44. Determine Whether Web Activity Is Related

Possible conclusions:

Related to Primary Incident

Independent Attack

Benign Activity

Insufficient Evidence

Not every alert occurring in the same window belongs to the same incident.

45. Build the IOC Inventory

Create:

IOC ID	Type	Indicator	Source	Confidence
IOC-001	IP	<IP>	Authentication	High
IOC-002	Domain	<domain>	DNS	High
IOC-003	Hash	<SHA-256>	Endpoint	High
IOC-004	File	<filename>	Endpoint	High
IOC-005	IP	<IP>	Network	Medium

46. Enrich Every Significant IOC

For each IOC, determine:

Reputation

Context

Relationships

First Seen

Last Seen

Internal Matches

Confidence

Avoid relying on a single reputation score.

47. Search IOCs Across the Environment

Search each:

IP

Domain

Hash

Filename

Username

across all telemetry.

Your objective is to discover the true scope.

48. Build the IOC Relationship Map

Example:

User Account
     ↓
CYSA-WIN01
     ↓
Suspicious Process
     ↓
Malware Hash
     ↓
Domain
     ↓
External IP

Additional evidence may show:

CYSA-WIN01
     ↓
Internal Authentication
     ↓
CYSA-LINUX01

This relationship map becomes part of the attack story.

49. Identify Potential Data Collection

Look for:

Large File Enumeration

Sensitive Directory Access

Archive Creation

Database Access

File Share Access

Record only evidence-supported findings.

50. Investigate Potential Exfiltration

Review:

Outbound Bytes

Destination

Protocol

Timing

Archive Creation

Cloud Storage Activity

External Connections

Classify:

Confirmed

Suspected

No Evidence Observed

Unknown

51. Determine the Earliest Suspicious Activity

You may have begun with an alert at:

03:10

but discover suspicious authentication at:

01:14

Continue moving backward until you identify the earliest defensible suspicious activity.

52. Determine Initial Access

Possible conclusions:

Credential Compromise

Phishing

Malicious Download

Public-Facing Application

Remote Service

Unknown

Do not force a root cause when evidence is insufficient.

53. Identify Execution

Document the first confirmed attacker-controlled or suspicious execution.

Record:

Host

User

Process

Parent

Command Line

Timestamp

54. Identify Persistence

Classify:

Confirmed

Attempted

Not Observed

Unknown

Document the supporting evidence.

55. Identify Privilege Escalation or Privileged Use

Determine whether:

Privilege Escalation Occurred

or whether:

Already-Privileged Credentials Were Used

These are different findings.

56. Identify Credential Access

Determine whether evidence suggests:

Credential Theft

Token Theft

Password Access

Credential Store Access

If unsupported:

Credential Access:
Not Confirmed

57. Identify Discovery

Look for evidence of:

System Discovery

Account Discovery

Network Discovery

Process Discovery

Service Discovery

File and Directory Discovery

58. Identify Lateral Movement

Document:

Source Host

Destination Host

Identity

Protocol

Timestamp

Outcome

Differentiate:

Attempted

from:

Successful

59. Identify Command-and-Control

Document:

Process

Domain

IP

Protocol

First Seen

Last Seen

Frequency

Threat Intelligence

Classify confidence.

60. Identify Impact

Look for:

File Encryption

File Deletion

Service Disruption

Account Modification

Application Modification

Data Exposure

Do not assume ransomware or destructive activity unless supported by evidence.

61. Build the Master Incident Timeline

Create a table such as:

Time	Host	User	Event	Evidence
01:14	WIN01	user01	Authentication failures	Windows
01:17	WIN01	user01	Successful login	Windows
01:22	WIN01	user01	Suspicious process	Endpoint
01:23	WIN01	user01	PowerShell activity	PowerShell
01:25	WIN01	user01	DNS query	Zeek
01:26	WIN01	user01	External connection	Zeek
01:26	WIN01	N/A	Network alert	Suricata
01:45	WIN01 → LINUX01	user01	Internal activity	Network/Auth
02:10	WEB01	N/A	Web activity	Web Logs

Use your actual evidence.

62. Build the Attack Story

Convert the timeline into a narrative.

For example:

Suspicious Authentication
        ↓
Account Access
        ↓
Endpoint Execution
        ↓
PowerShell
        ↓
Malware
        ↓
Persistence
        ↓
External Communication
        ↓
Internal Discovery
        ↓
Lateral Movement
        ↓
Potential Data Access

Every arrow should be supported by evidence.

63. Map to MITRE ATT&CK

Create:

Attack Stage	Observed Behavior	ATT&CK Context
Initial Access	<evidence>	<technique>
Execution	<evidence>	<technique>
Persistence	<evidence>	<technique>
Credential Access	<evidence>	<technique>
Discovery	<evidence>	<technique>
Lateral Movement	<evidence>	<technique>
C2	<evidence>	<technique>
Exfiltration	<evidence>	<technique>
Impact	<evidence>	<technique>

Do not map techniques that were not observed.

64. Determine Incident Scope

Classify every system:

Asset	Evidence	Status
CYSA-WIN01	Execution + Network	Confirmed Compromised
CYSA-LINUX01	Internal Contact	Investigate
CYSA-WEB01	Web Alert	Investigate
CYSA-SIEM	No compromise evidence	Monitoring

Use:

Confirmed Compromised

Suspected Compromised

Exposed / Contacted

Unaffected

Unknown

65. Determine Identity Scope

Create:

Identity	Evidence	Status
user01	Suspicious authentication	Compromised/Suspected
admin01	Privileged activity	Investigate
service-web	Web process	Monitor

66. Assess Confidentiality Impact

Ask:

Was sensitive information accessed?

Were credentials exposed?

Was data staged?

Was data transferred externally?

Classify:

None

Low

Moderate

High

Unknown

67. Assess Integrity Impact

Ask:

Were files modified?

Was persistence installed?

Were accounts changed?

Was application content altered?

Were configurations changed?

68. Assess Availability Impact

Ask:

Were services interrupted?

Were files encrypted?

Were systems unavailable?

Was business functionality affected?

69. Determine Incident Severity

Consider:

Number of Compromised Systems

Identity Privilege

Asset Criticality

Malware

Persistence

Lateral Movement

Potential Data Exposure

Business Impact

Active Attacker Presence

Classify:

Low

Medium

High

Critical

and document why.

70. Determine Whether the Threat Is Active

Ask:

Are suspicious sessions active?

Are malicious processes running?

Are network connections continuing?

Are additional hosts being contacted?

Are new alerts appearing?

Classify:

Active

Contained

Historical

Unknown

71. Preserve Critical Evidence

Collect:

SIEM Events

Windows Logs

Linux Logs

Web Logs

Process Evidence

PowerShell Logs

Suspicious Files

Hashes

Network Logs

PCAP

Threat Intelligence

Screenshots

Follow the evidence procedures from Lab 17.

72. Calculate Evidence Hashes

For preserved files:

sha256sum <evidence-file>

Create:

LAB20/Evidence/evidence-hashes.txt

Record:

Evidence ID

Filename

Source

SHA-256

Collection Time

73. Create the Evidence Inventory

Evidence ID	Evidence	Source	Hash
EVID-001	Security Log	WIN01	<SHA-256>
EVID-002	Suspicious File	WIN01	<SHA-256>
EVID-003	PCAP	Network	<SHA-256>
EVID-004	Web Log	WEB01	<SHA-256>

74. Determine Immediate Containment Priorities

Rank actions.

Example:

P1 — Immediate

Isolate confirmed compromised endpoints

Secure compromised identities

Revoke active sessions

Block validated malicious infrastructure

Preserve volatile evidence

Then:

P2 — Urgent

Hunt for IOCs

Investigate lateral movement

Restrict affected network segments

Protect critical systems

Review privileged accounts

Then:

P3 — Recovery Preparation

Remove persistence

Patch exploited vulnerabilities

Rotate credentials

Validate clean backups

Prepare system rebuilds

75. Avoid Premature Remediation

Do not immediately:

Delete suspicious files

Clear logs

Reimage everything

Restart systems

Disable services

without considering:

Evidence Preservation

Business Impact

Containment Strategy

Incident Response Procedures

76. Develop Eradication Recommendations

Depending on your findings:

Remove Malware

Remove Persistence

Patch Vulnerabilities

Reset Credentials

Rotate Secrets

Remove Unauthorized Accounts

Rebuild Compromised Systems

Correct Security Misconfigurations

77. Develop Recovery Recommendations

Include:

Restore from Known-Good Backup

Validate System Integrity

Reconnect Systems Gradually

Increase Monitoring

Verify Authentication

Validate Business Services

Confirm No Recurrence

78. Identify Detection Gaps

Ask:

Which attacker behavior was detected?

Which behavior was missed?

Which alert occurred too late?

Which telemetry was unavailable?

Which detection could be improved?

This transforms the incident into a defensive improvement opportunity.

79. Create Detection Recommendations

Examples:

Improve authentication correlation

Alert on unusual PowerShell lineage

Detect suspicious DNS from endpoints

Correlate endpoint and network telemetry

Monitor new scheduled tasks

Detect unusual internal authentication

Improve web-server process monitoring

80. Identify Security Control Improvements

Consider:

MFA

Least Privilege

Network Segmentation

EDR

Application Hardening

Patch Management

Email Security

Web Application Firewall

DNS Security

Centralized Logging

Backup Protection

Recommendations must connect to actual findings.

81. Create the Technical Incident Report

Use:

# Technical Incident Report

## Case Information

Case ID:
GHC-SOC-2026-020

## Incident Classification

Document the final classification.

## Severity

Low / Medium / High / Critical

## Initial Detection

Document the alerts that initiated the investigation.

## Initial Access

Document evidence.

## Authentication

Document:
- users
- source IPs
- failures
- successes
- privilege

## Endpoint Activity

Document:
- processes
- command lines
- files
- hashes

## Persistence

Document findings.

## Credential Activity

Document findings.

## Network Activity

Document:
- DNS
- IPs
- domains
- ports
- Zeek
- Suricata

## Lateral Movement

Document:
- source
- destination
- identity
- protocol
- outcome

## Web Activity

Document relevant findings.

## Indicators of Compromise

List all validated IOCs.

## Threat Intelligence

Document enrichment.

## Incident Scope

List affected:
- systems
- users
- applications

## Data Impact

Document confidentiality, integrity, and availability.

## Timeline

Insert the master incident timeline.

## MITRE ATT&CK

Document evidence-supported techniques.

## Root Cause

Confirmed / Suspected / Undetermined

## Containment

Document immediate actions.

## Eradication

Document recommendations.

## Recovery

Document recommendations.

## Detection Improvements

Document lessons learned.

## Final Assessment

Summarize the technical investigation.

82. Create the Executive Incident Summary

Your executive report should avoid unnecessary technical detail.

Use:

# Executive Incident Summary

## Incident

GHC-SOC-2026-020

## What Happened?

Provide a concise explanation.

## Business Impact

Explain:
- affected systems
- affected users
- service impact
- potential data exposure

## Current Status

Active / Contained / Recovered / Under Investigation

## Severity

Low / Medium / High / Critical

## Actions Taken

Summarize containment actions.

## Remaining Risk

Explain unresolved concerns.

## Next Steps

Summarize:
- remediation
- recovery
- monitoring
- security improvements

83. Mission Challenge — Final SOC Investigation

Your SOC Manager asks:

Determine what happened between 01:00 and 04:00, whether the alerts represent one coordinated incident, what assets and identities were affected, and what the organization must do next.

You must answer:

1. What was the earliest suspicious event?

2. What alert first brought the activity to the SOC’s attention?

3. Which identity was initially involved?

4. What source initiated suspicious authentication?

5. Did authentication succeed?

6. Was privileged access involved?

7. Which endpoint became suspicious?

8. What processes executed?

9. Was PowerShell involved?

10. Was malware identified?

11. What was the malware hash?

12. What threat intelligence exists?

13. Was persistence established?

14. Was credential access observed?

15. Was system discovery performed?

16. What domains were queried?

17. What external IPs were contacted?

18. What did Zeek observe?

19. What did Suricata detect?

20. Was command-and-control activity present?

21. Did the attacker contact additional internal systems?

22. Was lateral movement attempted?

23. Did lateral movement succeed?

24. Was CYSA-LINUX01 compromised?

25. Was CYSA-WEB01 involved?

26. Was web exploitation observed?

27. Were suspicious server files created?

28. Was data collected?

29. Was potential exfiltration observed?

30. What are the validated IOCs?

31. How are the indicators related?

32. What is the complete attack timeline?

33. Which MITRE ATT&CK techniques are supported?

34. Which systems are confirmed compromised?

35. Which identities are compromised or suspected?

36. What is the confidentiality impact?

37. What is the integrity impact?

38. What is the availability impact?

39. What is the incident severity?

40. Is the threat still active?

41. What should be contained first?

42. What evidence must be preserved?

43. What is the likely root cause?

44. What remediation is required?

45. What security controls should be improved?

84. Document Your Investigation

Update:

~/CySA-Lab/Investigations/LAB20/investigation-notes.md

Use:

# LAB20 SOC Analyst Capstone Investigation

## Case

GHC-SOC-2026-020

## Initial Alerts

Document all alerts.

## Investigation Hypotheses

Document your initial hypotheses.

## Authentication Investigation

Document findings.

## Endpoint Investigation

Document findings.

## Malware Investigation

Document findings.

## Persistence Investigation

Document findings.

## Network Investigation

Document findings.

## Linux Investigation

Document findings.

## Web Investigation

Document findings.

## Threat Intelligence

Document IOC enrichment.

## Lateral Movement

Document findings.

## Potential Exfiltration

Document findings.

## IOC Inventory

Document all validated indicators.

## Incident Scope

### Confirmed Compromised

List systems.

### Suspected

List systems.

### Exposed / Contacted

List systems.

### Unaffected

List systems where supported.

## Identity Scope

Document affected identities.

## Master Timeline

Build the chronological incident timeline.

## MITRE ATT&CK Mapping

Document evidence-supported techniques.

## Impact

### Confidentiality

Document assessment.

### Integrity

Document assessment.

### Availability

Document assessment.

## Severity

Low / Medium / High / Critical

## Incident Status

Active / Contained / Historical / Unknown

## Root Cause

Confirmed / Suspected / Undetermined

## Immediate Containment

Document prioritized actions.

## Eradication

Document recommendations.

## Recovery

Document recommendations.

## Detection Improvements

Document defensive improvements.

## Final Technical Assessment

Summarize the complete incident.

85. Example Final Analyst Assessment

A simulated final assessment might resemble:

Case:
GHC-SOC-2026-020

Classification:
Confirmed Multi-Stage Security Incident

Initial Access:
Suspicious authentication activity was followed by successful access to CYSA-WIN01.

Identity:
A user account showed authentication activity inconsistent with expected behavior.

Execution:
Suspicious PowerShell and endpoint process activity occurred shortly after authentication.

Malware:
An unknown executable was identified and preserved for analysis.

Network:
CYSA-WIN01 queried suspicious infrastructure and established outbound connections.

Threat Intelligence:
Several indicators were associated with suspicious activity.

Persistence:
Persistence-related activity was identified and requires remediation.

Lateral Movement:
The compromised endpoint contacted additional internal systems. Successful compromise must be determined independently for each destination.

Web Activity:
Web-server alerts were investigated separately and correlated where evidence supported a relationship.

Scope:
CYSA-WIN01 confirmed compromised.
Additional assets require continued investigation.

Data Exfiltration:
Not confirmed from currently available evidence.

Severity:
High

Status:
Containment required.

Recommended Response:
Isolate confirmed compromised systems, secure affected identities, preserve evidence, block validated malicious indicators, investigate internal movement, remove persistence, rotate credentials, remediate the initial access vector, and conduct environment-wide IOC hunting.

86. Evidence to Capture

Capture:

01-alert-inventory.png
02-authentication-failures.png
03-successful-authentication.png
04-privileged-access.png
05-user-pivot.png
06-endpoint-pivot.png
07-process-execution.png
08-process-tree.png
09-powershell-activity.png
10-malware-alert.png
11-file-hash.png
12-persistence.png
13-dns-activity.png
14-zeek-connections.png
15-suricata-alerts.png
16-threat-intelligence.png
17-internal-connections.png
18-lateral-movement.png
19-linux-investigation.png
20-web-investigation.png
21-ioc-inventory.png
22-ioc-relationship-map.png
23-potential-exfiltration.png
24-master-timeline.png
25-mitre-attack-map.png
26-incident-scope.png
27-identity-scope.png
28-evidence-inventory.png
29-containment-plan.png
30-technical-report.png
31-executive-summary.png
32-final-assessment.png

87. Capstone Validation Checklist

Triage

• All initial alerts were identified

• Alerts were placed chronologically

• Investigation hypotheses were created

• High-value pivots were identified

Identity

• Failed authentication was investigated

• Successful authentication was investigated

• Privileged access was investigated

• User activity was correlated across systems

Endpoint

• Process execution was investigated

• Process lineage was constructed

• PowerShell activity was analyzed

• Suspicious files were identified

• File hashes were calculated

• Malware alerts were investigated

• Persistence was investigated

Network

• DNS activity was analyzed

• Zeek telemetry was analyzed

• Suricata alerts were investigated

• External communications were identified

• Potential C2 was assessed

• Internal connections were investigated

Lateral Movement

• Internal authentication was reviewed

• Lateral-movement indicators were investigated

• Attempted and successful movement were distinguished

Linux

• Linux authentication was reviewed where relevant

• Linux activity was investigated

• Compromise status was determined

Web

• Web logs were reviewed where relevant

• Suspicious requests were investigated

• Server-side evidence was correlated

• Web compromise status was determined

Threat Intelligence

• IOC inventory was created

• Significant IOCs were enriched

• IOCs were searched across the environment

• IOC relationships were documented

• Confidence levels were assigned

Impact

• Potential data collection was investigated

• Potential exfiltration was assessed

• Confidentiality impact was assessed

• Integrity impact was assessed

• Availability impact was assessed

Incident Reconstruction

• Earliest suspicious activity was identified

• Initial access was investigated

• Execution was identified

• Persistence was assessed

• Credential activity was assessed

• Discovery was assessed

• Lateral movement was assessed

• C2 was assessed

• Impact was assessed

• Master timeline was completed

• Attack story was reconstructed

• MITRE ATT&CK mapping was completed

Response

• Incident scope was established

• Identity scope was established

• Severity was assigned

• Threat activity status was determined

• Evidence was preserved

• Evidence hashes were recorded

• Containment priorities were established

• Eradication recommendations were created

• Recovery recommendations were created

• Detection gaps were identified

• Security-control improvements were recommended

Reporting

• Technical incident report was completed

• Executive incident summary was completed

• Final analyst assessment was completed

• Required screenshots/evidence were captured

88. Mission Review

This capstone brought together the complete CySA+ analyst workflow.

You began with:

Disconnected Alerts

and transformed them into:

Alerts
  ↓
Evidence
  ↓
Correlation
  ↓
Indicators
  ↓
Relationships
  ↓
Timeline
  ↓
Attack Story
  ↓
Scope
  ↓
Impact
  ↓
Containment
  ↓
Remediation
  ↓
Reporting

The most important lesson from this lab is:

A SOC analyst’s job is not simply to respond to alerts. The analyst must transform fragmented telemetry into an evidence-backed explanation of what happened, what is affected, and what the organization should do next.

A mature investigation combines:

Identity Evidence
       +
Endpoint Evidence
       +
Network Evidence
       +
Application Evidence
       +
Threat Intelligence
       +
Timeline Analysis
       +
Business Context
       =
Defensible Incident Assessment

Skills Developed

After completing this capstone, you should be able to:

• triage enterprise security alerts

• manage a structured SOC investigation

• investigate suspicious authentication

• analyze Windows and Linux telemetry

• investigate endpoint processes

• analyze PowerShell activity

• investigate malware alerts

• analyze file hashes

• identify persistence

• investigate network traffic

• analyze Zeek telemetry

• investigate Suricata alerts

• analyze DNS activity

• investigate web security events

• enrich indicators with threat intelligence

• correlate endpoint and network evidence

• investigate lateral movement

• assess command-and-control activity

• investigate potential data exfiltration

• build IOC relationship maps

• reconstruct multi-stage attacks

• map evidence to MITRE ATT&CK

• establish incident scope

• assess CIA impact

• determine incident severity

• prioritize containment

• recommend eradication and recovery

• identify detection gaps

• produce technical incident reports

• communicate incidents to leadership

CySA+ Labs Completed

You have completed the full CompTIA CySA+ practical lab sequence:

Lab 01 — Build Your CySA+ SOC Lab Environment
        ↓
Lab 02 — Windows Security Log Analysis
        ↓
Lab 03 — Windows Endpoint Investigation
        ↓
Lab 04 — Linux Security Log Investigation
        ↓
Lab 05 — Network Traffic Analysis with Wireshark
        ↓
Lab 06 — Network Attack Detection with Zeek
        ↓
Lab 07 — IDS Alert Investigation with Suricata
        ↓
Lab 08 — SIEM Fundamentals and Log Ingestion
        ↓
Lab 09 — SIEM Detection and Correlation Lab
        ↓
Lab 10 — Authentication Attack Investigation
        ↓
Lab 11 — Phishing Email Investigation
        ↓
Lab 12 — Malware Analysis Fundamentals
        ↓
Lab 13 — Endpoint Malware Investigation
        ↓
Lab 14 — Vulnerability Scanning and Assessment
        ↓
Lab 15 — Vulnerability Prioritization with CVSS, EPSS and Threat Intelligence
        ↓
Lab 16 — Threat Intelligence and IOC Enrichment
        ↓
Lab 17 — Incident Triage and Evidence Collection
        ↓
Lab 18 — Ransomware Incident Investigation
        ↓
Lab 19 — Web Application Attack Investigation
        ↓
Lab 20 — SOC Analyst Capstone Investigation

What’s Next?

CySA+ Runbooks

You have completed the hands-on investigation labs.

The next stage should move from guided investigations to repeatable analyst procedures.

Instead of learning:

How do I investigate this?

you will build operational procedures answering:

When this happens in the SOC,
what exactly should the analyst do?

The runbook series will convert the skills developed throughout these labs into reusable SOC workflows for:

• alert triage

• suspicious authentication

• phishing

• malware

• endpoint compromise

• network alerts

• threat-intelligence enrichment

• vulnerability escalation

• ransomware

• web application incidents

• evidence collection

• incident escalation

The progression becomes:

Lessons
   ↓
Labs
   ↓
Investigation Skills
   ↓
Runbooks
   ↓
Repeatable SOC Operations
   ↓
Job-Ready Analyst Workflow

➡️ Next: CySA+ Runbook 01 — SOC Alert Triage and Escalation