Lion Cipher Lab
Detect anomalous logins with a behavioral baseline: build a UEBA analytic from scratch
- SOC Analyst / Blue Team
- Advanced
- ~75 min
- Free · no account required
Why it matters
Signature detection answers 'have I seen this exact bad thing before?' — a known malware hash, a known C2 domain, a Sigma rule for a specific command line. It is essential, and it is blind to the attack that looks completely normal: a valid username and a valid password, used by the wrong person. That is ATT&CK T1078 Valid Accounts, and it is one of the most common and most damaging initial-access and persistence techniques precisely because nothing is malformed — the login SUCCEEDS. You cannot write a signature for 'this is the real Alice' versus 'this is an attacker holding Alice's…
What you'll learn
- building a per-user behavioral baseline from a training window
- detecting impossible travel from geo-coordinates (haversine velocity)
- scoring off-baseline behavior: first-seen country/host and off-hours logins
- fusing signals into a UEBA risk score with an alert threshold
- reasoning about precision/recall, baseline drift, and the cold-start problem
Steps in this lab
- The idea: learn 'normal', then alert on the deviation
- The three signals — and the false positives to name up front
- Generate a synthetic authentication log
- Write the detector: baseline, impossible travel, off-baseline, risk fusion
- Run it and read the ranked alerts
- The judgment: drift, cold start, the VPN blind spot, alert-don't-block
- What you built — and the reflex to keep