Lion Cipher Lab

Interview scenario: "A new local admin appeared on a file server at 02:14, walk me through it" (score your triage on 7 cases)

• SOC Analyst / Blue Team
• Intermediate
• ~75 min
• Free · no account required

Why it matters

"Someone was added to the Administrators group on a server in the middle of the night" is one of the most common alerts a SOC (security operations center: the team that watches alerts around the clock) sees, and one of the most common interview questions for a SOC Analyst job. It is a perfect test because the same event fires for an approved change, a tired help-desk tech cutting a corner, a provisioning robot doing its job, and an attacker making themselves a back door. An analyst who calls every one an incident burns out the incident team; an analyst who closes them because "admins work…

What you'll learn

• Separating what a 4732 alert proves (who added which SID to which group, when, on which host) from what it does not (why, from where, whether it was approved)
• Ordering the checks and saying why: log integrity first, then resolve the member SID, join the 4732 to its 4624 by Logon ID to read the logon type and source, read the 4688 command line and parent process, match a change ticket, then look at what happened afterwards
• Telling an approved change, a process breach, a provisioning tool, and an intrusion apart from the same event ID
• Measuring a triage approach against an answer key: correct verdicts, false incident escalations, and missed attacks
• Choosing a proportionate response for each verdict: close with a note, route to the manager and change management, or open an incident and contain
• Naming the blind spots out loud: auditing that is off, a cleared log, real admins at 02:00, and tickets that are reused, forged or filed late

Steps in this lab

1. The prompt, and what the interviewer is really grading
2. Step 1: state the facts the alert gives you, and only those
3. Step 2: name the technique and both hypotheses
4. Open a terminal and make a working folder
5. Build the evidence pack and decide each case yourself
6. Step 3: what you check FIRST, and why that order
7. Run the triage script: score the naive rule first
8. Step 4: read the structured table, case by case: what confirmed and what cleared
9. The structured approach's own false escalation: C7, and what --allow-retro costs
10. Step 5: escalation and proportionate containment, per verdict
11. The honest negatives: what this walk-through cannot see
12. Step 6: deliver it in 60 seconds
13. Clean up

Open the full interactive lab →