Lion Cipher Lab
Reconstruct an attack from Windows event logs: suspicious logons, a new admin, and process creation (4624/4625/4688/4720)
- SOC Analyst / Blue Team
- Intermediate
- ~40 min
- Free · no account required
Why it matters
The single most common thing a SOC analyst actually does is stare at a handful of Windows Security events and decide whether they add up to an incident. No tool hands you that answer -- the events are just structured records, and the story lives in the fields and the order. A brute-force burst, one successful logon, a new account, a group change, and a process launch each look mundane in isolation; read as a sequence they are a domain compromise in progress. This drill trains exactly that reading: which Event IDs carry the signal, which fields disambiguate them, and how one 4624 with the…
What you'll learn
- reading a Windows Security event and finding the fields that matter (Event ID, Logon Type, Logon ID, Account Name, Source Network Address, command line)
- recognising the highest-value pattern in identity logs: a 4625 failure burst that turns into a 4624 success
- interpreting Logon Type (2 interactive, 3 network, 10 RDP) and why the same Event ID means very different things by type
- reading 4672 as an admin-level session and 4720/4728 as account creation and privileged-group escalation
- reading a 4688 process-creation command line to spot living-off-the-land tools like certutil
- correlating across Event IDs by shared Logon ID to reconstruct a full attacker timeline
- judgment: when a single raw event answers the question and when you need SIEM-style correlation across IDs and hosts
Steps in this lab
- The setup, and how to read a single Windows Security event
- Evidence A -- a wall of failed logons (Event ID 4625)
- Evidence B -- the failures stop and a success appears (4624 + 4672)
- Evidence C -- a brand-new account, instantly made Domain Admin (4720 + 4728)
- Evidence D -- what did they actually run? (Event ID 4688 and its command line)
- Put it together: one event is nothing, the sequence is everything
- Do it better: audit policy, baselining, and correlating across hosts