BLUE TEAM DEFENSE LAB
← Hub

🛡 Blue Team Defense Lab

Analyze real attack patterns, identify threats, respond to incidents, and build defensive reports. This is what SOC analysts and incident responders do every day.

📋
PHASE 01 OF 05
Log Analysis — SIEM Investigation
SOC analysts start every investigation with logs. You have Windows event logs from the Target breach. Identify the attacker path, tools used, and data exfiltration event.
Windows Event Logs — Target Corp, November-December 2013

Review each log entry. Reconstruct the attack timeline and answer all questions in a Google Doc.

Date Time EventID Account Source IP Description ---------- --------- -------- ------------------- --------------- -------------------------------- 2013-11-15 14:22:01 4624 HVAC\fazio_svc 208.74.1.20 VPN login SUCCESS 2013-11-15 14:22:44 4624 HVAC\fazio_svc 208.74.1.20 Accessed vendor portal (normal) 2013-11-27 23:14:33 4624 HVAC\fazio_svc 208.74.1.20 VPN login SUCCESS [OFF HOURS] 2013-11-27 23:15:02 4776 HVAC\fazio_svc 208.74.1.20 Credential validation: TARGET\admin 2013-11-27 23:15:09 4624 TARGET\admin 208.74.1.20 Lateral move to POS network [!] 2013-11-27 23:18:44 4663 TARGET\admin 208.74.1.20 File access: \POS\bin\track2.exe 2013-12-02 01:44:11 4663 TARGET\admin 208.74.1.20 track2.exe modified [MALWARE!] 2013-12-11 02:14:55 4663 TARGET\admin 208.74.1.20 FTP out to 96.27.170.30 (4.2GB)
Answer all questions in your Google Doc:
1. What was the initial access vector? How did the attacker get in?
2. What account was pivoted to for lateral movement?
3. What is the filename of the malware installed on POS systems?
4. What external IP received the exfiltrated data?
5. How many days between initial access (Nov 27) and data theft (Dec 11)?
6. What Event IDs would you create SIEM alerts for to catch this earlier?
7. Name 3 defensive controls that would have stopped this attack.
✓ Phase 1 Submitted — Good work, analyst.
🔍
PHASE 02 OF 05
Threat Detection — IOC Identification
Indicators of Compromise are the digital fingerprints attackers leave behind. Identify and classify IOCs from the SolarWinds attack, then explain how to use them for threat hunting.
IOC Reference Card
IOC TypeExampleDetection Source
IP Address96.27.170.30Firewall logs, netflow
Domain Nameavsvmcloud.comDNS logs, proxy logs
File Hashd0d626deb3f9484e649294a8dfa814c5AV, EDR agents
File PathC:\Windows\SysWOW64\netsetupsvc.dllEDR, file integrity
Registry KeyHKLM\SOFTWARE\SolarWinds\OrionWindows Registry
User AgentSolarWinds/1.0Web proxy logs
SolarWinds Threat Hunt Data

The data below contains a mix of malicious and legitimate activity from a SolarWinds environment. Find every IOC.

FILE INTEGRITY MONITOR: SolarWinds.Orion.Core.BusinessLayer.dll SHA1: d0d626deb3f9484e649294a8dfa814c5eaacb685 Path: C:\Program Files (x86)\SolarWinds\Orion\ Modified: 2020-03-26 (!!should not change after install) DNS QUERY LOG (past 24h): SRV-DC01 > windowsupdate.microsoft.com [NORMAL] SRV-DC01 > avsvmcloud.com [SUSPICIOUS - unknown] SRV-DC01 > api.github.com [NORMAL] SRV-DC01 > freescanonline.com [SUSPICIOUS - unknown] SRV-DC01 > deftsecurity.com [SUSPICIOUS - unknown] SRV-DC01 > thedoccloud.com [SUSPICIOUS - unknown] WRK-025 > avsvmcloud.com [SUSPICIOUS - same C2] NETFLOW - EXTERNAL CONNECTIONS: SRV-DC01 > 13.59.205.66:443 (AWS US-EAST) 420KB [SUSPICIOUS] SRV-DC01 > 54.193.127.66:443 (AWS US-WEST) 82KB [SUSPICIOUS] SRV-DC01 > 5.252.177.25:443 (Eastern EU) 14KB [SUSPICIOUS - known C2] WRK-018 > 8.8.8.8:53 (Google DNS) normal REGISTRY CHANGES: HKLM\SYSTEM\CurrentControlSet\Services\SolarWinds Orion Module Engine HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SolarWinds (new key!)
In your Google Doc:
1. List every IOC with its type (IP, domain, hash, file path, registry key)
2. Which IOCs are definitely malicious vs. possibly suspicious?
3. How would you use these IOCs to hunt across 500 machines?
4. Write a SIEM rule description that would have detected the C2 traffic
5. What is the purpose of the registry key change you found?
✓ Phase 2 Submitted
📡
PHASE 03 OF 05
Packet Analysis — Wireshark Lab
Network forensics means reading raw packet captures to reconstruct what an attacker did. Analyze this simulated Wireshark capture from the Colonial Pipeline incident.
Wireshark Packet Capture — Colonial Pipeline (2021)

Each row is a network packet. Read the protocol and Info columns carefully. The attacker is operating from an external IP. Reconstruct exactly what they did, step by step.

No. Time Src Dst Proto Len Info ---- ---------- ---------------- ---------------- ------ ---- ------------------------------------------- 1 09:14:22 10.10.1.55 10.10.1.1 DNS 75 Query: vpn.colpipe.corp 2 09:14:23 10.10.1.1 10.10.1.55 DNS 91 Response: 10.10.5.12 3 09:14:24 185.220.101.9 10.10.5.12 TCP 66 SYN [port 443 VPN] EXTERNAL SOURCE 4 09:14:24 10.10.5.12 185.220.101.9 TCP 66 SYN-ACK 5 09:14:25 185.220.101.9 10.10.5.12 TLS 308 Client Hello TLSv1.2 6 09:14:25 10.10.5.12 185.220.101.9 TLS 887 Server Hello, Cert 7 09:14:26 185.220.101.9 10.10.5.12 TLS 122 Application Data [VPN AUTH SUCCESS] 8 09:14:28 185.220.101.9 10.10.10.0/24 ICMP 74 Echo Request x255 [PING SWEEP] 9 09:14:31 185.220.101.9 10.10.10.22 TCP 66 SYN [port 21 FTP] 10 09:14:31 10.10.10.22 185.220.101.9 TCP 74 SYN-ACK "220 vsFTPd 2.3.4" 11 09:14:32 185.220.101.9 10.10.10.22 FTP 82 Request: USER smiley:) 12 09:14:33 10.10.10.22 185.220.101.9 TCP 66 SYN [port 6200 BACKDOOR OPENED] 13 09:14:34 185.220.101.9 10.10.10.22 TCP 66 Connect port 6200 [ROOT SHELL!] 14 09:15:01 10.10.10.22 185.220.101.9 TCP 14M Data stream [COMMAND OUTPUT] 15 09:22:44 185.220.101.9 10.10.10.22 FTP 2.1M STOR payload.exe 16 09:22:48 10.10.10.22 10.10.0.0/16 SMB 128 Trans2 FIND_FIRST2 [SHARE ENUM] 17 09:22:51 10.10.0.0/16 10.10.10.22 SMB 156 FIND_FIRST2 Response [LATERAL MOVE]
Analysis Reference
Protocol/PortMeaningWhat to Look For
DNSName resolutionUnusual domains, high frequency queries (C2 beaconing)
TCP SYN/SYN-ACKConnection setupPort scanning, unexpected port connections
FTP port 21File transferClear-text credentials, banner grabbing
FTP "USER smiley:)"vsftpd backdoor triggerSmiley face in username = CVE-2011-2523
TCP port 6200vsftpd backdoor shellUnexpected port 6200 = root shell spawned
SMB port 445Windows file sharingLateral movement, share enumeration
ICMP broadcastPing sweepNetwork discovery / host enumeration
Wireshark Filter Cheat Sheet
Filter suspicious FTP: ftp.request.command == "USER" Filter by external IP: ip.src == 185.220.101.9 Filter backdoor port: tcp.port == 6200 Filter ping sweeps: icmp and ip.dst == 255.255.255.255 Filter SMB lateral move: smb.cmd == 0x32 Find large transfers: frame.len > 10000
In your Google Doc, reconstruct the full attack:
1. Write a step-by-step narrative of exactly what the attacker did (Packets 1-17)
2. At which packet number did the attacker gain root access? How do you know?
3. What did the attacker upload in packet 15? Why is this significant?
4. What is the attacker doing in packets 16-17?
5. Write 3 Wireshark/SIEM filter rules that would have alerted on this attack
6. What network security control would have blocked packet 3 entirely?
✓ Phase 3 Submitted
🚨
PHASE 04 OF 05
Incident Response — NIST Playbook
Incident response follows the NIST framework: Preparation, Detection, Containment, Eradication, Recovery, and Lessons Learned. Apply it to the Equifax breach.
NIST Incident Response Framework
1. PREPARATION
Before an incident: establish IR team, create playbooks, deploy monitoring tools, train staff, define communication plan
2. DETECTION
Identify that an incident has occurred: SIEM alerts, user reports, anomaly detection, threat intel feeds
3. CONTAINMENT
Stop the bleeding: isolate affected systems, block malicious IPs/domains, disable compromised accounts, preserve evidence
4. ERADICATION
Remove the threat: delete malware, patch vulnerabilities, close attack vectors, rotate compromised credentials
5. RECOVERY
Restore operations: verify clean systems, restore from backups, monitor for re-infection, gradual return to normal
6. LESSONS LEARNED
Post-incident review: what went wrong, what worked, update playbooks, brief leadership, implement improvements
Equifax Breach Scenario — Your Incident

It is July 29, 2017. You are the Equifax CISO. Your security team just detected anomalous outbound traffic from your Apache Struts web server. You have confirmed exploitation of CVE-2017-5638. 143 million records may be at risk. You have 30 minutes before your board calls for an update.

Write a full Incident Response Report in your Google Doc covering all 6 NIST phases for the Equifax breach:

For each phase, write:
• What specific actions were taken (or should have been taken)
• Who is responsible for each action (CISO, IR team, legal, PR, IT)
• What tools or resources are needed
• What Equifax actually did wrong (compared to best practice)

Bonus: Write the 30-minute board briefing statement (2-3 sentences) that the CISO should deliver.
✓ Phase 4 Submitted
📝
PHASE 05 OF 05
Defensive Report — Security Recommendations
The final deliverable of any blue team engagement is a written report of findings and defensive recommendations. Write yours using evidence from all four phases.
Report Structure
SectionContentLength
Executive SummaryPlain English overview of what you found, severity, and top recommendation. Written for non-technical leadership.1 paragraph
FindingsEach vulnerability or threat you identified across all 4 phases, with severity rating (Critical/High/Medium/Low)1 entry per finding
Attack TimelineChronological reconstruction of attacker activity based on logs and packet analysisTimeline format
RecommendationsSpecific, actionable controls mapped to each finding. Include tool/technology suggestions.1 per finding
MITRE ATT&CK MappingMap each attack technique to the ATT&CK framework (use attack.mitre.org)Table format
Defensive Controls Reference
ControlPreventsExample Tool
Multi-Factor AuthenticationCredential theft, VPN compromiseDuo, Microsoft Authenticator
Patch ManagementKnown CVE exploitationWSUS, Qualys, Tenable
Network SegmentationLateral movementVLANs, Zero Trust, Palo Alto
SIEM / SOC MonitoringDelayed detectionSplunk, Elastic, Microsoft Sentinel
Endpoint Detection & ResponseMalware installationCrowdStrike, SentinelOne, Defender
Data Loss PreventionData exfiltrationSymantec DLP, Forcepoint
Web Application FirewallSQLi, RCE, XSSAWS WAF, Cloudflare, ModSecurity
Vulnerability ScanningUnpatched systems going unnoticedNessus, OpenVAS, Rapid7
Your Assignment
Write a complete Blue Team Defensive Report in your Google Doc covering all four scenarios studied in this lab:

• Target Breach (2013) — Log Analysis findings
• SolarWinds (2020) — IOC Identification findings
• Colonial Pipeline (2021) — Packet Analysis findings
• Equifax (2017) — Incident Response findings

Your report must include: Executive Summary, all findings with severity ratings, attack timeline, recommendations with tool suggestions, and MITRE ATT&CK technique IDs for each attack vector found.
✓ Blue Team Lab Complete — Outstanding work, Defender.
○ Log Analysis ○ Threat Detection ○ Packet Analysis ○ Incident Response ○ Defensive Report