Hands-On Labs and the Challenge Lab: Hunting End to End
Hands-on labs and the Challenge Lab are where the other domains combine. You receive a dataset - PCAP, Windows event logs, Falcon-style JSON, memory or a mixed bundle - and must produce an evidence-backed answer under time pressure.
A repeatable workflow
- Preserve and hash the evidence; record timestamps in UTC.
- Form a hypothesis from the initial hint, then baseline what is normal in the dataset.
- Start from the highest-fidelity artefact and pivot outward: hash to process, process to parent, domain to DNS, IP to proxy.
- Corroborate every finding with a second, ideally different, data source.
- Scope: how many hosts, which accounts, what data left.
- Write the timeline and the ATT&CK mapping.
Tooling pivots
Running Suricata over the PCAP with EVE JSON output gives alerts, extracted files and protocol metadata in one pass, and jq filters those records quickly. Zeek conn and dns logs give the network baseline. On the endpoint side, Timeline Explorer or Splunk/Kibana turns EVTX into an ordered story.
Worked example
A challenge PCAP contains a Word document retrieved over HTTP; host logs show winword.exe spawning mshta.exe, which contacts a rare domain. Reasoning: the parent-child pair is abnormal, so treat the domain as a lead rather than a fact. Pivot the domain through DNS logs to find four more hosts, then check each for a scheduled task. Because two independent sources agree, the finding is defensible and the scope expands from one host to five.
Traps
- Reporting one host without scoping the estate.
- Trusting a single data source.
- Mixing local and UTC timestamps in the timeline.
- Overfitting to indicators handed to you in the challenge instead of describing behaviour.