SIMULATION During the course of normal SOC operations, three anomalous events occurred and were flagged as potential IoCs. Evidence for each of these potential IoCs is provided. INSTRUCTIONS Review ea

SIMULATION During the course of normal SOC operations, three anomalous events occurred and were flagged as potential IoCs. Evidence for each of these potential IoCs is provided. INSTRUCTIONS Review each of the events and select the appropriate analysis and action options for each IoC. If at any time you would like to bring back the initial state of the simulation, please click the Reset All button. Answer:

IoC 1 Indicators:

DNS queries for a suspicious subdomain (update.s.domain, *.s.domain) Responses include odd CNAME and A records Activity resembles contacting a malicious domain Correct Selections:

Analysis: The service is attempting to resolve a malicious domain Action: Implement a blocklist for known malicious ports IoC 2 Indicators:

ICMP Echo (ping) requests from 10.0.5.5 to multiple hosts All packets are dropped Suggests a device is probing the network Correct Selections:

Analysis: Someone is footprinting a network subnet Action: Block ping requests across the WAN interface IoC 3 Indicators:

BitTorrent traffic (/announce?info_hash, peer_id, application/x-bittorrent) Indicates P2P protocol activity Correct Selections:

Analysis: An employee is using P2P services to download files Action: Enforce endpoint controls on third-party software installations