SOC Workbooks and Lookups

Prompts and answers

• Looking at the identity inventory, what is the role of R.Lund at the company?
  US Financial Adviser
• Checking the asset inventory, what data does the HQ-FINFS-02 server store?
  Financial records
• Finally, does the file sharing from the scenario look legitimate and expected? (Yea/Nay)
  Yea
• According to the network diagram, which service is exposed on the TCP/10443 port?
  VPN
• Now, which subnet would the server behind 172.16.15.99 IP belong to?
  Database subnet
• Finally, does the scenario look like a True Positive (TP) or False Positive (FP)?
  TP
• Which SOC role would use workbooks the most (e.g. SOC Manager)?
  SOC L1 Analyst
• What is the process of gathering user, host, or IP context using TI and lookups?
  Enrichment
• Looking at the workbook example, what platform is used as an identity inventory source?
  BambooHR
• What flag did you receive after completing the first workbook?
  THM{the_most_common_soc_workbook}
• What flag did you receive after completing the second workbook?
  THM{be_vigilant_with_powershell}
• What flag did you receive after completing the third workbook?
  THM{asset_inventory_is_essential}