The public web service on NW-WEB01 spawned an interactive shell seconds after a request. Establish the parent-child chain, adjudicate the command line, and stop the process tree behind an approval gate without taking the second web node offline with it.
Mission brief · C-341
the break-glass IR account `svc-ir`, checked out of the vault for this incident — never the compromised identity
The detection fired in the EDR console. You opened a live-response session from that detection, so your shell rides the EDR agent channel — containing the host will *not* cut you off, which is exactly why you contain from here rather than over SSH.
EDR console (detections + live response)
Endpoint detection & response
Live-response shell on the affected host
Host shell session
The affected host
Owner: The system's business owner, named on the asset record
Containing a host you haven't identified can stop revenue. Check criticality and owner before you isolate anything.
You may act alone
Ask a human first
A web server exists to serve pages, not to run shells. The parent-child relationship between a listening service and an interactive shell is one of the highest-signal detections in the whole catalog, and it is the step that turns an exploited application into a foothold.
The shell is the symptom. What matters is who spawned it: a service account that owns a listening port has no business starting bash, cmd or powershell. Walk the tree until you reach the process that owns the socket, and file that.
The request that broke the application and the command it then ran are different steps with different evidence. Keeping them apart is what lets you say how they got in and what they did, rather than blurring both into one vague compromise.
Behind a load balancer, isolating every web node is an outage you caused. Scope containment to the host carrying the shell and let its peers serve.
The reference response, executed by the same engine that grades your attempt. Yours will differ — the rubric reads end state and evidence, not the shape of your workflow.
Gate approved — 100%
12 of 12 rubric rules hold.
Gate denied — 79%
Refusing the consequential action is a defensible choice with a measured cost; the difference is what the lab is teaching.
A listening web service spawns an interactive shell — the payload step that follows an exploited public application.
| Technique | Name | Tactic |
|---|---|---|
| T1059.004 | Command and Scripting Interpreter: Unix Shell | Execution |
| T1190 | Exploit Public-Facing Application | Initial Access |
| T1505.003 | Server Software Component: Web Shell | Persistence |
The workflow reached a terminal success state on the graded run.
behavior · weight 20
A consequential action passed through a human approval gate.
safety · weight 15
No non-idempotent operation was retried without an idempotency key.
efficiency · weight 10
Every action node resolves its secret from the vault, never an inline field.
configuration · weight 10
The learner attached at least one linkable piece of evidence to the case.
investigation · weight 10
The case carries an analyst closure note explaining the outcome.
explanation · weight 10
No innocent asset in the alert batch was contained, disabled or revoked.
behavior · weight 15
The playbook survived the integration faults it met and still finished.
configuration · weight 15
Nothing was changed in the estate before evidence had been gathered.
investigation · weight 10
The learner filed the parent that spawned the shell, not just the shell itself.
investigation · weight 20 · T1059.004 Command and Scripting Interpreter: Unix Shell (Execution)
The command line was enriched to a verdict before anything was stopped.
investigation · weight 15 · T1059.004 Command and Scripting Interpreter: Unix Shell (Execution)
The exploited node was isolated; its healthy peer was left serving.
behavior · weight 20 · T1190 Exploit Public-Facing Application (Initial Access)
Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.
| Concept | Cortex Forge | Summit SOAR | Storyline |
|---|---|---|---|
| approval | Manual task | Prompt | Page |
The same reference to an enrichment node's verdict, written three ways:
The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.
| Concept | Cortex XSOARXSOAR 8.x | Splunk SOARSplunk SOAR 6.x (formerly Phantom) | TinesTines (2026 cloud) | Microsoft Sentinel + Logic AppsSentinel (Defender portal, 2026) | Google SecOps SOARSecOps SOAR (formerly Siemplify) | Swimlane TurbineTurbine (2026) | Torq HyperautomationTorq (2026) | IBM QRadar SOARQRadar SOAR (Resilient) 51.x | ServiceNow Security OperationsSecOps (Flow Designer era) |
|---|---|---|---|---|---|---|---|---|---|
| approval | Manual (data collection) task | Prompt block | Page (form) / Send to Chat | Approval action (Teams / email) | Manual action | Task / approval action | Approval step (Torq Chat / Slack) | Manual task / phase gate | Approval activity |
The same parent-child reasoning covers Office spawning script hosts, print spoolers spawning shells, and CI runners spawning interpreters.
CYBRARY