Northwind portal breach: detect, contain, debrief Start this lab

Why this matters

Most SOAR training stops at the alert. A real breach has three halves that are graded differently: what you can prove happened, what you are allowed to break to stop it, and what you write down so the same hole is not open next quarter. This lab makes all three mandatory on one estate.

Concepts

Objectives graded

• Prove initial access, lateral movement and exfiltration from the host itself
• Contain the server and the service account the evidence implicates, under approval
• File a post-incident record naming root cause and the loss you can actually scope

MITRE ATT&CK coverage

An unauthenticated upload bypass on an internet-facing portal drops a web shell; the portal service identity reaches the finance database and an archive is pushed to an external host over the same channel the shell arrived on.

What each rubric rule proves

• The workflow reached a terminal success state on the graded run.

  behavior · weight 20 · T1041 Exfiltration Over C2 Channel (Exfiltration)

• A consequential action passed through a human approval gate.

  safety · weight 15 · T1041 Exfiltration Over C2 Channel (Exfiltration)

• No non-idempotent operation was retried without an idempotency key.

  efficiency · weight 10 · T1071.001 Application Layer Protocol: Web Protocols (Command and Control)

• Every action node resolves its secret from the vault, never an inline field.

  configuration · weight 10 · T1078 Valid Accounts (Defense Evasion)

• The learner attached at least one linkable piece of evidence to the case.

  investigation · weight 10 · T1505.003 Server Software Component: Web Shell (Persistence)

• The case carries an analyst closure note explaining the outcome.

  explanation · weight 10 · T1190 Exploit Public-Facing Application (Initial Access)

• No innocent asset in the alert batch was contained, disabled or revoked.

  behavior · weight 15 · T1078 Valid Accounts (Defense Evasion)

• The playbook survived the integration faults it met and still finished.

  configuration · weight 15 · T1071.001 Application Layer Protocol: Web Protocols (Command and Control)

• Nothing was changed in the estate before evidence had been gathered.

  investigation · weight 10 · T1505.003 Server Software Component: Web Shell (Persistence)

• The analyst worked the compromised server directly instead of grading the alert.

  investigation · weight 10 · T1505.003 Server Software Component: Web Shell (Persistence)

• Initial access was located on disk: the web shell in the upload directory.

  investigation · weight 10 · T1505.003 Server Software Component: Web Shell (Persistence)

• The external peer was read off the host's own socket table and its access log.

  investigation · weight 10 · T1071.001 Application Layer Protocol: Web Protocols (Command and Control)

• The live transfer was identified by PID before anything was contained.

  behavior · weight 10 · T1041 Exfiltration Over C2 Channel (Exfiltration)

• Lateral movement was proven: the portal account reached the finance database.

  investigation · weight 10 · T1078 Valid Accounts (Defense Evasion)

• The compromised portal server is isolated at end state.

  behavior · weight 15 · T1190 Exploit Public-Facing Application (Initial Access)

• The service account the attacker used is disabled pending credential rotation.

  behavior · weight 10 · T1078 Valid Accounts (Defense Evasion)

• The staged archive was found, so the scope of the loss can be stated rather than guessed.

  investigation · weight 10 · T1041 Exfiltration Over C2 Channel (Exfiltration)

• Root cause is recorded as the unpatched application version, not as analyst error.

  explanation · weight 10 · T1190 Exploit Public-Facing Application (Initial Access)

• A post-incident timeline was filed: initial access, lateral movement, exfiltration, containment.

  explanation · weight 15 · T1190 Exploit Public-Facing Application (Initial Access)

• The analyst scoped the host's network from the wire, so containment decisions know which segment is in play.

  investigation · weight 5

• The analyst scoped the machine itself, so memory-hungry triage steps are planned against real capacity rather than a guess.

  investigation · weight 3

• Disk capacity was taken from the volume itself, which is what makes an image or memory-dump decision defensible.

  investigation · weight 3

Common mistakes

• Filing the attacker address from the brief rather than the host's own socket table.
• Isolating the database server, which was reached over a legitimate session and is not compromised.
• Closing the case without the staged archive, so the loss can never be scoped.
• Recording root cause as human error when the box records its own unpatched version.

Same idea, three vendors

Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.

The same concepts in shipping products

The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.