# Full SOC Incident Response (lab)

> A utility opened an incident, isolated the affected workstation, rebuilt it from clean media, blocked the command-and-control destination, and closed the ticket as fully remediated.

Canonical: https://codelivly.com/labs/ir-capstone

| | |
|---|---|
| Type | Investigation |
| Difficulty | Advanced |
| Points | 600 |
| Session length | 1 h |
| Completions | 2 |

A utility opened an incident, isolated the affected workstation, rebuilt it from clean media, blocked the command-and-control destination, and closed the ticket as fully remediated. Every one of those actions was correct. The SOC manager reviewing closed incidents found something in the telemetry AFTER the rebuild and reopened the case.

## Objective

Work a complete incident from detection to lessons learned, and learn the two failures that make otherwise competent responses ineffective: scoping on the artefact you happened to find rather than on the credential the attacker reuses, and eradicating the malware without eradicating the access. You will establish the true origin, the true blast radius, and demonstrate from the evidence that the response failed.

## Tasks

1. Detection and triage: establish what fired, and where
2. Scope on the credential, not on the artefact
3. Establish the real blast radius
4. Judge the response from the change record
5. Prove the eradication failed
6. Lessons learned

## Related

- [All labs](https://codelivly.com/practice?type=lab)