SOC › Module 7 › Lesson 4
Lab — Detections
Common detections lab on $SOC_LAB — phishing, malware, brute-force literacy cards triaged on sample alert set.
Visual · t29_detections_lab
Lab: common detections pack on YOUR $SOC_LAB sample alerts. Original Cyberlium.
Opening
Ship common-detection triage from YOUR sample alert set — phishing, malware, brute — zero offensive campaigns or unauthorized attacks.
On YOUR $SOC_LAB per brief: (1) scope proof — sample alert set labeled (email, EDR, auth); (2) phishing detection literacy card applied to ≥1 sample row; (3) malware detection card on ≥1 EDR sample; (4) brute-force detection card on ≥1 auth sample; (5) combined disposition table with enrichment stubs and UTC; (6) integrity — $SOC_LAB only, detection literacy not attack execution, no unauthorized SIEM; (7) chmod 600 pack. Cross-link Module 6 triage process and FP/TP rows. Named attack classes are triage vocabulary on YOUR samples — NOT how to run phishing, malware, or brute-force attacks.
1. Lab deliverables
Three detection-class cards + combined disposition table — single alert set cross-index.
MITRE tag literacy optional per brief — category level only.
Command guide
Try these commands — Lab deliverables
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MITRE detection — https://attack.mitre.org/ Elastic detection rules — https://www.elastic.co/guide/en/security/current/prebuilt-rules.html NIST IR — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install jq
macOS:
Command — copy this
brew install jq
Windows:
Command — copy this
choco install jq
═══ LINUX / macOS ═══
Command — copy this
export SOC_LAB=${SOC_LAB:-$HOME/cyberlium-lab/t29-soc}
echo '=== jq alert correlation: phishing + brute + malware ==='
jq '[.[] | select(.mitre=="T1566" or (.mitre|startswith("T1110")))]' "$SOC_LAB/logs/alerts.json"
jq -c 'select(.action=="block") | {user, category, url}' "$SOC_LAB/logs/proxy.jsonl"
grep -E 'phishing|malware|brute|DETECTION|NEVER' "$SOC_LAB/notes/phishing-detection-literacy.txt" "$SOC_LAB/notes/malware-detection-literacy.txt" "$SOC_LAB/notes/brute-detection-literacy.txt"═══ WINDOWS ═══
Command — copy this
findstr "T1110 T1566" $HOME/cyberlium-lab/t29-soc/logs/alerts.json Get-Content $HOME/cyberlium-lab/t29-soc/notes/brute-detection-literacy.txt | Select-String BAN
Primary tools to practice this lesson: jq, grep. Reference sites: MITRE detection (https://attack.mitre.org/); Elastic detection rules (https://www.elastic.co/guide/en/security/current/prebuilt-rules.html); NIST IR (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Quality bar
Each disposition cites observed alert fields — not guessed narrative.
Zero offensive steps in any card — triage literacy only.
3. Integrity
Phishing send, malware authoring, brute-force run = zero credit.
Share-safe export redacts user emails — mentor pack chmod 600.
4. What you ship: detections lab pack
Phishing + malware + brute cards + disposition table + integrity — chmod 600.
5. What you record before the next lesson
Detections lab pack path.
6. Wrong vs right: stranger SIEM vs YOUR sample logs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Detections lab includes phishing campaign walkthrough against real users.
Right
Detections lab pack on $SOC_LAB sample alerts. Next: quiz.
Mission: detections lab
1) Scope and alert set proof. 2) Three detection-class cards. 3) Combined disposition table. 4) Integrity block; chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “One alert set — minimum row count?”
Knowledge Check
APPLY: Detections lab scope:
Multiple choice
Knowledge Check
APPLY: True or False: Offensive attack steps belong in detections lab.
True or False
Knowledge Check
APPLY: Named detection classes teach:
Multiple choice