SOC › Module 7 › Lesson 3
Account Host Actions
Account and host action literacy — disable account, force reset, host quarantine, service stop category — defender decisions on $HUNT_LAB stubs.
Visual · t30_account_host_actions
Account/host actions = named containment rows. $HUNT_LAB. Original Cyberlium.
Opening
Accounts and hosts are containment levers — name disable, reset, and quarantine options on YOUR lab stubs without credential attack cookbooks.
Account/host action literacy names: disable compromised account category, force password reset category, revoke active sessions category, host quarantine via EDR category, stop malicious service/task category, and golden/sensitive account watch list category. Analyst maps $HUNT_LAB scenario (synthetic user hunt-lab-analyst-03 on labeled VM) to recommended actions — documents order (account before host or parallel category), comms note stub, UTC — without spraying passwords, without disabling prod admin accounts without RoE, without malware persistence to 'need' host quarantine. Cyberlium teaches defender decision literacy on instructor stubs — NOT how to steal or reuse credentials. Refused: unauthorized account disable on employer AD, credential stuffing, prod EDR tampering. Lab row: account/host action checklist with sequencing note for one lab scenario.
1. Named account/host actions
Disable account, force reset, revoke sessions, host quarantine, stop service — five literacy anchors.
Sequence matters — document order and dependency on lab stub.
Command guide
Try these commands — Named account/host actions
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Account actions — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final MITRE T1531 — https://attack.mitre.org/techniques/T1531/ (account access removal context) Elastic response — https://www.elastic.co/guide/en/security/current/administration.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install jq
macOS:
Command — copy this
brew install jq
Windows:
Command — copy this
choco install jq
═══ LINUX / macOS ═══
Command — copy this
export HUNT_LAB=${HUNT_LAB:-$HOME/cyberlium-lab/t30-hunt}
cat > "$HUNT_LAB/ir/account-host-actions-LAB-IR-001.md" <<'EOF'
# Account & Host Actions — LAB-IR-001 (lab doc only)
## Account: jsmith
- [ ] Disable account in lab AD (or document simulated action)
- [ ] Force password reset
- [ ] Revoke active sessions (document steps)
## Host: WIN-HUNT01
- [ ] Move to quarantine VLAN (YOUR lab VM only)
- [ ] Preserve memory/disk snapshot before remediation
- [ ] Block outbound except IR tooling (lab firewall doc)
## Host: WIN-HUNT02
- [ ] Monitor svc_backup activity (HNT-004 correlation)
Never execute on stranger/production systems without authorization
EOFCommand — copy this
jq '.[] | select(.user=="jsmith")' "$HUNT_LAB/logs/alerts.json" grep -E 'jsmith|WIN-HUNT|Never' "$HUNT_LAB/ir/account-host-actions-LAB-IR-001.md"
Primary tools to practice this lesson: grep, jq. Reference sites: Account actions (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); MITRE T1531 (https://attack.mitre.org/techniques/T1531/); Elastic response (https://www.elastic.co/guide/en/security/current/administration.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defender hygiene
Verify account identity from hunt telemetry — not guess from single alert.
Note business impact (shared service account category) in decision row.
3. Refused
No unauthorized prod AD changes; no credential attack cookbooks.
Account/host literacy supports containment — not offensive access.
4. What you ship: account/host action checklist
Five actions + sequencing note + lab scenario application + NEVER credential attack line.
5. What you record before the next lesson
Account/host action checklist path.
6. Wrong vs right: stranger prod vs YOUR hunt telemetry
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Disable employer domain admin account without ticket to 'practice containment.'
Right
Account/host action checklist from $HUNT_LAB scenario. Next: Containment Lab.
Mission: account/host action checklist
1) Name five account/host actions. 2) Sequencing note for lab scenario. 3) Apply to one $HUNT_LAB stub. 4) Write NEVER credential attack line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Service account disable — impact literacy?”
Knowledge Check
APPLY: Account/host actions on Cyberlium are:
Multiple choice
Knowledge Check
APPLY: True or False: Unauthorized prod account disable is lab.
True or False
Knowledge Check
APPLY: Action checklist should:
Multiple choice