SOC › Module 8 › Lesson 3
Validation Checks
Validation literacy — verify clean, monitor for re-infection, hunt follow-up — on $HUNT_LAB post-recovery stubs.
Visual · t30_validation_checks
Validation checks = named verify rows. $HUNT_LAB. Original Cyberlium.
Opening
Recovery without validation invites repeat compromise — name verification checks on YOUR lab stubs before any prod all-clear.
Validation checks literacy names: re-scan host with EDR category, compare hash baseline stub, review auth logs for return of IOC pattern, hunt query follow-up from Module 2–3, stakeholder sign-off category, and monitoring window duration. Analyst writes validation checklist for $HUNT_LAB post-recovery stub — pass/fail criteria, UTC, link to eradication and recovery rows — without disabling EDR to force pass, without declaring clean based on hunch, without unauthorized prod sign-off. Cyberlium teaches gate before PICERL Recovery exit — defender hygiene. Refused: validation fraud, turning off logging, prod all-clear without RoE. Lab row: validation checklist with five checks and pass criteria for one lab scenario.
1. Named validation checks
EDR rescan, hash baseline, auth log review, hunt follow-up, sign-off — five literacy anchors.
Fail path returns to Eradication — document loop honestly.
Command guide
Try these commands — Named validation checks
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Validation — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final MITRE — https://attack.mitre.org/ Elastic — https://www.elastic.co/guide/en/security/current/index.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install jq
macOS:
Command — copy this
brew install jq
Windows:
Command — copy this
choco install jq
═══ LINUX / macOS ═══
Command — copy this
export HUNT_LAB=${HUNT_LAB:-$HOME/cyberlium-lab/t30-hunt}
cat > "$HUNT_LAB/logs/process-post-recovery.jsonl" <<'EOF'
{"ts":"2026-08-23T08:00:00Z","host":"WIN-HUNT01","pid":5001,"ppid":1200,"process":"winword.exe","parent":"explorer.exe","user":"jsmith","cmdline":"winword.exe
"}
{"ts":"2026-08-23T08:05:00Z","host":"WIN-HUNT01","pid":5002,"ppid":5001,"process":"winword.exe","parent":"winword.exe","user":"jsmith","cmdline":"winword.exe
"}
EOFCommand — copy this
echo '=== Validation: no rare parent post-recovery ===' jq -c 'select(.parent=="winword.exe" and .process=="powershell.exe")' "$HUNT_LAB/logs/process-post-recovery.jsonl" || echo 'CLEAN: no winword→powershell' cat > "$HUNT_LAB/ir/validation-checklist-LAB-IR-001.md" <<'EOF' # Validation Checklist — LAB-IR-001 - [ ] No winword→powershell in post-recovery process logs - [ ] No netflow to 203.0.113.99 in new logs - [ ] jsmith logons from expected IPs only - [ ] AV scan clean on WIN-HUNT01 (lab) - [ ] PICERL containment + eradication steps marked complete EOF
Command — copy this
grep '\[ \]' "$HUNT_LAB/ir/validation-checklist-LAB-IR-001.md"
Primary tools to practice this lesson: jq, grep. Reference sites: Validation (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); MITRE (https://attack.mitre.org/); Elastic (https://www.elastic.co/guide/en/security/current/index.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Monitoring window
Post-recovery enhanced monitoring duration — literacy stub (24–72h category).
Hunt hypothesis may update from validation hits — feed Module 9 detection gaps.
3. Refused
No validation fraud or EDR disable; no unauthorized prod all-clear.
Validation literacy supports trustworthy recovery — not checkbox theater.
4. What you ship: validation checklist
Five checks + pass criteria + fail loop note + NEVER validation fraud line.
5. What you record before the next lesson
Validation checklist path.
6. Wrong vs right: stranger prod vs YOUR hunt telemetry
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Disable EDR on lab host to force validation pass.
Right
Validation checklist from $HUNT_LAB post-recovery stub. Next: Eradication Lab.
Mission: validation checklist
1) Name five validation checks. 2) Pass criteria per check. 3) Fail loop note to Eradication. 4) Write NEVER validation fraud line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Hunt follow-up — which hypothesis retest?”
Knowledge Check
APPLY: Validation literacy on Cyberlium uses:
Multiple choice
Knowledge Check
APPLY: True or False: Disabling EDR for validation pass is lab.
True or False
Knowledge Check
APPLY: Failed validation should:
Multiple choice