EY SOC Range

DFIR, Threat Detection & Enterprise Incident Response Simulation

LIVE LAB ENVIRONMENT

Welcome to the EY SOC Range. This simulation evaluates your capabilities across digital forensics, static binary analysis, phishing triage, and SIEM-driven threat hunting in an enterprise SOC environment.

1. Flag Format & Submission Integrity
  • Flag Syntax: All flags adhere strictly to the format: ESR{...} (e.g., ESR{wazuh_det3ct10n_succ3ss}, ESR{m@lw4re_c2_d0ma1n_f0und}).
  • Exact Matching: Flags are case-sensitive. Submit strings exactly as extracted, without leading or trailing spaces.
  • Integrity Policy: Sharing flags, attacking range infrastructure, or tampering with shared evidence is strictly prohibited and results in immediate disqualification.
2. Range Environment & Infrastructure Access
Platform Component Access Method Credentials Core Purpose
Windows Forensic Host mstsc → <WINDOWS_SERVER_IP> Assigned traineeXX / Password Evidence triage, artifact inspection, static binary analysis
Wazuh SIEM Dashboard Browser → https://<WAZUH_SERVER_IP> Assigned traineeXX / Password Telemetry triaging, Sysmon hunting, alert correlation
3. Windows Forensic Host Orientation
  • Master Artifacts Directory: Challenge evidence, disk images, memory captures, and phishing samples are stored centrally in: 
    C:\Challenge_Artifacts\
    (This path is enforced as Read-Only to preserve master evidence integrity for all analysts).
  • Tool Repository: Forensic tools are pre-configured in system PATH and located under: 
    C:\DFIR_Tools\
    Included Tools: FTK Imager, CAPA, FLOSS, Detect It Easy (DIE), Timeline Explorer, Registry Explorer, NetworkMiner, and oletools CLI utilities.
  • Personal Workspaces: Save carved files, decoded payloads, exports, and notes inside your personal profile directory (C:\Users\traineeXX\Desktop\ or Documents\).
4. Forensic Analysis & Safe Triage Rules
Passive / Static Triage Only

Artifacts are defanged (e.g., .bin, .raw, .vir). No challenge requires live malware detonation or process execution.

VBA & Phishing Macro Extraction

Do not run macros in Office. Extract code safely using oletools in PowerShell:

olevba "C:\Challenge_Artifacts\phishing_sample.docm"
Binary Inspection & Capabilities

Use Detect It Easy (DIE) for headers/packers, and run CAPA for ATT&CK mappings:

capa "C:\Challenge_Artifacts\sample_01.bin"
String Deobfuscation

Copy obfuscated base64, hex arrays, or XOR strings into CyberChef (available via Kasm sandbox) for offline decoding.

5. Wazuh SIEM Threat Hunting Guide

Investigate endpoint telemetry, process execution trees, and authentication events using the Wazuh Dashboard:

  • Navigate to Events: Open the menu (≡) → Threat Hunting or Security Events.
  • Time Filtering: Align the dashboard time range (top right) with the timestamp window specified in the scenario prompt.
6. Range Etiquette & Operational Rules
  • Resource Sharing: You are operating on a shared multi-session environment. Do not execute heavy recursive sweeps, memory-intensive brute force tasks, or runaway loops.
  • System Boundaries: User permissions are restricted to standard analyst capabilities. Do not attempt privilege escalation or modification of system security policies.
  • Preserve Master Files: Never attempt to delete or alter files in C:\Challenge_Artifacts. Work only with local copies in your user profile.