Chapter 15 — Security operations and blue team: guided lab
Lesson map
Lesson 15 published. Map, example, EX043.
flowchart TD
N0["Learning outcomes"]
N1["15.1 The lab"]
N2["15.2 Baseline and threshold"]
N3["Lab — rename spike"]
N4["15.3 Reading the result"]
N5["15.4 Response decision"]
N6["15.5 False alarms"]
N7["15.6 Reflection"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX043"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["15.1 The lab"]
N2["15.2 Baseline and threshold"]
N3["Lab — rename spike"]
N4["15.3 Reading the result"]
N5["15.4 Response decision"]
N6["15.5 False alarms"]
N7["15.6 Reflection"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX043"]
[Learning outcomes]
|
v
[15.1 The lab]
|
v
[15.2 Baseline and threshold]
|
v
[Lab — rename spike]
|
v
[15.3 Reading the result]
|
v
[15.4 Response decision]
|
v
[15.5 False alarms]
|
v
[15.6 Reflection]
|
v
[Worked example] --> [Exercise EX043]
Learning outcomes
You will (1) practise detecting mass file changes in a safe lab; (2) set a spike threshold from a baseline; (3) connect file activity to response decisions; (4) reflect on speed versus certainty.
15.1 The lab
The training lab replays synthetic file-share events from a clinic. No real files are touched. The exercise asks trainees to detect the start of mass renaming, a typical sign of encryption.
The replay uses the same kind of per-minute counts that the real file share at clinic 2 produced on the incident night, but no clinic data and no encryption program are involved. Trainees see only numbers on a screen, which keeps the exercise safe while still asking them to make the decision an analyst faces at 01:34.
15.2 Baseline and threshold
In quiet minutes, the share sees 0–3 renames per minute. The rule sets the limit at ten times the highest quiet value: 30 renames per minute.
The baseline values 2, 0, 3 and 1 give a highest quiet value of 3, so ten times that is 30. The code also uses max(max(baseline), 1), which keeps the limit at 10 or above even if every quiet minute were zero; without that guard, a share with no quiet renames would get a limit of zero and alert on its first rename.
Lab — rename spike
"""File renames per minute on a clinic file share; flag a sudden spike (synthetic)."""
per_minute = {"01:30": 2, "01:31": 0, "01:32": 3, "01:33": 1, "01:34": 180, "01:35": 410, "01:36": 395}
baseline = [2, 0, 3, 1]
limit = 10 * max(max(baseline), 1)
for minute, n in per_minute.items():
print(f"{minute} renames={n:4} {'SPIKE' if n > limit else ''}")
print("limit =", limit)
Run with python3 lab_renames.py. Verified output:
01:30 renames= 2
01:31 renames= 0
01:32 renames= 3
01:33 renames= 1
01:34 renames= 180 SPIKE
01:35 renames= 410 SPIKE
01:36 renames= 395 SPIKE
limit = 30
15.3 Reading the result
From 01:30 to 01:33, renames stay between 0 and 3. At 01:34 they jump to 180, then 410 and 395 — far above the limit of 30. The spike begins at 01:34.
The jump is large compared with the limit: 180 is six times 30, and 410 is nearly fourteen times. Nothing between the quiet minutes and the spike approaches the limit, so the start time does not depend on how the limit is set. Adding 180, 410 and 395 gives 985 renames, matching the file-change count in the worked example. Mei also notes that the spike continues at 01:36, the minute Raj approved isolation, so encryption was still running when containment began.
15.4 Response decision
A spike on a patient-records share at night is acted on immediately: isolate the server, then investigate. Waiting for certainty would let encryption continue.
On the incident night every minute of waiting cost hundreds of files: 410 renames at 01:35 alone. Isolation stops the server talking to the network, which halts encryption from a remote session, and the investigation then works on preserved logs. Raj's approval two minutes after the spike start is the kind of speed this measure asks for. The investigation that follows can still find that the renames were legitimate, and isolation can then be reversed with little lasting harm to the clinic.
15.5 False alarms
Legitimate bulk renames happen — for example, an X-ray system reorganising folders after an update. The response step includes a quick check of the process doing the renaming.
The check is short: which program and account are performing the renames. An X-ray vendor's update tool running under its service account after a scheduled update explains a spike, whereas an unknown program launched from the support2 session does not. Process creation logging, switched on at clinic 2 in chapter 6, is what makes that check possible on that server.
15.6 Reflection
Trainees compare their time-to-isolation in the lab. The fastest act within two minutes of the spike.
Two minutes matters because of the per-minute counts: at the replayed rates, each extra minute is several hundred more renamed files. Trainees who hesitate usually do so waiting for proof of encryption, and the comparison shows them that the spike itself, on a patient-records share at night, is already enough to act on. The lab records each trainee's time from the spike to the isolation decision, so the comparison is based on measured times rather than impressions.
Practising the call
The lab ends with a mock phone call: trainees explain to a role-played office manager what is happening and why the server is isolated, in under a minute and without jargon. Clear calls get faster client decisions.
Worked example
In the real BrightSmile incident, the spike began at 01:34; Raj approved isolation at 01:36. Afterwards, the file-change log showed 985 files renamed in those three minutes. Restoring them from the previous night's backup took two hours the next morning.
Synthetic case. Lab counts come from the script; the restoration figure is invented.
Errors and limits
Some encryption tools work slowly to avoid spikes; rename-rate rules miss them.
Exercises
- EX043 — Threshold. How is the spike limit set and what is it? Rubric: 3 = 10 × highest quiet value = 30; 2 = partial; 1 = guess; 0 = none.
- EX044 — Spike start. When does the spike begin and with how many renames? Rubric: 3 = 01:34 with 180; 2 = partial; 1 = wrong; 0 = none.
- EX045 — Speed versus certainty. Why isolate before fully investigating? Rubric: 3 = encryption continues while waiting; patient records at risk; 2 = partial; 1 = always; 0 = none.
Synthesis
Spike detection on file activity catches encryption early, but only fast, authorised response turns detection into protection.
Continue studying — chapter 15 of 30
← Chapter 14 (draft) · Course chapter index · Chapter 16 (draft) →