Telemetry labs

About 17 min read

On this page

The exercise packets train judgment on evidence someone has already pulled for you. On shift, nobody does that. You write the query, you get back a few thousand rows, most of them noise, and the one row that decides the case doesn’t look special. This track adds that missing step. Every lab runs on public attack telemetry recorded in a lab environment, and every lab’s deliverable is an ASSURED record: the claim, the citation, the confidence label and the decision. A correct answer to a trivia question doesn’t count.

The track complements commercial practice platforms; it doesn’t compete with them. They supply volume and variety. ASSURED supplies the decision model and the record standard, and this page applies both to data you query yourself.

How the track runs

• Prerequisites: the chapter for each lab, and the exercise packets first if you are new to the method. The labs assume you can read Windows Security and Sysmon Sysmon Microsoft Sysinternals service that writes detailed endpoint telemetry (process creation with command lines, network connections, driver and DLL loads, file-time changes) to the Windows event log for SIEM ingestion. Now also a built-in optional feature on Windows 11 and Server 2025 (rendered messages are localized, so parse the XML); Sysmon for Linux exists too. events; the formats and normalization page covers the event IDs used here.
• Write before you query further. Each lab names a stopping point. Write the artifact there, then open the instructor notes. As in the packets, your answer doesn’t need to match the model; it needs to survive comparison with it.
• Cite rows, not impressions. Every claim in a lab artifact names the event (host, event ID, timestamp) or the query that produced it, per the evidence citation rule.
• Lab data is lab data. These datasets were recorded on emulation ranges, so they carry the harness with them: capture tools, management agents, the operator’s own remote session. Each of those is a question to answer and record, never a finding to assume. Working out which rows belong to the range is part of the skill.

Lab setup

Three free resources cover the whole track, plus one optional resource you should only ever run in an isolated lab. Licenses and versions below were checked on 13 October 2026; re-check them before you build a course on them.

For the query stack, Splunk Free indexes up to 500 MB a day on a single instance and doesn’t expire. It has no user authentication, so give each learner their own instance. It can also take the OTRF JSON files through an upload. After any upload, check that each event’s time is the event’s own timestamp field and not the upload time ( event time, not ingest time Event Time vs Ingest Time When the source recorded an event versus when the SIEM received it: in ECS, @timestamp versus event.ingested; in Splunk, _time versus _indextime; in Microsoft Sentinel, TimeGenerated versus ingestion_time(). A batch of late-arriving events can look like a burst in ingest time. See Case D. ), because a timeline built on upload times is fiction. For the small atomic datasets, jq on a laptop is enough, and the queries below use it. If you can’t install anything, CyberDefenders hosts a BOTS v3 lab that is enough for Lab 5.

One lab per phase

Each lab gives the question, the dataset slice, a starting query, the artifact to hand in and the pass checks. The queries are starting points. The lab is the second and third query you write once you see what the first one returned. Times in the datasets are as recorded, in UTC unless a lab says otherwise.

Lab 1 · Alert: the task with a borrowed name

Alert 45 minutes

• Briefing: a rule fires on event 4698 (scheduled task created) on WORKSTATION6, for a task in the \Microsoft\Windows folder, created by a user account. No change record covers this host today.
• The question: what does the alert claim, what does the full event say that the alert summary would drop, and does a second, independent source agree?
• Dataset slice: schtask_create.zip (host), OTRF SDWIN-201219070027. Instructors: the dataset’s notebook page shows the operator’s commands, so it’s the answer key. Don’t hand it to learners.
• The artifact: the Alert sections of the alert report, with the claim, the mechanism family, the validation checks and a detection verdict.

unzip -p schtask_create.zip | jq -c 'select(.EventID==4698)
| {Hostname, TimeCreated, SubjectUserName, TaskName, TaskContent}'

Pass checks. (1) The claim is stated as a claim, separate from the verdict. (2) The task’s action, trigger and run-as principal come from the event’s TaskContent field, not from the task name. (3) The name is flagged as masquerading as an OS component, and the flag is labeled as a hypothesis. (4) The learner finds an independent source in the same window and cites it. (5) Detection axis: true positive, because the rule’s claim holds. Activity axis: undetermined, handed to Subject. See Validation for why those are two separate verdicts.

Lab 2 · Subject: who acted, from where

Subject 45 minutes

• The question: the event names an account. Who acted, from which host, through what process chain, and with what privilege?
• Dataset slice: the same file as Lab 1. It holds events from two hosts.
• The artifact: a Subject entry for each entity, scored on the four dimensions, plus the depth level the case should run at, with the reason.

unzip -p schtask_create.zip | jq -r 'select(.EventID==4624 or .EventID==4672
  or (.Channel=="Microsoft-Windows-Sysmon/Operational" and .EventID==1))
| [.TimeCreated, .Hostname, .EventID, (.TargetUserName // .SubjectUserName // .User),
   (.LogonType // ""), (.IpAddress // ""), (.ParentImage // ""), (.Image // "")]
| @tsv'

Pass checks. (1) The logon that preceded the task is identified with its logon type, authentication package and source address. (2) The source address is resolved to a host from the data, not assumed. (3) The process chain on the source host is reconstructed from parent to child (see process relationships). (4) The privileged logon (event 4672) at the target is read as context: the account holds administrative rights there. It is not evidence of escalation. (5) The depth call follows from it: a privileged identity fails the Level 0 eligibility gate, so the case runs at Level 2 (see the depth ladder). (6) The range’s own processes are recorded as questions, not attributed to the actor.

Lab 3 · Scope: what this sensor can and cannot see

Scope 60 minutes

• The question: import the network capture recorded during the same activity. Where was it captured, what share of it is the case, and what does the investigation still need that no source in hand can show?
• Dataset slice: schtask_create.zip (network), imported with sudo so-import-pcap /full/path/to/file. If the import rejects the .pcapng format, convert the file first with Wireshark’s editcap -F pcap.
• The artifact: a scope statement covering entities in and out, each exclusion with the observation that would pull it in, the time window with a lookback, and a list of what can’t be seen (see naming what is invisible).

Pass checks. (1) The capture point is identified from evidence, so the learner knows whose traffic this sensor can see. (2) The traffic between the two hosts is matched to the host-log events by ports and sequence. (3) The time offset between the capture and the host log is measured and explained before any join (see clock skew). A whole-hour offset is a time-zone error, not drift. (4) The logon was Kerberos, so the learner asks where the ticket exchange with a domain controller is recorded, and names that source as missing if neither file holds it. (5) The heaviest flow in the capture gets an explicit in-scope or out-of-scope decision with a reason.

Lab 4 · Uncover: the process that read LSASS

Uncover 60 to 90 minutes

• Briefing: the EDR reports a process reading lsass.exe memory on WORKSTATION5. No change record or sanctioned test covers the host.
• The question: which process, with what access, running from what code, doing what else, and what is the strongest benign explanation still standing?
• Dataset slice: empire_mimikatz_logonpasswords.zip (host), OTRF SDWIN-190518202151. It holds about 6,000 events from three hosts, most of them background.
• The artifact: a timeline with a source and confidence label on each row, a hypothesis ledger with at least one rejected alternative and the evidence that rejected it, and an ATT&CK mapping that records the version used (see the ATT&CK page).

unzip -p empire_mimikatz_logonpasswords.zip | jq -r 'select(.EventID==10
  and ((.TargetImage // "") | test("lsass.exe$"; "i")))
| [.["@timestamp"], .Hostname, .SourceImage, .SourceProcessId,
   .GrantedAccess, .CallTrace] | @tsv'

Pass checks. (1) The routine readers of LSASS are separated from the outlier by access mask Process Access Mask (GrantedAccess) The access rights a process requests when it opens a handle to another process, recorded in the GrantedAccess field of Sysmon event 10. Masks that include memory read on LSASS, such as 0x1010, are a classic credential-dumping signal. See Telemetry labs. and call trace, not by process name. (2) The call trace’s unresolved frame is read correctly: code running from memory that no file on disk backs. (3) The learner pivots on the outlier’s process ID to its child processes and its network connections, and records how often it connects and where. (4) A second subsystem corroborates the read: the Windows Security handle-request and object-access events for the same process. (5) The ledger keeps the administrator-tool alternative and rejects it with cited evidence; it isn’t dismissed by assertion. (6) The mapping uses current ATT&CK names and states the version. The dataset’s own metadata is as old as its recording.

Lab 5 · Risk: the bucket that was opened

Risk 60 minutes

• Briefing: a cloud alert reports that an access-control change granted AllUsers access to the S3 bucket frothlywebcode. Set your Splunk user time zone to UTC before you write any time down.
• The question: what could this reach, how likely is it that unauthorized activity happened, how confident are you in that judgment, and what does Risk recommend?
• Dataset slice: BOTS v3, sourcetypes aws:cloudtrail and aws:s3:accesslogs ( CloudTrail AWS CloudTrail Records API activity in an AWS account: the audit trail for security and forensic work. Management events are on by default (90 days in Event history); data events such as S3 object reads and Lambda invokes must be enabled on a trail or event data store. records the change; the access logs record who touched the bucket while it was open).
• The artifact: the Risk verdict block, with impact, likelihood and confidence each justified, the matrix cell and priority, and the recommended move.

index=botsv3 earliest=0 sourcetype=aws:cloudtrail eventName=PutBucketAcl
| table _time eventID userIdentity.userName requestParameters.bucketName sourceIPAddress

index=botsv3 earliest=0 sourcetype=aws:s3:accesslogs frothlywebcode
| stats count earliest(_time) AS first latest(_time) AS last BY operation

Pass checks. (1) The open window is bounded by two events, the change and its reversal, both cited. (2) Writes and reads during the window are counted separately, because impact differs: tampering with web code is not the same as disclosure. (3) Likelihood and confidence are kept apart. The change itself may be an honest mistake by an internal user, while activity by outside parties during the window is a separate claim with its own likelihood. (4) Anything not examined (for example, whether the bucket’s contents were served to customers) is recorded as low confidence, never as low likelihood. (5) The cell, the priority and one recommended move are stated, and the decision is left to Escalation.

Lab 6 · Escalation decision: does the tripwire fire?

Escalation decision 45 minutes

• The question: using only your Lab 4 artifacts, is any escalation criterion confirmed? If so, at what point in the data, and what do you do in the next ten minutes, in order?
• The artifact: the Escalation decision fields, and sections 1, 5, 6 and 8 of the handoff packet.

Pass checks. (1) The decision applies the E rule in its own words, and names the route that fired. (2) The learner says whether the claim behind confirmed malicious activity not fully contained by a control reaches High on the confidence rubric, citing two independent sources and the rejected alternative. (3) If it does, the escalation tripwire Escalation TripwireASSURED term ASSURED's rule that a confirmed escalation criterion escalates immediately, from any phase, and makes the case P1 whatever its matrix cell. Confirmed means supported at High confidence on the shared confidence rubric; suspicion refines Scope and re-runs the loop instead. Always written with "escalation", because Tripwire is also a file-integrity product. Formerly called the break-glass rule. See Escalation criteria. Full entry: ASSURED terms. fires at that moment and the case is P1, whatever the cell. (4) Section 6 preserves before it contains: the host’s volatile memory goes first, because isolation and reboot destroy it (see preserve before you contain). Reversible pre-authorized actions follow. A password reset is non-reversible and waits for IR or the owner unless the protocol pre-authorizes it. (5) Section 8 treats every account with a logon session on the host as credential-exposed, and names the query that lists them.

Lab 7 · Documentation: the cold read

Documentation 45 minutes

• The task: write the full record for your Lab 5 case: the closure record if your Escalation decision was close, the handoff packet if it was escalate. Then write one tuning request from Lab 1 that would have fired earlier or with more context.
• The swap: exchange records with a peer who didn’t work your case. The peer gets five minutes, then states the case and the next decision aloud, unaided.
• The artifact: the record, the tuning request and the peer’s one-line restatement.

Pass checks. The five checks of the close-note rubric (verdict on both axes, every claim cited, confidence per claim, gaps named, next action clear), plus the cold-read test: the peer’s restatement matches the record. A record that fails gets rewritten, not marked down.

Capstone: a Level 2 case, scored blind

Full arc Level 2 4 to 6 hours

The capstone uses the OTRF APT29 Day 1 dataset: host telemetry from four Windows hosts plus packet captures, recorded while OTRF replayed the first scenario of the APT29 emulation used in MITRE’s ATT&CK Evaluations (Round 2). The host file is a 14 MB zip that expands to about 385 MB of JSON. The scorer holds the Scenario 1 emulation plan from the Center for Threat-Informed Defense (Apache 2.0), which lists every step the operator ran. That emulation plan Adversary Emulation Plan A step-by-step replay of one threat group's documented procedures, used to test detections and produce realistic telemetry, such as the Center for Threat-Informed Defense's APT29 plan. See Telemetry labs. is the known truth. Don’t give it to the learner.

Briefing for the learner. One alert, nothing else:

EDR alert, 2020-05-02 02:55:57 UTC
rule:     Executable with a document-style name launched by the user shell
host:     SCRANTON.dmevals.local
user:     DMEVALS\pbeesly
process:  C:\ProgramData\victim\cod.3aka3.scr  (parent: explorer.exe)
follow-on: outbound connection from the same process to 192.168.0.5:1234
           five seconds later

Run the case at Level 2 whatever intake would decide: the capstone grades the full arc. The file name contains a right-to-left override Right-to-Left Override (RLO) The Unicode control character U+202E, which displays the text after it in reverse. A file actually named invoice, then U+202E, then fdp.exe displays as "invoiceexe.pdf", so an executable passes for a PDF. A Masquerading technique; see also File Extension Spoofing. character, which some tools render as garbled bytes. Spotting that, and explaining why it matters, is part of the Alert phase. The deliverable is the complete handoff packet, including case metadata, all nine sections, the Escalation decision fields and the timestamp of every escalation decision.

Scoring, blind. Strip the learner’s name from the packet, so the scoring is blind Blind Scoring Scoring work without knowing whose it is or when in the course it was written, so expectations do not move the score. See Blind scoring with two raters. . Two scorers score it independently against the grid below, compare scores and reconcile any difference by fixing the grid’s wording, not by averaging. One point per check:

1. The escalation tripwire fires at the first criterion that reaches High. Record that row’s dataset time and the learner’s elapsed time to it. A P1 declared long after its first confirmed criterion is a late P1, however good the packet is.
2. Initial execution is established from the process event and its parent, and the masquerade is explained.
3. The command-and-control channel is shown from both the host connection events and the network capture, with any time offset between them measured.
4. Every timeline row carries a UTC time, a source and a confidence label, and the time base is stated.
5. Coverage: each plan step that appears in the telemetry is either in the timeline or named in Open questions. Report the covered share separately. A step the telemetry never captured can’t be held against the learner.
6. ATT&CK mappings use current names and state the version.
7. The ledger rejects at least one alternative explanation, with the evidence that rejected it.
8. The Risk verdict gives both axes, then impact, likelihood, confidence and the cell.
9. Section 6 records preservation before containment, the things deliberately not done and the reason, and which non-reversible steps await approval.
10. Every open question names the query or source that would settle it, and a scorer who reads the packet cold can state the next decision within five minutes.

Disqualifiers: any claim labeled High that the known truth contradicts, and any finding without a cited artifact.

Instructor notes

Common wrong turns and anchor exemplars, by lab

Lab 1. The usual wrong turn: reading the task’s action (it starts Notepad) and calling the case benign. The action is the operator’s placeholder. The claim worth validating is the mechanism: a user account remotely created a startup task that runs as SYSTEM, under a path borrowed from the operating system. The second wrong turn is trusting the name. TaskContent is the evidence.

• Failing exemplar: “Scheduled task created by malware on WORKSTATION6; SYSTEM persistence. Escalate.”
• Passing exemplar: “4698 on WORKSTATION6 at 07:00:22 UTC: a task under \Microsoft\Windows\SoftwareProtectionPlatform\ running cmd.exe /C notepad.exe as S-1-5-18 at startup, created by pgustavo. Detection: true positive. Activity: undetermined. HIGH that the task was created as described (4698 TaskContent), MEDIUM that the name imitates an OS component (path compared with a clean host’s task list, still to be done).”

Lab 2. The source host’s own capture tool (Wireshark’s dumpcap.exe, started by the same account about twenty seconds earlier) and its monitoring agent show up in the process list. Learners who attribute them to the actor have skipped the question “is this the range or the case?”. A strong answer resolves 172.18.39.5 to WORKSTATION5 from that host’s own connection events, rebuilds powershell.exe → cmd.exe → schtasks.exe /create ... /S WORKSTATION6, and routes the case to Level 2 because of the 4672 at the target.

Lab 3. The capture was taken on WORKSTATION5’s own interface. About three quarters of its packets are a single RDP session from an internet address to that workstation. On a range, that session is the operator. In production, it would be the most important line in the capture, and a learner who scopes it out without saying why fails check 5. The RPC exchange between the hosts sits exactly five hours away from the host log’s timestamps, and neither file holds Kerberos traffic or domain controller logs. WORKSTATION6’s own lsass.exe connects to 172.18.38.5 a second later: that’s a lead to the domain controller, not its log.

Lab 4. Two svchost.exe readers use the masks 0x1000 and 0x2000. The outlier is powershell.exe with 0x1010 (query limited information plus memory read), and its call trace ends in an UNKNOWN frame. The same process ID beacons repeatedly to an internal address on port 80 and launches whoami /user at High integrity. Events 4656 and 4663 for the same process are the corroborating subsystem. The wrong turn is stopping at ” Mimikatz Mimikatz The canonical credential-theft tool: reads LSASS (Local Security Authority Subsystem Service) memory to extract plaintext passwords, NTLM hashes, and Kerberos tickets, and implements pass-the-hash, pass-the-ticket, golden and silver tickets. Written by Benjamin Delpy as a proof of concept; now embedded in nearly every intrusion toolchain and re-implemented inside countless loaders and C2 frameworks. EDR watches lsass access patterns specifically because of it, and Credential Guard and LSA protection, now default-on for many Windows 11 configurations, block its classic LSASS read. detected” without rejecting the administrator-tool alternative on the record.

Lab 5. Learners anchor on who made the change and stop there. The graded move is splitting the claims: the change (likely an internal mistake), the activity during the window (a separate likelihood), and what was never examined (low confidence, not low likelihood). Write-ups for the official BOTS v3 question set are public; don’t let learners treat those answers as their record, since the deliverable is the reasoning.

Lab 6. The trap runs both ways: escalating on “Mimikatz” before the alternative has been rejected, or waiting to finish Uncover after the claim has already reached High. Grade the timestamp of the decision, not only the decision.

Capstone. The emulation compresses a campaign into about half an hour of recorded time, so time gaps alone mean little. Expect learners to under-report the later stealth steps and to over-claim attribution: the scenario emulates APT29, but nothing in the telemetry alone attributes it. Pair this with the cognitive traps debrief, and run the capstone after Session 4 of the teaching guide.

Sources (checked 13 October 2026)

• Splunk, botsv3 repository README (size, format, required versions, CC0-1.0 license) and “Boss of the SOC v3 Dataset Released!” (18 March 2020).
• Open Threat Research Forge, Security-Datasets repository (LICENSE file, dataset metadata for SDWIN-201219070027 and SDWIN-190518202151, APT29 Day 1 README) and securitydatasets.com.
• Security Onion Solutions, releases (3.3.0, 11 September 2026), hardware requirements, so-import-pcap and license.
• Splunk, About Splunk Free (Splunk Enterprise Admin Manual 10.4).
• Red Canary, Atomic Red Team (MIT).
• Center for Threat-Informed Defense, APT29 adversary emulation plan (Apache 2.0).
• The dataset facts in the instructor notes (event IDs, access masks, hosts, the five-hour offset and the RDP share of the capture) were checked against the downloaded files on the same date.