OSDA Exam - Guided By RedBlock

SOC-200 / OSDA Cheatsheet

Detection-focused reference for OffSec's SOC-200 course and the OffSec Defense Analyst (OSDA) exam.

Exam mindset: OSDA is a blue-team exam. Your job is to detect, correlate, and report attacker activity from logs (ELK/Elastic Stack). For every attacker TTP below, the useful question is: "What artifact does this leave, and which query surfaces it?" Chain individual detections into a narrative (initial access → execution → privesc → lateral movement → persistence) — that narrative is what scores points.

0. Attacker Methodology & Defensive Frames

Kill chain → detection mapping

Pyramid of Pain — detections built on TTPs (top) hurt attackers more than hash/IP indicators (bottom). Prioritize behavioral detections.

Growth mindset (course framing): attackers adapt, so detections must be behavioral and revisable, not static signature lists.

1. ELK / KQL Fundamentals

KQL syntax

field1: value1 and field2:"value 2" and not field3: value3* and field4.subfield <= 30

• and / or / not (case-insensitive); parentheses for grouping.

• * = wildcard. : = match. >= <= > < for numeric/date ranges.

• Quote values containing spaces/special chars. Escape \ in Windows paths or use wildcards.

• Free text: bare term ("psexec") searches across analyzed fields — good for hunting, noisy for precision.

Core ECS fields to know cold

Query pattern templates

# Sysmon process creation on one host
host.hostname: "appsrv01" and data_stream.dataset: "windows.sysmon_operational" and event.code: "1"

# Web access, exclude local noise
"apache-access" and host.hostname: "web01" and not source.ip: 127.0.0.1

# Snort/IDS alerts, IPv4 only
tags: "snort.log" and network.type: "ipv4"

OSQuery patterns

SELECT field1, field2 FROM table1 WHERE field1 = 'value1' AND field2 LIKE '%value2%';

-- Suspicious files dropped to Desktop
SELECT directory, filename FROM file
WHERE path LIKE 'C:\Users\%\Desktop\%' AND filename LIKE '%.txt';

-- Autoruns / persistence surface
SELECT name, path, source FROM startup_items;

-- Listening processes (C2 / backdoor hunt)
SELECT DISTINCT p.name, l.port, l.protocol
FROM listening_ports l JOIN processes p ON l.pid = p.pid;

2. Windows Endpoint — Event IDs You Must Know

Security log (channel: Security)

Logon Types (event 4624 winlog.event_data.LogonType)

Sysmon (channel: Microsoft-Windows-Sysmon/Operational, dataset windows.sysmon_operational)

PowerShell logging

• 4103 – module logging (pipeline). 4104 – script block logging (deobfuscated code — gold for detection). 400/403/600 – engine start/stop.

event.code: "4104" and powershell.file.script_block_text: (*FromBase64String* or *IEX* or *DownloadString* or *-enc*)

3. Initial Access Detections

Web Attacks (proxy / apache-access / IIS logs)

SQL injection

"apache-access" and url.query: (*UNION* or *SELECT* or *' or 1=1* or *information_schema* or *sleep(* or *waitfor delay*)

• Also watch: bursts of 500s, abnormal response sizes, single IP hitting one param repeatedly.

LFI / RFI / path traversal

"apache-access" and url.query: (*../* or *..%2f* or */etc/passwd* or *php://* or *data://* or *http\://*)

Command injection

url.query: (*%3B* or *";"* or *|* or *`* or *$(* or *&&* or *whoami* or *nc%20* or *curl* or *wget*)

Malicious file upload / web shell

• Sysmon 11 (file create) writing .php/.aspx/.jsp into a web root; then the web server process spawning cmd.exe/sh (Sysmon 1 parent-child anomaly).

event.code: "1" and process.parent.name: ("w3wp.exe" or "httpd" or "apache2" or "nginx" or "php-fpm") and process.name: ("cmd.exe" or "powershell.exe" or "sh" or "bash" or "whoami")

Credential Attacks

SSH (auth.log / filebeat system)

# Successful login — pivot on user.name, count by source.ip
event.action: "ssh_login" and event.outcome: success

# Brute force — many failures then a success from same source.ip
event.action: "ssh_login" and event.outcome: failure

• Correlate: N failures from source.ip followed by a success = likely successful brute force.

Windows brute / spray

event.code: "4625"          // count failures per source / per account
event.code: "4625" and winlog.event_data.SubStatus: "0xC000006A"   // bad password

• Spray = one password across many accounts (low failures per account, many accounts). Brute = many failures against few accounts.

4. Windows Server-Side Attacks

• Exploitation of a listening service → look for the service process spawning a shell/child (parent-child anomaly, section 3 web-shell query generalizes).

• Crashes/restarts of the vulnerable service (Application/System log) near the intrusion window.

• IDS/Snort alert on the exploit signature + matching source.ip in host telemetry.

event.code: "1" and process.parent.name: ("sqlservr.exe" or "tomcat*.exe" or "java.exe" or "spoolsv.exe") and process.name: ("cmd.exe" or "powershell.exe")

5. Windows Client-Side Attacks

Malicious Office docs / macros — Office app spawning script/shell:

event.code: "1" and process.parent.name: ("winword.exe" or "excel.exe" or "powerpnt.exe" or "outlook.exe") and process.name: ("cmd.exe" or "powershell.exe" or "wscript.exe" or "cscript.exe" or "mshta.exe" or "rundll32.exe" or "regsvr32.exe")

LOLBins (living-off-the-land) — legit binaries used maliciously: mshta, rundll32, regsvr32, certutil (download/encode), bitsadmin, msbuild, installutil, wmic.

process.name: "certutil.exe" and process.command_line: (*-urlcache* or *-decode* or *-encode*)

6. Windows Privilege Escalation

• UAC bypass — high-integrity child from auto-elevating binary; fodhelper.exe/eventvwr.exe/sdclt.exe spawning cmd; registry hijack in HKCU\...\shell\open\command (Sysmon 13).

• Token manipulation / SeImpersonate (Potato attacks) — service account → SYSTEM; watch 4672/4673 plus a service-account process spawning SYSTEM shell.

• Service abuse — 7045/4697 new service, or unquoted-path / weak-perms binary replacement (Sysmon 11 writing over a service exe).

• Sensitive privilege use — event.code: "4673" / 4674.

event.code: "13" and registry.path: (*\\shell\\open\\command* or *ms-settings*)   // UAC-bypass reg hijack

7. Linux Endpoint & Detections

Sources: auditd, /var/log/auth.log (Debian) / secure (RHEL), syslog, journald, bash history, /var/log/audit/audit.log.

# Linux server-side / reverse shell indicators
process.name: ("bash" or "sh" or "nc" or "ncat" or "python*" or "perl") and process.command_line: (*"-i"* or *"/dev/tcp/"* or *"nc "* or *"-e /bin/"*)

# sudo to root by unexpected user
event.dataset: "system.auth" and process.name: "sudo" and message: *COMMAND=*

Linux privesc hunts: SUID GTFOBins execution, dirty-cow/kernel-exploit compiles (gcc in /tmp), writable /etc/passwd or cron, capability abuse (getcap).

8. Network Detections (Snort / Suricata / Zeek)

• Snort/Suricata alerts land in ELK with tags: "snort.log" (or event.dataset: suricata.eve). Pivot from rule.name / signature to host telemetry via source.ip/destination.ip.

tags: "snort.log" and network.type: "ipv4" and not destination.ip: 10.0.0.0/8

• Snort rule anatomy (read, don't necessarily write):

alert tcp any any -> $HOME_NET 445 (msg:"SMB exploit attempt"; content:"|FF|SMB"; sid:1000001; rev:1;)

• Beaconing — regular-interval, similar-size connections to one destination (jitter aside). Aggregate destination.ip + count + interval.

• Zeek conn/dns/http logs give netflow-level pivoting when packet payload isn't logged.

9. Antivirus Alerts & Evasion Detections

• AV/Defender alerts are a signal and a pivot — take the flagged path/hash and hunt the process tree around detonation time.

• AMSI bypass — PowerShell 4104 containing amsiInitFailed, [Ref].Assembly, System.Management.Automation.AmsiUtils, reflection to patch amsi.dll.

• ETW tampering — patching EtwEventWrite, disabling logging providers.

• Obfuscation — long base64 blobs, -EncodedCommand, char-array reassembly, backtick splitting → script-block logging (4104) deobfuscates it for you.

event.code: "4104" and powershell.file.script_block_text: (*AmsiUtils* or *amsiInitFailed* or *EtwEventWrite* or *VirtualProtect*)

10. Network Evasion & Tunneling

• DNS tunneling — high volume of TXT/NULL queries, long/high-entropy subdomains, many unique subdomains under one parent domain.

event.code: "22" and dns.question.name: *   // then aggregate: count unique subdomains per registered domain

• HTTP(S) tunneling / C2 over 443 — long-lived connections, odd JA3, self-signed certs, no matching browser/user process (Sysmon 3 with unexpected parent).

• ICMP / port-forwarding tunnels — abnormal ICMP payload sizes; SSH -L/-R/-D on internal hosts.

• Pivot IDS tunneling alerts against destination.ip reputation + host process owning the socket.

11. Active Directory Enumeration Detections

• BloodHound / SharpHound — burst of LDAP queries, mass 4662 object reads, many 4769 service-ticket requests in a short window, session enumeration (SAMR/4661), reads of objectClass=user/computer/group.

• LDAP recon — event.code: 4662 spikes; unusual account querying adminCount, servicePrincipalName.

• Kerberoast prep — enumerating SPNs (4769 for many distinct services from one user).

# Kerberoasting — RC4 (0x17) service tickets, often many services / one account
event.code: "4769" and winlog.event_data.TicketEncryptionType: "0x17"

# AS-REP roasting — TGT requested for accounts w/ preauth disabled
event.code: "4768" and winlog.event_data.PreAuthType: "0"

12. Windows Lateral Movement Detections

# Remote-service style lateral movement (PsExec-like)
event.code: "7045" and winlog.event_data.ServiceName: (*PSEXESVC* or *PAExec* or *RemCom*)

# WMI/WinRM remote exec parents
event.code: "1" and process.parent.name: ("wmiprvse.exe" or "wsmprovhost.exe") and process.name: ("cmd.exe" or "powershell.exe")

# RDP interactive logon
event.code: "4624" and winlog.event_data.LogonType: "10"

13. Active Directory Persistence & Cred Access Detections

# DCSync from non-DC
event.code: "4662" and winlog.event_data.Properties: (*1131f6aa-9c07-11d1-f79f-00c04fc2dcd2* or *1131f6ad-9c07-11d1-f79f-00c04fc2dcd2*) and not user.name: *$

LSASS dumping (cred access) — Sysmon 10 access to lsass.exe with dump-style access masks (0x1010/0x1410), or 4688/1 for procdump/comsvcs.dll MiniDump/rundll32 ... MiniDump:

(event.code: "10" and winlog.event_data.TargetImage: *lsass.exe*) or (process.command_line: (*comsvcs.dll*MiniDump* or *procdump*lsass* or *sekurlsa*))

14. SIEM Workflow — ELK Part I & II

Part I (Intro to ELK): index/data-stream patterns, Discover, KQL filters, field pivoting, saving searches, timeline building.

Part II (Combining the logs): correlate across sources into one attack story:

1. Anchor on the strongest alert (IDS hit, AV detection, 4104 obfuscation, LSASS access).

2. Pivot on shared keys: source.ip ↔ host.hostname ↔ user.name ↔ process.pid/process.entity_id ↔ time window.

3. Walk the process tree (parent → child) with Sysmon 1 + Security 4688.

4. Trace lateral movement across hosts via logon type + timestamps.

5. Confirm persistence & impact, then write the timeline.

Exam reporting tip: for each finding record — timestamp, host, user, source→dest, technique (MITRE ID), the evidence field/query, and how it links to the next step. That chain is the report.

15. Quick Reference — "See X → Suspect Y"

Fill in host-specific field names as you meet them in the labs — encryption-type codes, winlog.event_data.* names, and dataset strings can vary by ingest pipeline. Verify each query against your actual ELK index before relying on it in the exam.