Lab 02 — Payload Staging Analyzer

Classify staging events from a host-event stream, identify the staging strategy, enumerate telemetry artifacts, and return detection findings.

What it builds

A staging-event classifier and detection mapper. Given a list of synthetic host events (file creates, network connections, image loads, LOLBin executions), it classifies the staging strategy (disk, memory-only, or LOLBin), maps each event to its telemetry plane (host/network), and returns detection findings with Sysmon EID and Sigma description.

Running

LAB_MODULE=solution python3 -m pytest -q   # 12 tests
python3 -m pytest -q

API

classify_strategy(events: list[dict]) -> str
    # "disk" | "memory_only" | "lolbin" | "unknown"
    # disk: file-create followed by image-load
    # lolbin: LOLBin process creates a network connection or writes a file
    # memory_only: image-load with no prior file-create (unbacked)

analyze(events: list[dict]) -> dict
    # Returns {strategy, findings: [{event_id, telemetry_plane, sysmon_eid, detection}]}

lolbin_findings(events: list[dict]) -> list[dict]
staging_network_findings(events: list[dict]) -> list[dict]
unbacked_image_findings(events: list[dict]) -> list[dict]

Event schema

# FileCreate event:
{"type": "file_create", "path": "C:\\Temp\\payload.exe", "process": "certutil.exe"}

# NetworkConnect event:
{"type": "network_connect", "process": "certutil.exe", "dest_ip": "203.0.113.5", "dest_port": 443}

# ImageLoad event:
{"type": "image_load", "process": "explorer.exe", "image": "C:\\Temp\\injected.dll",
 "signed": False, "on_disk": False}   # on_disk=False → unbacked

# ProcessCreate event:
{"type": "process_create", "image": "certutil.exe", "parent": "cmd.exe",
 "command_line": "certutil.exe -urlcache -split -f http://... payload.exe"}