Investigation cases

beginner · ~30 min · Analyst Foundations

A burst of failed logons culminates in a successful sign-in from an unusual source. Trace the account, confirm the compromise, and escalate.

Telemetry: Windows

Skills: Investigation scoping · Evidence and reporting

• Credential Access
• Initial Access
• Persistence
• Privilege Escalation
• Stealth

beginner · ~30 min · Analyst Foundations

An obfuscated PowerShell command runs on a workstation and quietly pulls something down. Find out what it grabbed and where it came from.

Telemetry: Windows · Sysmon

Skills: SIEM search · Log analysis · Evidence and reporting

• Command and Control
• Execution

beginner · ~40 min · Analyst Foundations

A public shipment portal takes a burst of SQL injection attempts, and a web shell may follow. Confirm whether it's real, whether it landed, and escalate.

Telemetry: Web logs · Linux · Suricata

Skills: SIEM search · Evidence and reporting

• Initial Access
• Persistence

beginner · ~25 min · Analyst Foundations

Every shadow copy on a file server is deleted, and an unfamiliar process is already running. Work out whether the backups are gone, and contain it.

Telemetry: Sysmon

• Impact

beginner · ~30 min · Analyst Foundations

Telemetry: Linux · Network

Skills: SIEM search · Log analysis · Investigation scoping

• Defense Impairment
• Privilege Escalation

beginner · ~35 min · Analyst Foundations

An alert fired on a workstation the moment an archive appeared in a user-writable folder. Work out what was collected, how much, and whether it has actually left the building.

Telemetry: Windows · Sysmon

Skills: SIEM search · Log analysis · Investigation scoping

• Collection

beginner · ~35 min · Analyst Foundations

A workstation reaches out to a stream of hostnames that do not exist, then tries to push data to cloud storage. Both attempts fail, for two completely different reasons, and only one of them is a control.

Telemetry: Proxy

Skills: Alert triage · SIEM search · Log analysis · Investigation scoping · Evidence and reporting

• Command and Control
• Exfiltration

beginner · ~35 min · Analyst Foundations

An egress alert fires on a web server talking out on a port that has no business carrying that traffic. The first attempt did not reach its destination. Work out what the second one did.

Telemetry: Network

Skills: SIEM search

• Command and Control

intermediate · ~60 min · Incident Investigation

A masquerading process on a Finance workstation leads to domain reconnaissance, a Kerberoasting attempt, and a quiet pull of sensitive files. Trace the whole chain.

Telemetry: Windows · Sysmon · Suricata · Network

Skills: SIEM search · Investigation scoping

• Credential Access
• Discovery
• Execution
• Exfiltration
• Lateral Movement

intermediate · ~35 min · Analyst Foundations

A scan alert fires on the administrative bastion. Confirm how the attacker got in, what they went looking for, and how far the exposure really reaches.

Telemetry: Linux · Network

Skills: SIEM search · Investigation scoping · Evidence and reporting

• Discovery
• Lateral Movement

intermediate · ~40 min · Analyst Foundations

A phishing attachment leads to registry persistence on a workstation, and mailbox access from somewhere else entirely. Trace it both ways: how it started, and what's been taken.

Telemetry: Windows · Sysmon · Mail

Skills: SIEM search · Log analysis · Investigation scoping

• Collection
• Initial Access
• Persistence
• Privilege Escalation

intermediate · ~45 min · Analyst Foundations

A compromised application server reads its own credential file, and the database sees a query it has no way to attribute. Follow the credential, not the connection.

Telemetry: Web logs · Linux · Suricata · Network

Skills: Log analysis

• Collection
• Credential Access
• Execution
• Persistence
• Privilege Escalation

intermediate · ~60 min · Incident Investigation

A helpdesk ticket, no alert, and an unfamiliar name in Domain Admins. Work backwards across four hosts to reconstruct how it got there, then decide what the attacker's clean-up on the way out actually destroyed.

Telemetry: Windows · Sysmon

Skills: Alert triage · SIEM search · Log analysis · Investigation scoping · Timeline reconstruction · Evidence and reporting

• Credential Access
• Defense Impairment
• Discovery
• Lateral Movement
• Persistence
• Privilege Escalation

intermediate · ~60 min · Incident Investigation

A routine audit review, no alert, and a ninety-minute gap that closed itself before anyone went looking. Work backward to find how it opened, and forward through the window it left behind.

Telemetry: Windows · Sysmon · Suricata · Network

Skills: Alert triage · SIEM search · Investigation scoping · Timeline reconstruction · Evidence and reporting

• Credential Access
• Defense Impairment
• Lateral Movement
• Persistence

intermediate · ~40 min · Analyst Foundations

A noisy service-install alert fires every night across the network. Triage it by comparing each host against its own history.

Telemetry: Windows · Sysmon

Skills: SIEM search · Log analysis

• Execution
• Persistence

advanced · ~70 min · Incident Investigation

A living-off-the-land foothold spreads through persistence, credential access, and two lateral hops, all while beaconing out over DNS. Determine the full scope.

Telemetry: Windows · Sysmon · Suricata · Network

Skills: SIEM search · Log analysis · Evidence and reporting

• Command and Control
• Credential Access
• Discovery
• Execution
• Exfiltration
• Lateral Movement
• Persistence
• Privilege Escalation