Case file
Cuckoo
A phishing attachment leads to registry persistence on a workstation, and mailbox access from somewhere else entirely. Trace it both ways: how it started, and what's been taken.
- Difficulty
- intermediate
- Estimated time
- About 40 minutes
- Learning Path
- Analyst Foundations
- Plan
- Pro
- Telemetry you will work with
- Windows · Sysmon · Mail
- Skills you will use
- SIEM search · Log analysis · Investigation scoping
- ATT&CK tactics
- Collection · Initial Access · Persistence · Privilege Escalation
The full briefing (your role, what is already known, and who to contact) opens when you launch the case. Sign in to launch it and track your progress.