Case file
First Light
A burst of failed logons culminates in a successful sign-in from an unusual source. Trace the account, confirm the compromise, and escalate.
- Difficulty
- beginner
- Estimated time
- About 30 minutes
- Learning Path
- Analyst Foundations
- Plan
- Pro
- Telemetry you will work with
- Windows
- Skills you will use
- Investigation scoping · Evidence and reporting
- ATT&CK tactics
- Credential Access · Initial Access · Persistence · Privilege Escalation · Stealth
The full briefing (your role, what is already known, and who to contact) opens when you launch the case. Sign in to launch it and track your progress.