Case file
Impact
Every shadow copy on a file server is deleted, and an unfamiliar process is already running. Work out whether the backups are gone, and contain it.
- Difficulty
- beginner
- Estimated time
- About 25 minutes
- Learning Path
- Analyst Foundations
- Plan
- Pro
- Telemetry you will work with
- Sysmon
- ATT&CK tactics
- Impact
The full briefing (your role, what is already known, and who to contact) opens when you launch the case. Sign in to launch it and track your progress.