Case file
Magpie
An alert fired on a workstation the moment an archive appeared in a user-writable folder. Work out what was collected, how much, and whether it has actually left the building.
- Difficulty
- beginner
- Estimated time
- About 35 minutes
- Learning Path
- Analyst Foundations
- Plan
- Pro
- Telemetry you will work with
- Windows · Sysmon
- Skills you will use
- SIEM search · Log analysis · Investigation scoping
- ATT&CK tactics
- Collection
The full briefing (your role, what is already known, and who to contact) opens when you launch the case. Sign in to launch it and track your progress.