Case file
Operation Locust
A living-off-the-land foothold spreads through persistence, credential access, and two lateral hops, all while beaconing out over DNS. Determine the full scope.
- Difficulty
- advanced
- Estimated time
- About 70 minutes
- Learning Path
- Incident Investigation
- Plan
- Pro
- Telemetry you will work with
- Windows · Sysmon · Suricata · Network
- Skills you will use
- SIEM search · Log analysis · Evidence and reporting
- ATT&CK tactics
- Command and Control · Credential Access · Discovery · Execution · Exfiltration · Lateral Movement · Persistence · Privilege Escalation
The full briefing (your role, what is already known, and who to contact) opens when you launch the case. Sign in to launch it and track your progress.