Case file
Operation Locust
A living-off-the-land foothold spreads through persistence, credential access, and two lateral hops, all while beaconing out over DNS. Determine the full scope.
- Difficulty
- advanced
- Estimated time
- About 70 minutes
- Learning Path
- Incident Investigation
- Plan
- Pro
- Telemetry you will work with
- Windows · Sysmon · Suricata · Network
- Skills you will use
- SIEM search · Log analysis · Evidence and reporting
- ATT&CK tactics
- Command and Control · Credential Access · Discovery · Execution · Exfiltration · Lateral Movement · Persistence · Privilege Escalation
Network
Text too small? Click the diagram to open it full size.
The full briefing (your role, what is already known, and who to contact) opens when you launch the case. Sign in to launch it and track your progress. Create a free account