Case file
Operation Nightjar
A helpdesk ticket, no alert, and an unfamiliar name in Domain Admins. Work backwards across four hosts to reconstruct how it got there, then decide what the attacker's clean-up on the way out actually destroyed.
- Difficulty
- intermediate
- Estimated time
- About 60 minutes
- Learning Path
- Incident Investigation
- Plan
- Pro
- Telemetry you will work with
- Windows · Sysmon
- Skills you will use
- Alert triage · SIEM search · Log analysis · Investigation scoping · Timeline reconstruction · Evidence and reporting
- ATT&CK tactics
- Credential Access · Defense Impairment · Discovery · Lateral Movement · Persistence · Privilege Escalation
The full briefing (your role, what is already known, and who to contact) opens when you launch the case. Sign in to launch it and track your progress.