Case file
Operation Ptarmigan
A routine audit review, no alert, and a ninety-minute gap that closed itself before anyone went looking. Work backward to find how it opened, and forward through the window it left behind.
- Difficulty
- intermediate
- Estimated time
- About 60 minutes
- Learning Path
- Incident Investigation
- Plan
- Pro
- Telemetry you will work with
- Windows · Sysmon · Suricata · Network
- Skills you will use
- Alert triage · SIEM search · Investigation scoping · Timeline reconstruction · Evidence and reporting
- ATT&CK tactics
- Credential Access · Defense Impairment · Lateral Movement · Persistence
The full briefing (your role, what is already known, and who to contact) opens when you launch the case. Sign in to launch it and track your progress.