Case file
Operation Silverfish
A masquerading process on a Finance workstation leads to domain reconnaissance, a Kerberoasting attempt, and a quiet pull of sensitive files. Trace the whole chain.
- Difficulty
- intermediate
- Estimated time
- About 60 minutes
- Learning Path
- Incident Investigation
- Plan
- Pro
- Telemetry you will work with
- Windows · Sysmon · Suricata · Network
- Skills you will use
- SIEM search · Investigation scoping
- ATT&CK tactics
- Credential Access · Discovery · Execution · Exfiltration · Lateral Movement
The full briefing (your role, what is already known, and who to contact) opens when you launch the case. Sign in to launch it and track your progress.