Case file
Swift
An egress alert fires on a web server talking out on a port that has no business carrying that traffic. The first attempt did not reach its destination. Work out what the second one did.
- Difficulty
- beginner
- Estimated time
- About 35 minutes
- Learning Path
- Analyst Foundations
- Plan
- Pro
- Telemetry you will work with
- Network
- Skills you will use
- SIEM search
- ATT&CK tactics
- Command and Control
The full briefing (your role, what is already known, and who to contact) opens when you launch the case. Sign in to launch it and track your progress.