Case file
Tollgate
A workstation reaches out to a stream of hostnames that do not exist, then tries to push data to cloud storage. Both attempts fail, for two completely different reasons, and only one of them is a control.
- Difficulty
- beginner
- Estimated time
- About 35 minutes
- Learning Path
- Analyst Foundations
- Plan
- Pro
- Telemetry you will work with
- Proxy
- Skills you will use
- Alert triage · SIEM search · Log analysis · Investigation scoping · Evidence and reporting
- ATT&CK tactics
- Command and Control · Exfiltration
The full briefing (your role, what is already known, and who to contact) opens when you launch the case. Sign in to launch it and track your progress.