Case file
Trailhead
A compromised application server reads its own credential file, and the database sees a query it has no way to attribute. Follow the credential, not the connection.
- Difficulty
- intermediate
- Estimated time
- About 45 minutes
- Learning Path
- Analyst Foundations
- Plan
- Pro
- Telemetry you will work with
- Web logs · Linux · Suricata · Network
- Skills you will use
- Log analysis
- ATT&CK tactics
- Collection · Credential Access · Execution · Persistence · Privilege Escalation
The full briefing (your role, what is already known, and who to contact) opens when you launch the case. Sign in to launch it and track your progress.