Case file
Understudy
A noisy service-install alert fires every night across the network. Triage it by comparing each host against its own history.
- Difficulty
- intermediate
- Estimated time
- About 40 minutes
- Learning Path
- Analyst Foundations
- Plan
- Pro
- Telemetry you will work with
- Windows · Sysmon
- Skills you will use
- SIEM search · Log analysis
- ATT&CK tactics
- Execution · Persistence
Network
Text too small? Click the diagram to open it full size.
The full briefing (your role, what is already known, and who to contact) opens when you launch the case. Sign in to launch it and track your progress. Create a free account