Practice
Guided investigations where you do the work rather than read about somebody else doing it. They come in two kinds, and which one suits you depends on how much machine you have to spare.
A finance workstation, a July morning, and a binary claiming to be seven years old.
Everything an operator did between getting in and encrypting, and the moment it became unstoppable.
The question every incident call opens with: which machine was first, and how do you know?
13 of 13 labs
Data staged with an archiver and sent out with a renamed copy of a legitimate sync tool. Identify the binary from one field, reconstruct what was taken from a command line, and be exact about what endpoint telemetry cannot tell you about volume.
A password spray that stayed under the lockout threshold and never produced a failed-logon event on the server it was aimed at. Find where the failures were recorded, identify the account that fell, and explain why the dashboard showed nothing.
An LSASS dump taken with a DLL that ships in System32, called by ordinal so the obvious rule misses it. Work out which process touched LSASS, which access mask matters, and whose credentials you now have to assume are gone.
Remote execution over the admin share, reconstructed from the target. Tie four events in three logs into one action, work back to the host it came from, and handle the version where the service is not called PSEXESVC.
A burst of Kerberos service ticket requests from one workstation, every one of them legitimate as far as the domain controller is concerned. Find what makes the cluster abnormal, separate it from a legacy application, and say what the log cannot tell you.
The first lab for a machine of your own. You create the evidence yourself, delete a file from it, and then recover the file you deleted, which is the only way to be certain the recovery worked.
Every other lab here asks for a virtual machine. This one asks for a terminal. Pre-recorded event logs, a cross-platform parser, and the same reasoning, on whatever laptop you already have.
A business email compromise where the obvious finding is a decoy. Ninety minutes on Microsoft 365 audit logs, OAuth consent grants, and why resetting the password does not end this incident.
A first investigation for anyone who has read about persistence but never gone looking for it. You will plant a Run key with Atomic Red Team, then find it three different ways and work out which of the three you would actually trust in production.
WMI event subscriptions run code on a condition you choose, survive reboots, live nowhere in the filesystem, and log nothing by default. The last of the persistence series, and the one that changes how you think about the other three.
Windows services run as SYSTEM and start before anyone logs in, which makes them the most valuable persistence on the box and the hardest to spot among the two hundred already there. Part three of the persistence series.
Plant a scheduled task with Atomic Red Team, then find it four ways and work out which one survives an attacker who names their task properly. Closes the loop on the persistence you found on the domain controller in the Northwind case.
A constructed intrusion written as a DFIR report. You get the same artifacts an analyst gets on day one, in the order they arrive, and you build the timeline yourself. The company is fictional; the techniques, event IDs and analytic reasoning are not.
