Research

Guided lab: nine hours at Northwind Freight, from lure to scheduled task

A constructed intrusion written as a DFIR report. You get the same artifacts an analyst gets on day one, in the order they arrive, and you build the timeline yourself. The company is fictional; the techniques, event IDs and analytic reasoning are not.

Full write-up available to members subscribers. See what is included.