Dozens of cases across two disciplines, Digital Forensics and Incident Response, from single-artifact First Look triage to multi-hour capstones. Every case generates a different, auto-graded lab for each student. Filter by discipline, by difficulty, and by the certification path (forensics) or MITRE ATT&CK tactic (incident response) it exercises.
Featured Marquee case
A Marquee capstone that runs the whole arc. On Christmas Eve a crew took Nakatomi Corporation's systems during the office party and left a note on the file server. Reconstruct the night from email, browser, event logs, registry, memory, cloud audit logs and the disk image.
Featured Marquee case
A Marquee capstone that runs the whole arc. Overnight the cameras and Windows logging at a dinosaur-park genetics company went dark, and facilities blamed the weather. Work the mailbox, browser, event logs, registry, memory, cloud logs, packet capture and disk to reconstruct the night.
Featured Marquee case
A large share of a digital-asset exchange's hot wallet left overnight. You're the incident commander. Work a treasury engineer's mailbox, the single sign-on logs, the endpoint detections, the fraud and security monitoring export and an early note from the IR retainer to reconstruct the operation, pull the indicators, trace the funds, attribute it, map it to ATT&CK and run the response through every NIST phase.
Featured Marquee case
The full incident, start to finish. Overnight, ransom notes appeared across the hospital and systems began locking ward by ward. You're the incident commander: work the SIEM, the EDR feed and the host logs to reconstruct the operation, pull the indicators, map it to ATT&CK, run the response through every NIST phase, and write the incident report.
One small disk image. Recover a deleted document, carve a file out of unallocated space, and catch a file hiding behind the wrong extension.
Exported event logs from one server. Find the account and service changes made overnight and who made them.
A workstation's event logs. Find the flagged logon in the Security log, where it came from, and what happened around it.
Two artifacts, one clock. Line up a browser download and a Security log to reconstruct the order things happened.
One LiME capture from a Debian server that started talking to an address nobody recognized. Find the process behind it, how it got there, and where it's connected.
One packet capture from a workstation that looked compromised. Work out what it looked up, what it kept contacting, where it logged in, and what it sent.
Shortcuts, jump lists and registry MRUs. Reconstruct what a departing employee opened, where each file lived, and when.
One Android SMS extraction. Read the thread and pin down the contact, the message, and the times.
One Azure sign-in log. The account has MFA, yet a sign-in from abroad got in. Read every field of each record to work out how.
One Chrome profile. Work out what the user searched for, where they went, and what they downloaded.
Registry hives and a shortcut file. Work out which USB drive was plugged into the machine, when, and what was opened from it.
A gentle introduction to the macOS TCC privacy database. Read the consent records and find the app that doesn't belong among the usual video-call tools.
One user's execution artifacts. Test a user's claim that they never ran a program they downloaded.
A workstation keeps reinfecting itself after cleanup. Find what brings the malware back.
One memory capture. Find the process that shouldn't be running, where it lives, and the server it phones home to.
A Mac triage set. A user installed something they shouldn't have. Use the quarantine database and browser history to trace where the file came from and how they got there.
One Linux auth.log and a shell history. Work out where the SSH logins came from, which one worked, and what happened on the server afterwards.
An account-lockout alert fired on one staff member. You have the Entra sign-in log. Work out who was targeted, from where, whether anyone got in, and what to do next.
An alert fired on a staff member's cloud account: a sign-in from a country the company doesn't operate in. You have the Azure sign-in log for the account. Find the sign-in that doesn't belong, pull its IP, country, time and MFA outcome, and work out which account is compromised.
A workstation's outbound traffic for one hour was captured off the sensor. Most of it is ordinary browsing. Read the capture the way a responder reads a proxy log: rule out the normal destinations and pull indicators for whatever's left.
One mailbox. Tell the real message from the fake and pull the sender details.
Your first shift, and a CloudTrail export is open on your screen. One AWS account logged a short run of API calls that don't look like normal admin work. Read the trail the way a responder does: follow the events in order and pull the entities off each one so containment is clean.
Your first shift on the SOC queue. One correlated SIEM export is waiting with a short stack of alerts. Read it the way a responder does: sort by severity, open the worst alert, and pull its rule, technique and the source, destination and user entities so you can escalate cleanly.
Your first shift on the SOC queue. One endpoint threw a short stack of EDR detections. Read the feed the way a responder does, triage by severity, read the process tree and the ATT&CK technique on each one, and decide whether this is a real incident or noise.
A Mac that keeps reinfecting itself after cleanup. Find what brings the payload back and where it came from, using the quarantine database, the LaunchAgents folder, the shell history and the unified log.
An attacker keeps getting back into a compromised Linux server. Find out how before it's rebuilt.
An Android extraction from a warehouse associate's company phone after inventory went missing overnight. Find who they were in touch with, what was planned and when.
A public web server is pegged at 100% CPU. Using the Apache access log, root's shell history, the cron directory, authorized_keys and a memory image, work out how the attacker got in, what's eating the CPU, and what they left behind.
HR has a complaint that an employee ran a side business on company time and shared company data with someone outside. Work the browser history, disk and phone extraction to see what the artifacts show.
A packet capture plus host artifacts from a workstation that talked to a server nobody recognized. Read what crossed the wire, measure what left, and tie it to the browser history and a file on disk.
An executive assistant bought gift cards and sent the codes to someone they believed was the CEO. The CEO never asked.
A shadow-AI data-governance case. DLP flagged an engineer's traffic to a public AI assistant and a customer records export. Use the browser history, a disk image and the mailbox to work out what went out and where.
An engineer who has resigned is suspected of walking out with confidential files on a USB stick. Prove what was connected, what was copied, and when.
Event logs, registry hives and Prefetch from a file server. Find the account that shouldn't exist, who made it, and what was left behind to keep access.
A patient says a staff member knew details from their medical file. Work the logon events, browser history and disk image to show what the staff member opened and whether anything left the records system.
An Android extraction from a salesperson suspected of leaking pricing. Find who got it, what was sent, and when.
A departing sales manager's workstation pulled a full customer export from the CRM. Find out where it went.
A warehouse manager's phone extraction. The SMS threads look clean. Find where the real conversation happened, who it was with, and what it arranged.
An employee deleted texts before handing in a company phone. Get back what was deleted and work out who it was with.
An iPhone extraction from a departing employee's company phone. Work sms.db, decode Apple's clock, and recover what's no longer in the live message table.
A Mac user suspects they're being monitored. Use the TCC privacy-consent database, the quarantine record, Safari history and the unified log to find the app watching them and trace where it came from.
An HR partner's account signed in from an unfamiliar location in the small hours. Rebuild the sequence from the Entra sign-in log, mailbox, browser history and a phone extraction.
A finance controller wired a vendor payment to an account nobody recognizes, after an urgent request from an executive and new bank details from the vendor.
A Kubernetes worker node is pinned at 100% CPU by a pod nobody deployed. Work the API audit log the way the SIEM shipped it, the container-runtime detections and the egress capture to find how the pod got there, what it runs, where it connects, and what to contain.
A timed SOC drill. An employee gave notice and the proxy flagged outbound traffic from their workstation. You have 45 minutes with the egress capture and the browser history to confirm the user, the destination, the volume and the timing, then decide what to do before anyone talks to the employee. Built for timed and exam mode.
An unusual service started on the file server. Using the Security and System logs, the registry and Prefetch, work out where the session came from, what ran, and what was left to survive a reboot.
A Google Cloud service-account key was committed to a public repo, and billing flagged a VM nobody recognized. Work the Cloud Audit Logs as a responder and decide what to revoke first.
A single endpoint threw a short stack of EDR detections. Work it from alert to verdict: find the worst severity and the technique, read what the sensor actually did, pull the offending process, its hash and parent, pin the first-detection time, and set the incident severity.
A finance director's Microsoft 365 account sent a wire request they never wrote. Work the sign-in and audit logs to find out how the attacker got in and what they did.
A user clicked. Walk the intrusion end to end: read the phishing email, follow what ran on the endpoint, and pull the indicators the team needs to block.
Accounts payable paid an invoice to the wrong bank account, and the supplier's warning emails never showed up. Work the reported phishing email and the Microsoft 365 Unified Audit Log to find out how the mailbox was taken over and what changed in it.
A small business web server slowed to a crawl and a strange file turned up in its web root. Work the disk, event logs, registry and memory to find how the attacker ran commands, what they ran, how they stayed, and where the server connected.
A service account turned up on servers it never touches. Work out from one workstation's logs, memory and a capture how it was taken and where it went.
A user's crypto transfer landed in a wallet they don't recognize. Work out what happened on their workstation.
A workstation called a flagged address and nothing showed up on disk. Work its memory image, disk image and packet capture to find what was running, what it loaded, and where it called.
A departing employee's Mac. Work out whether company data left the machine, and how, from the shell history, the browser history, the quarantine record, and the unified log.
A company Mac was flagged beaconing to an unfamiliar host every few minutes. Reconstruct the whole chain from five artifacts, from the first download to data leaving the machine.
A retiree lost their savings to what they thought was a cryptocurrency trading account. You have their phone. Reconstruct the contact from the first message to the lost money: who it was, where the money went, how much, and when, so a fraud investigator or law-enforcement referral can act on it.
An Android extraction with location history and a seized laptop's browser history. Work out where the phone was the night a warehouse was hit, what was sent from it, and what the laptop shows about the day before.
A self-custody crypto wallet was emptied in a single transaction. The owner still has the recovery phrase and never sent coins by hand. Work the workstation's Chrome history and the owner's mailbox to find how the wallet was emptied and pull the indicators to report.
A full-file-system iPhone extraction, not just a backup. Put knowledgeC app usage, sms.db, Safari history and the camera roll's EXIF together to work out what a departing employee did with the phone before handing it back.
An Android extraction from a harassment complaint. Line the call log up with the messages and recover what the owner deleted.
A Linux web server tripped an alert for odd traffic. Read the access log, auth.log and shell history to reconstruct the intrusion from first request to the data that left.
A developer's cloud access key leaked to a public repository. Find out whether someone used it and what they did.
A timed ransomware drill for a SOC team. The EDR feed and the SIEM queue are open and files are being encrypted. Inside 45 minutes, detect and analyze the chain, pull the indicators, choose containment and make the communication call. Built to run against a timer in exam mode.
A finance workstation started making repeated outbound connections after a supplier's document wouldn't open. Work out how it started, what ran, how it kept access and where it called home.
You're the on-call responder. The EDR console lit up at 06:48 with a stack of detections from a finance workstation. Triage the detection feed and the host's own event logs, scope the intrusion from first access to impact, pull the indicators, map it to ATT&CK, and make the containment call fast.
A file server was pulled offline after overnight admin activity nobody could explain. Nothing's encrypted yet. Find out what the operator set up.
A file server's shares are encrypted and a ransom note threatens to publish stolen data. Work out what happened and whether data really left.
A customer's phone lost all signal, and by the time they borrowed a friend's phone their cryptocurrency exchange account was empty. Work the inbox, the exchange sign-in logs, the fraud monitoring feed and the handset to reconstruct what happened, where the money went, and the response.
A developer clicked through an update prompt, and days later their workstation was flagged for outbound traffic. Follow it from the browser to the network and into memory.
A VPN account logged in from abroad and a workstation started making the same outbound connection on a schedule. Trace the login, the beacon and what else crossed the wire.
An intrusion on a file server is confirmed. You're the detection engineer: pull the values a detection rule needs from the server's event logs and the SIEM alert, and separate the attack from a sanctioned admin tool that leaves similar traces.
A public Linux server was taken over. Reconstruct the intrusion end to end across five host artifacts.
A third party says this company's documents turned up on an espionage actor's infrastructure. Nothing was encrypted and nobody noticed a thing. Rebuild the intrusion from the public web server's disk, memory and logs and the cloud audit logs.
A company's customer database is for sale. A data analyst with broad, legitimate access to it is under suspicion. Work the workstation, mailbox, browser, phone and cloud logs to find what was taken, how it left and who it went to.
Residents' data is for sale and the city's dispatch system went down. Scope a breach across a whole city government.
Ransomware on a file server and the cloud accounts tied to it, with the server's Security log nearly empty. Rebuild the whole intrusion from everything else.
By Monday morning the SIEM has a weekend's worth of correlated alerts, and one is still active. Work the SIEM queue, the EDR feed and the host logs; scope the intrusion end to end; pull the indicators; map it to ATT&CK; and run the response from containment to lessons learned.
A Marquee capstone that runs the whole arc. On Christmas Eve a crew took Nakatomi Corporation's systems during the office party and left a note on the file server. Reconstruct the night from email, browser, event logs, registry, memory, cloud audit logs and the disk image.
A Marquee capstone that runs the whole arc. Overnight the cameras and Windows logging at a dinosaur-park genetics company went dark, and facilities blamed the weather. Work the mailbox, browser, event logs, registry, memory, cloud logs, packet capture and disk to reconstruct the night.
A large share of a digital-asset exchange's hot wallet left overnight. You're the incident commander. Work a treasury engineer's mailbox, the single sign-on logs, the endpoint detections, the fraud and security monitoring export and an early note from the IR retainer to reconstruct the operation, pull the indicators, trace the funds, attribute it, map it to ATT&CK and run the response through every NIST phase.
The full incident, start to finish. Overnight, ransom notes appeared across the hospital and systems began locking ward by ward. You're the incident commander: work the SIEM, the EDR feed and the host logs to reconstruct the operation, pull the indicators, map it to ATT&CK, run the response through every NIST phase, and write the incident report.
