Learning pathways

Registry, execution, USB, browser and event-log analysis on a Windows host, from first look to a full intrusion.

10 cases · ~18 h

1. 1
   First Look: What Ran on This MachineEASY

   Execution: Prefetch, UserAssist and shortcuts.
2. 2
   First Look: Recent Files and Jump ListsEASY

   Recent files, LNK and jump lists.
3. 3
   First Look: USB Device HistoryEASY

   USB device history in the registry.
4. 4
   First Look: What Runs at StartupEASY

   Find autostart entries in the registry and services.
5. 5
   First Look: Building a TimelineEASY

   Assemble a multi-artifact timeline.
6. 6
   Paper TrailMEDIUM

   Apply execution and USB artifacts to a full insider case.
7. 7
   Two Weeks' NoticeMEDIUM

   Follow a file through browser history, shortcuts and mail.
8. 8
   Blank ChequeHARD

   Work browser history and a mailbox to explain a wallet loss.
9. 9
   Pivot PointHARD

   Correlate logs, memory and a capture across hosts.
10. 10
    Silent HarvestEXPERT

    Capstone: rebuild a quiet intrusion from disk, memory and cloud logs.

Messages, app data, deleted records and device activity from mobile extractions.

8 cases · ~16.4 h

1. 1
   First Look: Recovered PhoneEASY

   Read SMS, contacts and call logs from an extraction.
2. 2
   Off the RecordMEDIUM

   Look past the SMS store into third-party app databases.
3. 3
   Open SecretMEDIUM

   Tie SMS, contacts and timestamps to a leak complaint.
4. 4
   Second ThoughtsMEDIUM

   Recover deleted messages from SQLite.
5. 5
   AlibiHARD

   Place a device with location artifacts.
6. 6
   Cold CallerHARD

   Call detail records, SMS and deleted-message recovery in one case.
7. 7
   Fattened CalfHARD

   Trace an investment fraud across messages, app data and the call log.
8. 8
   Inside JobEXPERT

   Capstone: tie phone evidence to workstation, mail and cloud logs.

Reading packet captures: DNS, beacons, cleartext credentials and exfiltration.

6 cases · ~19.2 h

1. 1
   First Look: Reading a Packet CaptureEASY

   Follow streams and read protocols in a capture.
2. 2
   Open ChannelMEDIUM

   Measure traffic in a capture and tie it to host artifacts.
3. 3
   Tunnel VisionHARD

   Tie a remote-access login to scheduled outbound traffic.
4. 4
   Patient ZeroHARD

   Follow a host from an opened document to its outbound traffic.
5. 5
   Trust FallHARD

   Follow a download from the browser into the network and memory.
6. 6
   Open RecordsEXPERT

   Capstone: network evidence in a multi-department breach.

Investigating a Linux host and server: logins, persistence, and web-server intrusion.

5 cases · ~5.6 h

1. 1
   First Look: Who Logged Into the ServerEASY

   Read auth.log: brute force, the login that worked, and what followed.
2. 2
   First Look: Linux MemoryEASY

   Read processes, sockets and bash history from a LiME memory image.
3. 3
   House KeysMEDIUM

   Sweep a Linux server for every way back in.
4. 4
   Rabbit HoleHARD

   Read access, auth and shell logs from first request to last.
5. 5
   Open HouseEXPERT

   Expert capstone: correlate five host logs into one timeline.

Investigating an Apple endpoint: download provenance, privacy consent, persistence, and insider exfiltration.

6 cases · ~6 h

1. 1
   First Look: Where Did This Mac App Come From?EASY

   Trace a download with the quarantine database and Safari history.
2. 2
   First Look: What Can Each App See?EASY

   Read the system and user TCC privacy databases and their consent records.
3. 3
   Login LoopMEDIUM

   Trace macOS persistence back to its download.
4. 4
   Consent GrantedMEDIUM

   Correlate TCC, quarantine and unified-log records.
5. 5
   Parting GiftHARD

   Work shell, browser and unified-log history on a departing employee's Mac.
6. 6
   House GuestHARD

   Capstone: five macOS artifacts, one timeline.

The first-look triage skills across every evidence family, in the order a new analyst should meet them.

10 cases · ~6.4 h

1. 1
   First Look: What Ran on This MachineEASY

   Start with execution artifacts: what ran on a machine.
2. 2
   First Look: Suspicious DownloadEASY

   Trace a file from the browser that put it there.
3. 3
   First Look: Accounts and Services in the LogsEASY

   Read the security event log for accounts and services.
4. 4
   First Look: What Runs at StartupEASY

   Find what a program set to run at startup.
5. 5
   First Look: USB Device HistoryEASY

   Tie a removable device to a host.
6. 6
   First Look: Reading a Packet CaptureEASY

   Open a packet capture and follow a conversation.
7. 7
   First Look: What's in MemoryEASY

   Read process and connection lists from a memory image.
8. 8
   First Look: Recovered PhoneEASY

   Recover messages from a mobile extraction.
9. 9
   First Look: Building a TimelineEASY

   Bring several artifacts together into one timeline.
10. 10
    Side HustleMEDIUM

    Put it together on a full, if gentle, misconduct case.

Data theft, snooping and policy violations by people who already had access.

6 cases · ~14.2 h

1. 1
   Need to KnowMEDIUM

   Logon, browser and disk evidence on a records-access complaint.
2. 2
   Paper TrailMEDIUM

   Removable-media artifacts on a departing engineer's workstation.
3. 3
   Open SecretMEDIUM

   Phone evidence on a pricing-leak complaint.
4. 4
   Loose LipsMEDIUM

   Browser, disk and mail evidence behind a DLP alert.
5. 5
   Two Weeks' NoticeMEDIUM

   Track where a customer export went.
6. 6
   Inside JobEXPERT

   Capstone: one suspect across five evidence sources.

The incident-handling kill chain from the responder's own tooling: detection and triage through containment to a full-arc capstone, mapped to MITRE ATT&CK.

10 cases · ~13.1 h

1. 1
   First Look: Reading an EDR AlertEASY

   Triage your first EDR detection: process tree, technique, severity.
2. 2
   First Look: Reading a SIEM AlertEASY

   Read a SIEM alert queue and find the one that matters.
3. 3
   First Look: Phishing TriageEASY

   Work a reported phish: header, link and payload.
4. 4
   One ClickMEDIUM

   Follow the phish through to the payload running on the host.
5. 5
   TrapdoorMEDIUM

   Initial access and foothold on an internet-facing server.
6. 6
   Hands on KeyboardMEDIUM

   Trace a remote session back to its source.
7. 7
   Dry RunHARD

   Read logs, registry and memory on a server caught before impact.
8. 8
   First CallHARD

   A live ransomware outbreak worked from the EDR feed.
9. 9
   Fire DrillHARD

   Timed drill: triage a live ransomware outbreak in 45 minutes.
10. 10
    NightfallEXPERT

    Capstone: run a hospital-wide incident through every NIST phase.

The SOC analyst's daily queue: reading and triaging detections from EDR and SIEM, correlating entities, and escalating a real incident.

12 cases · ~13.2 h

1. 1
   First Look: Reading a SIEM AlertEASY

   Triage the SIEM alert queue: rule, severity, entities, technique.
2. 2
   First Look: Reading an EDR AlertEASY

   Read an EDR alert and decide what it means.
3. 3
   First Look: An Impossible-Travel Sign-InEASY

   Spot the impossible-travel sign-in in the cloud logs.
4. 4
   First Look: Phishing TriageEASY

   Triage a phishing report end to end.
5. 5
   Open the TicketMEDIUM

   Work an EDR detection from alert to a severity verdict.
6. 6
   Push Comes to ShoveMEDIUM

   Rebuild an off-hours sign-in from logs, mail and a phone.
7. 7
   Wire ActMEDIUM

   Trace a misdirected wire through mail headers and logs.
8. 8
   Last DayMEDIUM

   Timed drill: scope flagged outbound traffic against the clock.
9. 9
   Hands on KeyboardMEDIUM

   Correlate host and log evidence to track lateral movement.
10. 10
    Ported OutHARD

    Correlate a handset, an inbox and exchange logs on an account loss.
11. 11
    Signature MoveHARD

    Turn that lateral move into a detection rule's fields.
12. 12
    Low and SlowEXPERT

    Capstone: scope a weekend of alerts end to end.

Investigating identity and cloud audit logs: sign-ins, token abuse, and data pulled from the cloud.

9 cases · ~13.3 h

1. 1
   First Look: Sign-In From AbroadEASY

   Read a cloud sign-in log and spot the anomaly.
2. 2
   Push Comes to ShoveMEDIUM

   Workstation event logs, mail and a phone on an off-hours login.
3. 3
   Rule of ThumbMEDIUM

   Read the Microsoft 365 Unified Audit Log for mailbox changes.
4. 4
   Reply AllMEDIUM

   Identity IR in Microsoft 365 sign-in and audit logs.
5. 5
   KeyringMEDIUM

   Work GCP Cloud Audit Logs after a key exposure.
6. 6
   Noisy NeighborMEDIUM

   Kubernetes audit, runtime and egress evidence on a rogue pod.
7. 7
   Two Weeks' NoticeMEDIUM

   Browser and mail evidence on a departing employee's export.
8. 8
   Skeleton KeyHARD

   Work CloudTrail after an access-key exposure.
9. 9
   Hollow VaultEXPERT

   Marquee capstone: run an exchange incident across mail, SSO, EDR and monitoring.

Memory, persistence, anti-forensics and full-intrusion timelines: the host-based incident-response capstone track.

7 cases · ~18.2 h

1. 1
   First Look: What's in MemoryEASY

   Baseline: processes and connections in memory.
2. 2
   Field PromotionMEDIUM

   Account creation and persistence across host artifacts.
3. 3
   Ghost in the RAMHARD

   Memory analysis with malfind, dlllist and ldrmodules.
4. 4
   Dry RunHARD

   Memory and logs on a server caught before impact.
5. 5
   Pivot PointHARD

   Follow a service account across logs, memory and a capture.
6. 6
   Double CrossHARD

   Memory, disk, logs and a capture on an encrypted file server.
7. 7
   Operation LedgerEXPERT

   Capstone: a complete ransomware intrusion.

The ransomware kill chain end to end, from initial access to double-extortion and recovery.

5 cases · ~11.8 h

1. 1
   Patient ZeroHARD

   Initial access: from an opened document to outbound traffic.
2. 2
   Dry RunHARD

   Catch an operator's setup before encryption.
3. 3
   First CallHARD

   A fast-moving outbreak worked live from the EDR feed.
4. 4
   Double CrossHARD

   Test a ransom note's claims against the evidence.
5. 5
   NightfallEXPERT

   Capstone: the full hospital incident, start to finish.