GCFR practice labs, one tenant at a time
The GCFR objectives expect a responder who can investigate identity and cloud audit logs without a disk image: anomalous sign-ins, MFA-fatigue takeovers, hidden mailbox rules and role abuse in Microsoft 365, leaked service-account keys and tokens across a project, and data pulled from the cloud by an account that shouldn't have had it.
This pathway starts with a single cloud sign-in log and adds one identity or platform at a time: an off-hours login, mailbox changes in the Microsoft 365 Unified Audit Log, a Microsoft 365 account takeover, GCP Cloud Audit Logs after a key exposure, a rogue pod in Kubernetes, a departing employee's export and CloudTrail after an access-key exposure. The Marquee capstone runs a digital-asset exchange incident across mail, single sign-on, EDR and monitoring.
9 cases · ~13 h 17 min of lab time · Easy to Expert · a different variant for everyone · verified answer keys
The pathway, in order
9 cases, about 13 h 17 min of lab time. Each step opens the case in the library, where you can read the brief, the evidence list and sample questions. Everyone gets a different variant of the same case, graded against a key that was verified in the evidence.
-
01
First Look: Sign-In From Abroad
Read a cloud sign-in log and spot the anomaly.
EASY~33 minUp to 15 questions -
02
Push Comes to Shove (Account Takeover: MFA Fatigue)
Workstation event logs, mail and a phone on an off-hours login.
MEDIUM~1 h 15 minUp to 20 questions -
03
Rule of Thumb (The Inbox Rule That Hid the Fraud)
Read the Microsoft 365 Unified Audit Log for mailbox changes.
MEDIUM~1 h 15 minUp to 20 questions -
04
Reply All (Microsoft 365 Account Takeover)
Identity IR in Microsoft 365 sign-in and audit logs.
MEDIUM~1 h 15 minUp to 20 questions -
05
Keyring (Leaked Service Account Key in GCP)
Work GCP Cloud Audit Logs after a key exposure.
MEDIUM~1 h 10 minUp to 20 questions -
06
Noisy Neighbor (Cryptojacking in the Cluster)
Kubernetes audit, runtime and egress evidence on a rogue pod.
MEDIUM~1 h 15 minUp to 20 questions -
07
Two Weeks' Notice (The Customer Export)
Browser and mail evidence on a departing employee's export.
MEDIUM~1 h 20 minUp to 20 questions -
08
Skeleton Key (Cloud Account Compromise: Stolen Access Key)
Work CloudTrail after an access-key exposure.
HARD~1 h 50 minUp to 20 questions -
09
Hollow Vault (Hot Wallet Drained)
Marquee capstone: run an exchange incident across mail, SSO, EDR and monitoring.
EXPERT~3 h 24 minUp to 40 questions
What this pathway covers
Who it's for
- Candidates preparing for the GCFR who want to work real audit-log exports in JSON and CSV, not console screenshots.
- Instructors adding cloud to an IR course who need labs that need no cloud account to solve.
- Enterprise responders whose incidents now start in the identity provider and who want structured practice before the next one.
What you get with every case
- A different variant per student. Same case, same rubric, different names, hashes, timestamps and answers, so students can talk about method without sharing answers.
- Evidence in the real on-disk format. Registry hives, EVTX, PCAP, SQLite, JSON audit logs and memory images open in the tools the exam expects.
- A verified answer key. Every answer is re-derived from the planted evidence before the lab ships, so grading disputes end at the artifact.
- One-click grading and LMS export. Canvas, Blackboard, Moodle, D2L and LTI 1.3 grade passback, or a CSV. See the student portal.
- Runs on the instructor's machine. Windows installer plus macOS and Linux, fully offline after activation. Nothing to host and no student data leaves the room. Course packs on courses.
Run this pathway with your own roster
Download the app, generate a three-student version of the first case in under five minutes, and grade it. First Look cases run free with no key, and the 30-day trial needs no card. Or open the sample lab first and work a student package in your own tools.
Related pathways
Advanced Forensics & IR (GCFA)
Memory, persistence, anti-forensics and full-intrusion timelines: the host-based incident-response capstone track.
7 cases · ~18 h 12 min · GIAC GCFA
Ransomware Incident Response
The ransomware kill chain end to end, from initial access to double-extortion and recovery.
5 cases · ~11 h 51 min
All learning pathways
Every certification-prep and role pathway across Digital Forensics and Incident Response, side by side.
Browse the overview →
ATT&CK® and MITRE ATT&CK® are registered trademarks of The MITRE Corporation. Red Herrings maps to published ATT&CK tactics and techniques for teaching; it isn't affiliated with or endorsed by MITRE. GIAC, GCFE, GASF, GNFA, GCIH, GCFR and GCFA are trademarks of GIAC. CompTIA and CySA+ are trademarks of CompTIA, Inc. SANS is a trademark of the SANS Institute. Red Herrings aligns its pathways to the published objectives of these programs for teaching; it's independent of, and not affiliated with or endorsed by, any certification body.