The student, working in the role of a tier 2 security operations center analyst, is assigned a traditional malware IR case involving a ransomware attack that compromised a client’s network. The student must determine the scope of the incident, identify the method by which the malware propagated throughout the network, and begin to answer the question of containment—only to discover that the clues don’t lead directly to an initial perimeter compromise.

Following the pivot of the compromised Active Directory account, the student will explore techniques for detecting several common methods of lateral movement as well as privilege escalation within AD. Students must profile the suspicious account, timeline both user and workstation activity, and pivot to any other potentially-compromised accounts, based on following the attacker’s tracks through the logs until “patient 0” is found, the site of initial access.

After identifying the original entry point into the network, the student will dive deep into answering the question of containment. Using primarily network-based logs, they will confirm a specifically targeted server and determine how it was successfully exploited. Then, they will dive deeply into host-based logs to determine what happened post-exploitation and begin to build a profile of the attacker’s motivations. By the conclusion of this task, students will have developed a much more accurate picture of the attacker’s motivations.

Now that it has become clear this is a targeted attack, students will take a higher-level view of their investigation thus far in order to reassess the evidence. They will reexamine their existing evidence, dive deeper into detection strategies for commonly-used living-off-the-land techniques, and elaborate the profile of the attacker’s motivations and intent.

Students will analyze several instances of proprietary data being transferred to different locations within the network and ultimately crossing the perimeter to be successfully exfiltrated to the attacker’s C2 server using a novel, difficult-to-detect technique.

Students will conclude their investigation by writing an appropriate report to the CISO and a more technical report to the incident responders. They will also write a non-technical, short executive summary for senior management of the company.