Skip to main content

We use cookies to ensure you get the best user experience. For more information see our cookie policy.

Logless Hunt

Detect every attack step on a Windows machine even after threat actors cleared Security logs.

Task 1: Introduction

Task 2: Scenario

Task 3: Initial Access | Web Access Logs

Task 4: From Web to RDP | PowerShell Logs

Task 5: Breached Admin | RDP Session Logs

Task 6: Persistence Traces | Scheduled Tasks

Task 7: Credential Access | Windows Defender

Task 8: Conclusion

Back to all walkthroughs
Room Icon

Logless Hunt

Max room.

Detect every attack step on a Windows machine even after threat actors cleared Security logs.

medium

90 min

4,643

User profile photo.
User profile photo.

To access material, start machines and answer questions login.

In this room, as a team member, you were tasked with supporting a medium-sized company in its efforts to investigate and recover from a cyberattack in which threat actors cleared Windows Security logs and hoped to remain undetected.

The room is intended for DFIR team members and L2/L3 analysts who want to be better prepared during scenarios in which a cyberattack does not leave any obvious traces but still must be investigated using built-in tools and artifacts.

Learning Objectives

  • Get acquainted with different Windows logs, some even more helpful than Security logs
  • Investigate a realistic attack scenario, from web exploitation up to credential access

Prerequisites

Before moving on, it is recommended to be familiar with Windows , its logging capabilities and common attack techniques. Great rooms to start with:

Notice: This room includes both guided walkthroughs along with independent challenges that rely on knowledge gained in other rooms. Prepare for both!
Answer the questions below

Let's begin!