Windows Threat Detection 2

After breaching a host, threat actors are faced with a choice: quietly establish a backdoor to maintain long-term access or take immediate action to achieve their objectives. This room covers the second approach and continues your Windows threat detection journey by exploring what typically follows the Initial Access, beginning with Discovery and Collection.

Learning Objectives

• Detect common Discovery techniques using Windows Event Log
• Learn how to trace the attack origin by reconstructing a process tree
• Find out what data threat actors look for and how they exfiltrate it
• See how the malicious commands are logged by running them yourself

Prerequisites

• Recall the basics of MITRE tactics and Windows logs
• Complete the previous room, Windows Threat Detection 1
• Be ready to continue your Windows threat detection journey

Lab Access

Before moving forward, start the lab by clicking the Start Machine button below. The VM will open in split view and will need about 2 minutes to fully load. In case the VM is not visible, you can click the Show Split View button at the top of the page.

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting the Target Machine, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.

Target machine

Status:Off

Start Machine