Windows Threat Detection 3

What if attackers aren't satisfied with just breaching the host but aim to stay, establish control, and use the system as a starting point for future operations? This room completes your Windows threat detection journey and explores how a compromised host can become part of a larger attack, focusing on three tactics: Command and Control, Persistence, and Impact.

Learning Objectives

• Remind the concept of Command and Control (C2)
• Learn why and how threat actors maintain control of their victims
• Use Windows event logs to uncover various persistence methods
• See how the learned techniques work in a hands-on environment

Prerequisites

• Recall the basics of MITRE (opens in new tab) tactics and Windows logs
• Complete Windows Threat Detection 1 and 2 rooms
• Be ready to dive deeper into the last stages of Windows attacks

Lab Access

Before moving forward, start the lab by clicking the Start Machine button below. The VM will open in split view and will need about 2 minutes to fully load. In case the VM is not visible, you can click the Show Split View button at the top of the page.

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting the Target Machine, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.

Target machine

Status:Off

Start Machine