Lesson 6.5: Capstone: the night shift
One night, every skill from the course. Six alerts arrive in the queue. You triage them, notice that three belong together, and investigate: the process tree on the workstation, the hidden PowerShell command, a DNS beacon to a domain no feed knows yet, a service account used from that workstation against the file server, and gigabytes leaving the network. You finish with a filled-in incident report, a new indicator for the sector CERT and sealed evidence, ready for the morning's incident manager.
28 min
You will learn to
- Triage and group a night's alerts
- Investigate across endpoint, DNS, network and Windows data
- Recognise lateral movement and exfiltration
- Identify a new indicator not yet in any feed
- Write and seal an incident report
← Vulnerable and outdated components · All lessons · Computer crime law: what is illegal almost everywhere →