Lesson 6.6: Capstone: from a phishing e-mail to a contained infection
One case, every skill from the course. Omar from accounts reported a 'remittance advice' e-mail, but only after opening its attachment. Working on the isolated SOC workstation, you analyse the message (headers, link), the attachment (HTML smuggling, decoded command), find out what ran on his PC from the proxy and endpoint logs, identify the malware family with your YARA rule, spot its new C2 server, check whether his account was taken over, and finish with a filled-in incident report and sealed evidence. Nothing is executed at any point.
25 min
You will learn to
- Analyse a phishing e-mail end to end
- Decode an HTML-smuggled payload safely
- Trace execution through proxy and endpoint logs
- Identify a family with YARA and find its C2
- Check identity logs and write an incident report
← Searching the filesystem: find and locate · All lessons · Troubleshooting a network, layer by layer →