Case Scenario Overview:
An international consulting firm detects suspicious outbound traffic from a financial analyst’s workstation. Initial alerting suggests unauthorized access to internal document repositories. As the investigation begins, incident response uncovers signs of a coordinated intrusion campaign affecting multiple hosts across the network.
Over the course of this instructor-guided simulation, attendees will step into the role of a response team working through a multi-phase intrusion. The case begins with initial access via a malicious backdoor, escalates to persistence and credential abuse, and culminates in lateral movement and data exfiltration.
Analysts will be given evidence files and access to all affected systems, and they’ll work to reconstruct the full attack chain, identify compromised accounts, and map the attacker’s path across the enterprise.
Learning Objectives:
By the end of this simulation, attendees will be able to:
- Identify common forensic artifacts linked to initial access and payload execution
- Reconstruct attacker behavior across hosts using log data, timeline artifacts, and file system activity
- Recognize signs of persistence, privilege escalation, and lateral movement using free tools
- Trace data staging and exfiltration techniques, including use of covert channels
- Correlate attacker actions to understand timing, objectives, and impact
- Practice a structured investigation flow that mirrors real-world incident response operations using free, open-source tools and investigative frameworks
