Analyzing a targeted intrusion
A defense subcontractor detects a suspicious network beacon. From the EDR timeline, rebuild the attack chain, map it to MITRE ATT&CK and assess what can (and cannot) be said about the attacker.
Briefing
Ostral Systems, an engineering firm working for the defense sector, received an alert from its NDR: a purchasing department workstation has been contacting an unknown domain at regular intervals for 6 days. The internal CERT hands you the initial email, the EDR timeline excerpt for ACH-PC17, the network requests and a comparison table prepared by a colleague. Management wants to know: what happened, and “is it an APT?”.
Fictional scenario and data, built on real techniques. .example domains and documentation IP ranges.
Objectives
- Identify the initial access vector
- Recognize a DLL loading evasion technique
- Spot the persistence mechanism
- Characterize the C2 channel and its value for attribution
- State a conclusion with a confidence level
Tools used in real investigations
Ready to put it into practice?
CyberXTEL is our free platform to train hands-on: certifications, CTFs and a dedicated cyber awareness space.