Browser LabLD-CF-LAB-003Easy
Browser LabLD-CF-LAB-003Easy25 min
The Process That Should Not Be
Endpoint protection on WS-07 — the finance manager's workstation at Aurora — flagged 'unusual child process' and captured a process snapshot plus a connection list, then auto-closed the alert as low severity. Review the evidence yourself and decide whether the auto-close was right.
What you will be able to do
- Read a process tree and identify parent-child anomalies.
- Pair a process with the network connection it owns.
- Overrule an automated verdict with evidence.
Windows SecurityIncident TriageT1566.001 — Spearphishing AttachmentT1059.001 — PowerShell
Sign in to start this lab.
Sign in