Skip to main content

Preview build: sign-in and grading run on the server. MFA is not enabled, and storage is in server memory so it does not survive a restart.

LearnDefend
Browser LabLD-CF-LAB-004Easy
Browser LabLD-CF-LAB-004Easy25 min

One Password, Many Doors

Aurora's identity provider logged a burst of failed sign-ins overnight. The IT lead wants three answers before the morning stand-up: what attack pattern is this, did any account actually fall, and did MFA do its job anywhere?

What you will be able to do

  • Classify a credential attack from its account-to-attempt shape.
  • Find the one account that was actually compromised.
  • Read MFA outcomes as part of the authentication story.
Log AnalysisIncident TriageT1110.003Password Spraying

Sign in to start this lab.

Sign in