Browser LabLD-EP-LAB-003Medium
Browser LabLD-EP-LAB-003Medium28 min
The Containment Call
A Fanar Hotels host is confirmed compromised: a partly-fileless implant is beaconing to C2, a domain-admin credential was exposed, and lateral movement to an internal server has begun. Leadership wants it 'shut down now'. Your job is to choose the right containment sequence — one that stops the spread, preserves evidence, and addresses every part of the intrusion.
What you will be able to do
- Preserve volatile evidence before destructive action.
- Choose containment that stops spread without destroying evidence.
- Address the host, the credential and the C2.
Incident TriageWindows SecurityNetwork AnalysisT1071.001 — Web ProtocolsT1021.002 — SMB/Windows Admin Shares
Sign in to start this lab.
Sign in