Browser LabLD-IR-LAB-001Easy
Browser LabLD-IR-LAB-001Easy25 min
Scope the Marasi Intrusion
You are the responder on the Marasi svc-fleet incident. Validation is done; now you must scope it. You have the service account's authentication log and the map of what that account can reach. Separate confirmed scope from the blast radius that still needs checking.
What you will be able to do
- Separate attacker sessions from the account's legitimate batch activity.
- List confirmed-scope entities from evidence.
- Identify what belongs on the blast-radius check list.
Log AnalysisIncident TriageT1078 — Valid Accounts
Sign in to start this lab.
Sign in