Skip to main content

Preview build: sign-in and grading run on the server. MFA is not enabled, and storage is in server memory so it does not survive a restart.

LearnDefend
Browser LabLD-IR-LAB-001Easy
Browser LabLD-IR-LAB-001Easy25 min

Scope the Marasi Intrusion

You are the responder on the Marasi svc-fleet incident. Validation is done; now you must scope it. You have the service account's authentication log and the map of what that account can reach. Separate confirmed scope from the blast radius that still needs checking.

What you will be able to do

  • Separate attacker sessions from the account's legitimate batch activity.
  • List confirmed-scope entities from evidence.
  • Identify what belongs on the blast-radius check list.
Log AnalysisIncident TriageT1078Valid Accounts

Sign in to start this lab.

Sign in