Browser LabLD-IR-LAB-002Medium
Browser LabLD-IR-LAB-002Medium25 min
The Containment Board
Three items land on your containment board during the Marasi response. Two are attacker footholds needing action; one is a legitimate emergency change a panicking admin made that LOOKS hostile. Contain what must be contained — and do not take down the business over a false alarm.
What you will be able to do
- Match each item to the right containment action — or none.
- Distinguish a hostile foothold from a legitimate emergency change.
- Preserve evidence before any destructive action.
Incident TriageWindows SecurityT1021.001 — Remote Desktop Protocol
Sign in to start this lab.
Sign in