Browser LabLD-SOC2-ASSESS-009Hard
Browser LabLD-SOC2-ASSESS-009Hard22 min
Module 9 Assessment — Part B: Command the Incident
Ransomware is encrypting files on a live host and spreading to a file share; a domain credential is exposed and scoping shows more affected hosts. You are the incident commander. Take the right actions in the right order, and close the incident properly.
What you will be able to do
- Take the first containment action on a live, spreading threat.
- Capture the most volatile evidence first.
- Refuse to close until the full scope is eradicated, and deliver the report.
Incident TriageAnalyst ReportingT1486 — Data Encrypted for ImpactT1078 — Valid Accounts
Sign in to start this lab.
Sign in