Browser LabLD-SYSMON-LAB-002Medium
Browser LabLD-SYSMON-LAB-002Medium18 min
One GUID, the Whole Action
You have a mix of Sysmon events correlated by ProcessGuid for one process. Reconstruct what it did: where it connected and what persistence it installed.
What you will be able to do
- Correlate multi-type events by ProcessGuid.
- Identify the C2 destination and the persistence.
Windows SecurityIncident TriageNetwork AnalysisT1071 — Application Layer ProtocolT1547.001 — Registry Run Keys
Sign in to start this lab.
Sign in