Browser LabLD-TH-LAB-002Medium
Browser LabLD-TH-LAB-002Medium28 min
The Anomaly That Wasn't
Your hunt flagged three anomalies on Qasr's servers this week. Leadership wants to know if Qasr is breached. Your job is NOT to find a breach — it is to reach the honest verdict. Investigate each anomaly against the baseline and change records. Not every hunt ends in compromise, and calling a benign event an incident is its own failure.
What you will be able to do
- Test each anomaly against the baseline and change records.
- Distinguish anomaly from malice.
- Reach a defensible verdict — including 'no incident'.
Threat HuntingLog Analysis
Sign in to start this lab.
Sign in