Preview build: sign-in and grading run on the server. MFA is not enabled, and storage is in server memory so it does not survive a restart.

Sign in Create account

Browser LabLD-WEL-LAB-002Medium

Browser LabLD-WEL-LAB-002Medium16 min

Account & Privilege Investigation

After a suspected compromise, review account-management events on a Jisr domain controller. Find the persistence the attacker created.

What you will be able to do

Correlate 4720 and 4732 into account persistence.
Identify the privileged group abused.

Windows SecurityIncident TriageT1136.001 — Local AccountT1098 — Account Manipulation

Sign in to start this lab.