Skip to main content

Preview build: sign-in and grading run on the server. MFA is not enabled, and storage is in server memory so it does not survive a restart.

LearnDefend
Create account
Browser LabLD-WEL-LAB-003Hard
Browser LabLD-WEL-LAB-003Hard22 min

Windows Incident Timeline (Exam)

Multiple Windows events span one account across two hosts. Build the timeline and answer who, where, whether it succeeded, and what the attacker did to cover tracks. This is the academy's final assessment.

What you will be able to do

  • Order multi-host events into one timeline.
  • Identify the anti-forensics action.
Windows SecurityIncident TriageAnalyst ReportingT1078 — Valid AccountsT1070.001 — Clear Windows Event Logs

Sign in to start this lab.

Sign in