Browser LabLD-WINAD-LAB-003Medium
Browser LabLD-WINAD-LAB-003Medium34 min
Boss Lab: The Server That Won't Behave
Aldar's application server SRV-APP07 started misbehaving this morning: a key service keeps failing, and something looks off in its autostart configuration. You have the System log, the Security log, and an autostart/process snapshot. Apply the troubleshooting method — scope, localize, read the evidence, find the earliest cause — and reach an evidence-based conclusion about what happened and what to fix. Claim only what the evidence supports.
What you will be able to do
- Localize a problem to the right layer and evidence.
- Find the earliest cause, not a downstream symptom.
- Correlate System, Security and autostart evidence into one conclusion.
Windows SecurityLog AnalysisAnalyst ReportingT1543.003 — Windows ServiceT1547.001 — Registry Run KeysT1078 — Valid Accounts
Sign in to start this lab.
Sign in