Weekly scenarios: season 3
At large, complex fictional organisations you solve, as the defender, multi-step incidents that span the domain, the network and applications.
Level 401 · 15 lessons · 15 practice labs
Lessons
Weeks 1–4
- Week 1, Demirtas Holding: a hidden addition to Domain Admins
- Week 2, Safir Telecom: lateral movement in the management network
- Week 3, Manolya Pay: a secret key leak in the payment service
- Week 4, Atlas Port: a scheduled task spread through Group Policy
- Short task: map the four incidents to ATT&CK
Weeks 5–8
- Week 5, Zirve Pharma: a large data outflow from the research share
- Week 6, Gumus Rail: bulk ticket requests for service accounts
- Week 7, Ilgaz Municipality: the last 48 hours before a ransom note
- Week 8, Poyraz Automotive: misuse of a supplier VPN account
- Short task: write the containment steps for the most critical incident in priority order
Weeks 9–12
- Week 9, Ayaz Bank: abuse of domain replication rights
- Week 10, Cinar Hospital: unexpected traffic on the medical device network
- Week 11, Yesil Grid: a risky template on the certificate authority
- Week 12, Orion Labs: the returning attacker and leftover persistence
- Capstone: bring a domain back safely from a compromised state
Practice labs
- Granit Holding: who added whom to a privileged group?: In the holding's domain event logs you find the addition to a privileged group, the account that made it and the time and write them to the result file.
- Yıldırımkaya Telekom: hidden rights arriving through nested groups: In the telecom's domain you trace the chain of nested groups that makes an ordinary-looking account an admin and write its links to the result file.
- Akik Ödeme: a lasting right added to the protection template: In the payment company's domain you find the foreign entry added to the protected accounts' permission template, remove it and write the verification output to the result file.
- Doruk İlaç: hundreds of service tickets in one minute: In the pharma firm's event logs you find the account requesting tickets in bulk with an old encryption type and the service accounts targeted and write them to the result file.
- Çelikyol Demiryolları: an account with pre-authentication off: In the railway's lab domain you find the account with pre-authentication disabled, fix the setting and submit the flag the checker gives.
- Boran Bank: a ticket whose lifetime breaks policy: In the bank's domain logs you find the ticket whose lifetime and encryption type don't fit policy, the machine it was used on and the account it impersonates and write them to the result file.
- Fenerburnu Liman: a logon script pushed by policy: In the port's domain you find the logon script added to a group policy afterwards and submit the flag inside it.
- Mavitepe Belediyesi: a policy anyone can edit: In the municipality's domain you find the group policy every user may edit, narrow the permission and submit the flag the checker gives.
- Karayel Otomotiv: the scope of a scheduled task spread by policy: In the automotive firm's domain you determine which units and machines a policy-deployed task reached and write them with the clean-up order to the result file.
- Ardıçlı Hastanesi: which machine did the admin account log in from?: In the hospital's logon records you find the admin account's session from an unusual workstation and write the machine name and time to the result file.
- Rüzgargülü Enerji: sessions opened with one hash on three servers: From network logon records on the energy company's three servers you pick out the traces of logging in with a hash instead of a password and write the hop order to the result file.
- Kuyrukluyıldız Laboratuvarı: from remote access to the domain controller: You merge the lab's remote access, server and domain logs and write the attacker's path and the containment steps in priority order to the result file.
- Kervansaray Otelleri: admins whose passwords never expire: In the hotel chain's domain you find with a directory query the accounts in privileged groups set to never expire and write them to the result file.
- Alabalık Su Ürünleri: the same local admin password on every machine: You prove the local admin password is shared across the seafood firm's lab machines, give each machine its own and write the outcome to the result file.
- Gökdelen Gayrimenkul: a rogue computer added by an ordinary user: In the property company's domain you find the computer account an ordinary user added, remove it, set the join quota to zero and write the verification to the result file.
About this course
At large, complex fictional organisations you solve, as the defender, multi-step incidents that span the domain, the network and applications.
What you will learn
- Weeks 1–4
- Weeks 5–8
- Weeks 9–12
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in a Kali Linux terminal in the browser and in a practice domain (CORP.LAB) set up separately for every lab. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.