Scenario: ransomware night at Sedir Hospital
Starting from the first alert in a hospital’s SIEM on the night shift, you trace the attack, stop the spread, prioritise patient services and report to management in the morning.
Level 301 · 15 lessons · 12 practice labs
Lessons
11 pm: first signs
- The first alert: shadow copies are being deleted on the backup server
- Which machine was infected first
- The tools the attacker used
- The path the attacker took through the network
- Short task: pin down the time of initial access to the minute
1 am: stopping the spread
- Identifying critical patient services
- Emergency isolation: which segment to cut off
- Stopping the compromised admin account
- Short task: stop the spread without cutting off the radiology network
4 am: recovery
- Confirming the backups are intact
- Restore priorities
- Communicating with staff and patients
- Preparing evidence for the authorities
- Short task: bring the appointment system back from a clean backup
8 am: the morning report
- Capstone: an incident report to the board and the plan for the first 30 days
Practice labs
- Validate the shadow copy deletion alert on the backup server: Pull the command line behind the alert, the account that ran it and the time from the SIEM.
- Find the first machine infected: Trace the session into the backup server backwards and identify the workstation at the start of the chain and its first suspicious process.
- Pin down the time of initial access to the minute: Merge mail, proxy and endpoint records after correcting clock offsets and support the minute of initial access with three separate pieces of evidence.
- List the tools the attacker used from process records: Collect the commands run by the compromised account and flag unusual uses of administration tools.
- Draw the path the attacker took through the network: Order the host-to-host hops from logon records and prepare a diagram showing which account was used where.
- Stop the compromised admin account without breaking patient services: Identify the services and tasks the account runs, move them to another account, disable the account and end its sessions.
- Identify the critical patient services and their dependencies: Choose from the system list those that directly affect patient care and write the server each depends on.
- Decide with evidence which segment to cut off: Extract the segments showing infection from flow records and separate links that must be cut from those that must stay open.
- Stop the spread without cutting off the radiology network: Block on the firewall only the ports and sources used for spreading, and show by measurement that radiology imaging still flows and no new infection occurs.
- Confirm the backups are intact: Check the hashes and dates of the last three backups and identify the latest clean one from before the attack.
- Bring the appointment system back from a clean backup: Restore the system from backup in an isolated segment, scan it for malicious traces and connect it to production only once clean.
- Prepare the incident report and 30-day plan for the board: Write a report covering timeline, impact, root cause, evidence kept for the authorities and staff and patient communication, and order the measures for the first 30 days.
About this course
Starting from the first alert in a hospital’s SIEM on the night shift, you trace the attack, stop the spread, prioritise patient services and report to management in the morning.
What you will learn
- 11 pm: first signs
- 1 am: stopping the spread
- 4 am: recovery
- 8 am: the morning report
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.