Long-haul hunting: tracing an intrusion campaign end to end
You trace an intrusion spread over weeks across several data sources, link every attacker step from initial access to exfiltration with evidence and present it to management.
Level 501 · 12 lessons · 15 practice labs
Lessons
Getting started
- Scope: which time range, which assets
- Roles and division of work in the hunt team
- Evidence tracking and the findings log
- Short task: set the scope starting from one suspicious login
Following the trail
- Finding initial access
- Building a lateral movement graph
- Traces of staging and exfiltration
- Calculating attacker dwell time
- Short task: graph every host the attacker touched
Outcome
- The campaign timeline
- Briefing management: impact, root cause, recommendations
- Capstone: uncover the whole campaign in 30 days of data
Practice labs
- Set the hunt scope from one suspicious login: Starting from the login’s user, host and time, write down the assets and time range to examine.
- Record findings consistently in the evidence log: Enter five findings with time, source, query and confidence fields and flag the two that contradict each other.
- Separate the evidence that narrows and widens the scope: Assess new leads and justify which hosts enter the scope and which leave it.
- Find the initial access path in 30 days of data: Find the first unusual login of the first compromised account and prove how it was obtained.
- Graph every host the attacker touched: Extract source–target edges from logon and remote execution records and draw the graph in time order.
- Pinpoint the staging and exfiltration moment and size it: Match archive creation with large outbound transfers and calculate the amount of data that left.
- Calculate the attacker’s dwell time: Calculate the time between the first proven activity and detection and state the margin of uncertainty.
- Build the campaign timeline on one page: Split the events in the evidence log into stages and produce the timeline with the gaps clearly marked.
- Write the impact, root cause and recommendation brief: Turn the technical findings into a three-paragraph executive brief and tie each recommendation to a finding.
- Weed weakly supported claims out of the report: Match every claim in the draft report with the evidence log and rewrite unsupported ones as assumptions.
- List the data sources and retention you have for the hunt: Go through the sources in the SIEM, find the oldest record for each and flag the ones that do not cover 30 days.
- Record one finding so that it can be reproduced: Add the query, time range, source index and a summary of the result for a suspicious logon record to the evidence log.
- List the hosts the compromised account logged on to: From thirty days of logon records extract the hosts one account reached with first-seen and last-seen times.
- Label the hunt findings by strength of evidence: Label eight findings as confirmed, likely or unconfirmed and point to the record each one rests on.
- Total the data the suspect host sent per destination: Sum from flow records the bytes the host sent to external destinations and name the top three.
About this course
You trace an intrusion spread over weeks across several data sources, link every attacker step from initial access to exfiltration with evidence and present it to management.
What you will learn
- Getting started
- Following the trail
- Outcome
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.