Catch and contain the store PC intrusion

An alert shows an unusual login to a store back-office PC at 2 a.m. Using the practice log data provided (identity, EDR, VPN and file-share logs), investigate what happened: confirm whether it is real, build a timeline from the log lines, establish how far the attacker got, contain it, and deliver the detections that would have caught it earlier. The goal is an investigation another analyst could follow and defend, not a guess.

What you hand in

An investigation timeline where every entry is backed by a specific log line
An established scope of compromise (accounts, hosts and data touched), not assumed
Three new detection rules mapped to MITRE ATT&CK, each with test cases
An incident report with root cause and lessons learned that have owners and dates

Check your work

Tick each item when your project meets it. Be strict: this is the rubric the reviewer uses.

Every timeline entry cites a specific log line (source, field and time in UTC), and event time is distinguished from ingest time
The scope of compromise is established from evidence by pivoting across log sources, not assumed from the first alert
The three detections are mapped to ATT&CK techniques and each has a true-positive and a false-positive test case
Containment and recovery steps preserve evidence and fit a store environment (isolate, reset, restore from known-good backup)
Root cause is identified (for example a phished store manager password without MFA) and supported by the evidence
Lessons learned are blameless and have an owner and a date, and at least one becomes a new detection

0 of 6 checked

Model answer

The model answer opens once your capstone passes the review, so you can compare your work with an outline of a strong submission.

Hand in your capstone

Your links are checked automatically, then the work is scored against the rubric above, item by item, with comments. A pass counts toward the course certificate and shows on your profile.

Loading…