Threat Hunt · APT · Threat Hunt
Inside for 14 months: Municipal APT · data leaking silently
The municipality's SIEM alerts had been dismissed as 'internal IT' for weeks. On the first day the C2 traffic patterns match APT28. As the threat hunting lead, you will make 11 critical decisions in sequence.
Before you start the scenario
- You are the decision-maker in this incident · every choice leaves time/cost/reputation behind
- There are no wrong answers · just like in real life · but some paths are more expensive
- You can restart it anytime · try different paths
- At the end, a 3-axis score + alternative routes are shown