Threat Hunt · Fileless · Threat Hunt
PowerShell Empire fileless C2 · undetected for 90 days · 47 endpoints
At a software firm with 200 endpoints, a SOC analyst has been seeing anomalous PowerShell activity for weeks. AV/EDR keep reporting clean. Memory forensics revealed an Empire C2 beacon. 47 endpoints infected · 2 hops away from a DA compromise. You will make 11 critical decisions in sequence.
Before you start the scenario
- You are the decision-maker in this incident · every choice leaves time/cost/reputation behind
- There are no wrong answers · just like in real life · but some paths are more expensive
- You can restart it anytime · try different paths
- At the end, a 3-axis score + alternative routes are shown