IDLE

Blue Team Incident Response

Name: Blue Team Incident Response
Brand: Hacker Labs

INSTANCE: hl-attackblueteam · IP: 10.10.27.37 · eu-west-1

TIME03:00:00

Windows 11

Lab not running

Click Launch above to provision a fresh Windows 11 VM. Takes ~30s.

Submit flag

0/4 objectives

Scenario

Detect, investigate, contain, eradicate and recover from the simulated APT ShadowFox intrusion.

Objectives — click to toggle

Step-by-step walkthrough

1
Detect
Review the queued notables in Splunk ES — identify the first true positive.
2
Triage
Pull EDR telemetry for the affected host. Capture volatile memory with WinPMEM.
3
Contain
Isolate host via EDR network containment. Disable affected user accounts.
4
Eradicate
Remove persistence (scheduled task + WMI sub), rotate credentials.
5
Recover & lessons learned
Restore from clean image, publish IOCs, write postmortem with ATT&CK map.

Submission requirements

Upload deliverables via the Files tab before claiming points.