CredSnare - Angry Likho APT Lab

Correlate Splunk logs and filesystem artifacts from a workstation and domain controller to reconstruct an attack chain involving Kerberos delegation and credential theft.

Category:

Tactics:

Execution Persistence Privilege Escalation Stealth Credential Access Discovery Collection

Tools:

Eric Zimmerman Tools Event Log Explorer DB Browser for SQLite Autopsy Registry Explorer MFTECmd Splunk

medium

Walkthrough Available

3hrs

Sign in to Download Lab Files

Unlock Your Full Learning Experience with CyberRange Labs

Sign up to track your progress, unlock exclusive labs, and showcase your achievements—begin your journey now!