ELPACO-team Lab

Correlate Sysmon, MFT, and application logs to reconstruct a ransomware attack timeline, identifying persistence, defense evasion, and data exfiltration TTPs.

Category:

Endpoint Forensics

Tactics:

Execution Persistence Stealth Defense Impairment Credential Access Command and Control Impact

Tools:

Event Log Explorer Eric Zimmerman Tools NTFS Log Tracker Registry Explorer Timeline Explorer Volatility 3

medium

Walkthrough Available

Sign in to Download Lab Files

Unlock Your Full Learning Experience with CyberRange Labs

Sign up to track your progress, unlock exclusive labs, and showcase your achievements—begin your journey now!