Midnight RDP Lab

Reconstruct a sophisticated intrusion's timeline by correlating Windows Event, Sysmon, and PowerShell logs in Splunk, identifying RDP-based initial access, persistence, privilege escalation, and C2.

Category:

Tactics:

Initial Access Execution Persistence Privilege Escalation Stealth Defense Impairment Discovery Lateral Movement Command and Control

Tools:

hard

Walkthrough Available

Sign in to Download Lab Files

Unlock Your Full Learning Experience with CyberRange Labs

Sign up to track your progress, unlock exclusive labs, and showcase your achievements—begin your journey now!