MinerHunt Lab

Correlate Windows Event Logs and Sysmon artifacts to reconstruct a SQL Server attack, identifying initial access, multiple persistence techniques, and the attacker's cryptomining objective.

Category:

Endpoint Forensics

Tactics:

Initial Access Execution Persistence Privilege Escalation Stealth Defense Impairment Credential Access

Tools:

Event Log Explorer Timeline Explorer Evtxcmd Threat Intel tools

medium

Walkthrough Available

1hr 30mins

Sign in to Download Lab Files

Unlock Your Full Learning Experience with CyberRange Labs

Sign up to track your progress, unlock exclusive labs, and showcase your achievements—begin your journey now!