Zoom Incident - Ignoble Scorpius APT

Zoom Incident - Ignoble Scorpius APT is a blue team lab that falls under the Threat Hunting category and will cover the following subjects: Splunk, VirusTotal, CyberChef, Initial Access, Execution, Privilege Escalation, Stealth, Credential Access, Lateral Movement, Command and Control, Exfiltration, Impact.

Learning Objectives

Correlate Sysmon events and forensic artifacts across multiple hosts using Splunk to reconstruct a full ransomware kill chain, from initial compromise to domain-wide impact.

Categories: Threat Hunting.

MITRE ATT&CK Tactics: Initial Access, Execution, Privilege Escalation, Stealth, Credential Access, Lateral Movement, Command and Control, Exfiltration, Impact.

Tools: Splunk, VirusTotal, CyberChef.

Difficulty: hard.