-
Level 1
Find what's suspicious in this phishing email.
BackIt could be a red flag if an email from a seemingly reliable source does not specifically address you by name. Phishing emails use common generic greetings such as “dear sir/madam,” “dear user,” or “dear valued member.”
-
Level 2
Identify what's suspicious in the phishing email that appears to present an irresistible offer.
BackAttackers exploit the visual similarities between characters to spoof popular domain names and direct users to malicious URLs. Attackers have been seen employing Cyrillic alphabets that have visual similarities to Latin alphabets.
-
Level 3
A normal Google search. But what isn't right here?
BackAttackers exploit ad space in legitimate advertising networks by injecting code or graphics to redirect users. This technique is called malvertising.
-
Level 4
You are viewing the Network Overview dashboard in Log360 as a part of your routine assessments. When looking at the charts below, one device appears to be vulnerable. Which is it?
BackGraph 1 depicts over 100 malicious events detected on a specific endpoint by threat intelligence sources. Graph 2 shows that multiple requests from the same device have been denied, implying that connections to restricted IPs or URLs have been observed.
-
Level 5
The user logon report below lists logon events based on the IP address. Find the user with suspicious logon activity.
BackThe same user logging on from multiple devices could be an indication of account compromise or unauthorized access. It is also wise to check the geolocations of client IP addresses.
-
Level 6
You are looking at your Email Auditing Report. Find the user sending suspicious emails.
BackA user sending sensitive files to an external or personal email could be a sign of data exfiltration. Admins can classify files as public, internal, sensitive, or restricted according to the organizational policy by using Log360.
-
Level 7
From this list of file upload requests, find the user with the suspicious upload request.
BackAn upload of a high volume of data to a third-party application can indicate an attempt at data exfiltration.
-
Level 8
You are looking at process creation events. But one doesn't seem to fall in place. Which is it?
BackThe %APPDATA% folder and the %TEMP% folder in the system are the two main locations where malware is commonly executed. This is because many Windows application files are created in these directories, which are often overlooked by security analysts.
-
Level 9
From this list of file creation events from Windows file monitoring, find the one file that is malicious.
BackOne common behavior of ransomware is to create or modify files with unfamiliar extensions. In most cases, ransomware attacks will either append a ransom note to the affected folders or change the file extensions of the encrypted files. This is intended to indicate to the victims that their files have been encrypted.
-
Level 10
You are investigating process creation events from Sysmon. From the list of events in the report below, find the suspicious one.
BackAttackers embed malicious macros in Microsoft Word documents or Excel sheets to execute PowerShell scripts to download malware onto victims' machines. These legitimate-looking documents spawn a PowerShell process to execute commands when opened.