| # | Flag | Box |
|---|---|---|
| 1 | Public Asset | 1-Understanding log data |
| 2 | Protocols | 1-Understanding log data |
| 3 | Events | 1-Understanding log data |
| 4 | IP /HOST Name | 1-Understanding log data |
| 5 | Events 2 | 1-Understanding log data |
| 6 | Targets | 2-External Attackers |
| 7 | Identify attack | 2-External Attackers |
| 8 | Mitigation | 2-External Attackers |
| 9 | New attack | 3-Initial access |
| 10 | New attack 3 | 3-Initial access |
| 11 | New Attack 2 | 3-Initial access |
| 12 | IIS Compromised | 4-Exploitation |
| 13 | Escalate privs | 4-Exploitation |
| 14 | Migrate process | 4-Exploitation |
| 15 | Cobalt Strike | 4-Exploitation |
| 16 | Defensive action | 3-Initial access |
| 17 | Attack identif. | 5-Extend the attack |
| 18 | Command | 4-Exploitation |
| 19 | Targets found | 5-Extend the attack |
| # | Flag | Box |
|---|---|---|
| 1 | Public Asset | 1-Understanding log data |
| 2 | Protocols | 1-Understanding log data |
| 3 | Events | 1-Understanding log data |
| 4 | IP /HOST Name | 1-Understanding log data |
| 5 | Events 2 | 1-Understanding log data |
| 6 | Mitigation | 2-External Attackers |
| 7 | Targets | 2-External Attackers |
| 8 | Identify attack | 2-External Attackers |
| 9 | New attack | 3-Initial access |
| 10 | New attack 3 | 3-Initial access |
| 11 | New Attack 2 | 3-Initial access |
| 12 | Escalate privs | 4-Exploitation |
| 13 | Migrate process | 4-Exploitation |
| 14 | IIS Compromised | 4-Exploitation |
| 15 | Defensive action | 3-Initial access |
| 16 | Cobalt Strike | 4-Exploitation |
| 17 | Attack identif. | 5-Extend the attack |
| 18 | Command | 4-Exploitation |
| # | Flag | Box |
|---|---|---|
| 1 | Attack identif 2 | 5-Extend the attack |
| 2 | Targets found | 5-Extend the attack |