Incident Response Lab

Incident Background

It's Monday morning at 9:15 AM. Sarah from Marketing reports that her computer is behaving strangely. She noticed:

Files on her desktop have strange extensions (.encrypted)
A ransom note appeared demanding Bitcoin payment
The computer is very slow and the fan is running constantly
She received a suspicious email Friday afternoon but isn't sure if she clicked anything

ALERT: This appears to be a ransomware infection!

As the first responder, you must document the incident, preserve evidence, and maintain chain of custody.

Task 1: Incident Report Form

Date of Discovery *

Time of Discovery *

Reported By *

Affected System(s) *

Incident Type *

Incident Description *

Immediate Actions Taken

Isolated from network Secured the scene Photographed screen Notified supervisor Documented observations

Lab Complete!

You have successfully completed the full Incident Response Lab.

You demonstrated proper:

Incident detection and identification
Containment procedures
Evidence collection (order of volatility)
Chain of custody documentation
Timeline reconstruction
Malware eradication
System recovery procedures
Lessons learned analysis

Incident Response Process

Hint

Incident Background

ALERT: This appears to be a ransomware infection!

Task 1: Incident Report Form

Task 2: Containment Procedures

SITUATION UPDATE

Task 2: Evidence Collection (Order of Volatility)

RAM Memory Dump Critical

Disk Image Stable

Network State Critical

Running Processes Important

System Logs Stable

Suspicious Email Stable

Task 4: Chain of Custody Log

Task 5: Incident Timeline Reconstruction

INVESTIGATION FINDINGS

Malware Execution

Phishing Email Received

Ransom Note Displayed

Attachment Opened

User Reports Incident

C2 Communication

Task 6: Eradication Procedures

Task 7: System Recovery

Task 8: Lessons Learned Report

Lab Complete!

Incident Response Lab - A+ Core 2

Incident Response Process

Hint

Incident Background

ALERT: This appears to be a ransomware infection!

Task 1: Incident Report Form

Task 2: Containment Procedures

SITUATION UPDATE

Task 2: Evidence Collection (Order of Volatility)

RAM Memory Dump Critical

Disk Image Stable

Network State Critical

Running Processes Important

System Logs Stable

Suspicious Email Stable

Task 4: Chain of Custody Log

Task 5: Incident Timeline Reconstruction

INVESTIGATION FINDINGS

Malware Execution

Phishing Email Received

Ransom Note Displayed

Attachment Opened

User Reports Incident

C2 Communication

Task 6: Eradication Procedures

Task 7: System Recovery

Task 8: Lessons Learned Report

Lab Complete!