A machine is behaving badly. Prove it, then touch it.
FIN-WKS-0777 raised Behavioral threat detected (high severity) plus an RDP session from an unusual peer. You are the endpoint engineer on shift. Everything here is graded on order: evidence before remediation, approval before disruption, verification before closure.
Required
i
Console replica, synthetic tenant.
Layout and control names model the 2026 Defender portal. Nothing is connected to a real environment: no device is isolated, no binary is executed, no package is installed. Every host, user, hash, URL and address is fabricated for training (documentation ranges only). No Microsoft marks or logos are reproduced.
Objectives · 100 pts
Seven graded controls
1
Scope & asset context · 10Pick the right device out of the inventory and state the exposure you are protecting.
2
Timeline & process tree · 15Separate parent-child facts from noise; identify why nothing was blocked.
3
Blast radius in KQL · 15Find every host with the same file hash and the same registry persistence.
4
Live response · 20Drive the simulated console: evidence first, no destructive verb before collection, structured query when you need it.
5
Isolation or containment? · 10Choose the right disruption for the right reason, with the notification and the exception path.
6
Vulnerability remediation · 15Recommendations, remediation package, and an exception with owner and expiry.
7
Verification & closure · 15Prove the machine is clean, the sensor is healthy and the note is audit-ready.
Device inventory
Five candidates, one is yours
Select one device. No rows selected
Device name
Exposure
Groups
Alerts
Sensor
Last seen
HVA
FIN-WKS-0777Windows 11 23H2 · 4 users
High
FIN-WKS
3 open
Healthy
2 min ago
No
FIN-WKS-0421Windows 11 23H2
Medium
FIN-WKS
0
Healthy
11 min ago
No
OPS-SRV-0102Windows Server 2022
Medium
OPS-SRV
1 open
No onboarding
3 h ago
Yes
PAY-SRV-0007Windows Server 2019 · conditional launch enforced
Low
PAY-SRV
1 open
Healthy
40 s ago
Yes
HR-WKS-0110Windows 11 24H2
Low
HR-WKS
2 open
Healthy
1 h ago
No
HVA = onboarded as a high-value asset, which deliberately restricts some response actions. Two of these hosts sit in the payroll path: disrupting one at 16:40 on a Friday is a decision, not a reflex.
Objective 1 · 10 pts
FIN-WKS-0777
3 open alertsInvestigateExposure score 8.1Not an HVAASR: 2 rules in audit
Required
Device page
Facts you will need in the next six objectives
Operating system
Windows 11 Enterprise 23H2 (22631.4037)
Logged on users
fin.clerk (local admin) · svc_print (session 2)
Device group
FIN-WKS · 118 members
Internet facing
No external listener; RDP reachable from the LAN only
Defender AV
Active mode · cloud-delivered protection: High · EDR in block mode: Off
ASR rules
Block executable content from email client — audit; Office child process — audit
Missing updates
4 KBs · 2 with known public exploitation
Sensor
Version 10.26.08.1 · check-in 2 min ago · no proxy issues
Disk free
7% — an investigation package needs about 2 GB
!
The free-space line is a trap on purpose.
Collecting an investigation package on a nearly full disk, or on a metered connection, fails. Check the environment before you click, exactly as the product guidance tells you to.
Objective 1
Declare the scope you are working in
Required
Objective 2 · 15 pts
Device timeline · 2026-08-21 08:05 – 09:40 UTC
The timeline is the only place where the sequence is unambiguous. Read it, then answer what actually executed.
RequiredProcessNetworkRegistry
Timeline
Nine events — three of them are the whole story
08:07P
OUTLOOK.EXE started a child: msedge.exe --embedded-webviewcscript blocked by policy · no ASR enforcement (audit only)
invoice_88216.xlsx.exe → svch0st.exe spawned in a new sessionUnsigned · parent chain traces back to Outlook · not blocked (EDR block mode off)
08:11N
svch0st.exe → login-contoso.secure-mail.example (203.0.113.64:443)3 outbound connections · 42 KB up / 8 KB down in 9 minutes
08:14R
Registry value created: HKCU\…\Run\WindowsUpdateSvcPoints at the temp loader — this is your second blast-radius key
08:22P
mshta.exe ran with an obfuscated argumentRelated to a different alert on HR-WKS-0110 — not this device's story
08:41N
RDP inbound session from 10.20.4.19 (WINSCP-SRV, maintenance)Legitimate change window · no file transfer recorded · do not treat as lateral movement
09:02F
Archive created: C:\PerfLogs\stage.cab (9.7 MB)Staging behaviour · source folder was the payroll export directory
09:38P
svch0st.exe deleted itself after a failed second uploadAnti-forensics · this is why the timeline matters more than the alert title
Process tree
Who spawned whom
OUTLOOK.EXEpid 8104
└msedge.exeembedded webview · pid 8212
└invoice_88216.xlsx.exepid 8444 · unsigned
└svch0st.exepid 8502 · network + registry child
·SearchHost.exe114 children — normal noise
Selecting a node in the replica shows its command line, hash, signer and integrity level. The lab does not need you to click it; it needs you to read the parent chain correctly.
Objective 2
Read the timeline, don't guess it
Required
Objective 3 · 15 pts
How many machines have the same thing?
Answer with one bounded query, then state the scope you would remediate.
Required
Bounded windows only · this lab's retention is 14 days
Query
Every device that executed the loader by hash
Requirements: start from DeviceFileEvents or DeviceProcessEvents, restrict Timestamp > ago(14d), filter on SHA1 or SHA256 of the loader, then summarize … by DeviceName. Available tables: DeviceFileEvents, DeviceProcessEvents, DeviceRegistryEvents, DeviceNetworkEvents.
Results
No query run yet
Nothing run yet · window bound by your query
Run a query to see simulated results here. The grid is generated from the lab's synthetic dataset — not from a tenant.
Only the columns below exist in this lab. Real Advanced hunting has far more tables and columns.
Tables
Four endpoint tables
Objective 4 · 20 pts
Live response session
One simulated sensor, one typed console. The grade is not "did you type a command" — it is evidence before destruction, and an approval record for anything that changes the machine.
RequiredSession: not started
!
The verbs below are this lab's subset.
Real live response exposes a vendor-defined action set that changes over time. What transfers to your console is the discipline: collect first, keep the original file, never remove or kill before you have the artefact, and never run an unsigned binary you have not been approved to run.
Console
Typed commands · recorded in the audit log
FIN-WKS-0777> session requested. Type help for the accepted verbs.
No approval recorded — remove-item, stop-process and run-binary will be refused and flagged.
Objective 4
Session outcome
Required
Objective 5 · 10 pts
Isolate, contain, or neither
These are different buttons with different blast radii. Choosing one is a decision about the business, not about the alert severity.
Required
Action matrix
What each button actually does
Action
Effect on the device
User impact
Undo path
Isolate device
Blocks inbound and outbound network traffic except the Defender portal and the sensor's cloud endpoints. Local execution continues.
High but reversible; the user keeps working offline
Reverse isolation from the same control
Contain device
Suspends the machine entirely, including local execution, and keeps it visible for forensics. Intended for devices with no business dependency, e.g. Kiosk / shared hardware.
Total — the machine stops responding to the user
Release containment
Restrict app execution
Blocks untrusted and unsigned applications from running; network stays up.
Medium; may break line-of-business apps
Lift restriction
Stop and quarantine file
Terminates the process tree and quarantines that file only.
Low
Action center → restore
Collect investigation package
No operational effect; produces the artefact set you need before anything else.
None (needs disk space and a non-metered link)
n/a
Run full antivirus scan
Scan plus remediation of detected items.
Performance hit only
n/a
High-value-asset settings can silently disable some of these for particular groups. That is a configuration fact you are expected to check, not discover at the moment you need it.
Objective 5
The decision
Required
Objective 6 · 15 pts
The hole the intrusion walked through
Six open recommendations touch this device. Remediate the two that are exploitable from the browser and the mail path; the rest need a window, an owner and an expiry.
Required
Recommendations on FIN-WKS-0777
Choose exactly two to fix today
Multi-select. No rows selected
ID
Recommendation
CVSS
Exploit
Fix
Break risk
REC-1
Edge 128 → 129 security updateRemote code execution via crafted PDF
8.8
Publicly exploited
KB5039218
Low
REC-2
Windows Script Host should not launch from mail clientsConfiguration, not a patch: ASR rule to block mode
7.4
Used in this incident
ASR 9e6c4e…
Medium — 2 legacy macros
REC-3
Office 2019 → latest monthlyCredential leak in outlook.exe
6.5
Unreported
Current channel
Medium — add-in testing
REC-4
Enable EDR in block mode on FIN-WKSPost-detection blocking is currently off
8.1
Used in this incident
Policy: Sensor
Low
REC-5
Remove local admin from fin.clerkElevation opportunity
5.9
Unreported
Privileged access
High — payroll tooling
REC-6
NetBIOS over TCP/IP should be disabled on server VLANsNot applicable to this device group
4.3
Unreported
DHCP option
Medium
CVSS alone does not order your work. "Used in this incident" and "publicly exploited" are the columns that decide the queue for today.
Objective 6
Remediate and except, in writing
Required
Objective 7 · 15 pts
Prove it, then hand it back
"I clicked isolate" is not an outcome. Verification is a re-scan, a sensor check, a comparison against the original alert, and a sentence a manager can read.
Required
Action center
Result of your session
Action
Status
Result
Undo
Collect investigation package
Completed
38 MB · retrieved 09:52
n/a
Isolate device
Active
Network blocked; sensor reachable
Run full antivirus scan
Completed
2 items cleaned · 0 pending after re-scan
n/a
Remove item (loader path)
Approved
File absent on re-check; hash still in the package
ASR rule → block (FIN-WKS)
Pending reboot
Applies at next check-in window
i
Read the last row before you close anything.
A policy that is pending, or a scan whose result you have not read, is not verification. Reverse isolation only after the re-scan and the sensor check agree.
Objective 7
Closure record
Required
Reference
Marking scheme, standing rules and what this lab deliberately omits
Marking
How the 100 points are awarded
#
Objective
Points
What the validator actually checks
1
Scope & asset context
10
Correct device, correct data class, impact stated honestly, three scope acknowledgements, tags present and clean of personal data
2
Timeline & process tree
15
Exactly the four supported statements, the right pivot key, the enforcement-mode answer, a note that reads like an evidence chain
3
Blast radius in KQL
15
Query runs on the right table with a bounded window and a hash filter, returns the expected devices, plus a scope answer consistent with your own result
4
Live response
20
Evidence verbs before destructive verbs, approval recorded before any destructive verb, refusal of the unapproved binary, a note a third party can follow
5
Isolation or containment
10
Action justified by continuity and reversibility, notification sent, four pre-flight conditions met
6
Vulnerability remediation
15
Exactly the two incident-linked recommendations, a real remediation method, an exception with owner, expiry and compensating control
7
Verification & closure
15
Re-scan plus file re-check, sensor health, the other devices explained, custody of the package, residual risk admitted
Standing rules
Read once, apply everywhere
Evidence before remediation. A package you could not retrieve is worse than a delay; the disk-space line in objective 1 is there to make you check.
Disruption is a decision with a owner. Isolation, containment and app-execution restriction have different blast radii; pick the smallest one that stops the outcome you are seeing.
Never destroy the artefact you have not copied. Removing a file that is the only copy of a payload in your tenant is how investigations end early.
Correlation is not evidence. The 08:41 RDP session and the mshta alert on another host are in this lab specifically to be resisted.
Fix the control, not the ticket. A clean scan with audit-mode ASR rules reproduces the incident next week.
Exceptions expire. Every accepted risk in this lab needs an owner, a date and a compensating control, or it is not an exception — it is a forgotten hole.
Verification is a comparison. Re-scan, re-check the persistence key, re-check the other devices, then reverse isolation.
§
Mapping used in this series
Techniques to MITRE ATT&CK (T1566.002, T1204.002, T1547.001, T1071.001, T1021.001, T1560); controls to NIST SP 800-61r3 detection/containment/eradication/recovery and ISO/IEC 27001:2022 A.5.24–A.5.28; regulatory clocks to NIS2 Art. 23, DORA Art. 19 and GDPR Art. 33; vulnerability terms to PCI DSS v4.0 requirements 6.3, 6.4, 11.3, 12.10. These labs are training aids and are not certification exam prep.
Data
Everything in this lab is synthetic
Kind
Values used
Guarantee
Host names
FIN-WKS-0777, PAY-SRV-0007, OPS-SRV-0102
Invented; role-prefixed
Accounts
fin.clerk, svc_print
No real UPNs or directories
Addresses
203.0.113.64, 10.20.4.19
RFC 5737 / RFC 4193 documentation ranges
Domains & URLs
*.example
Never resolvable to real infrastructure
Hashes
fabricated SHA-1 / SHA-256
Not real malware fingerprints
State is kept in your browser only (localStorage). Nothing is uploaded; there is no analytics script, no web font and no third-party request on this page. The audit log and the exported evidence pack redact anything shaped like a real identity unless it is obviously documentation data.
Access
Keyboard and screen-reader notes
Skip link first; every view is a labelled <section> and the side nav is a real list of buttons.
Grids: arrow keys move, Space selects, Shift+Arrow extends; the selected count is announced in the caption.
The live-response terminal is focusable and its output is a polite live region; commands are also mirrored into the audit log so nothing exists only visually.
Every validation message sits inside the form it belongs to and is announced via aria-live; colour is never the only signal.
Escape closes the audit flyout and any open modal; prefers-reduced-motion and Windows high contrast are respected.