APT Capstone III: Write the Incident Report
ExpertDigital Forensics & Incident Response40-55 minReconstruction found what happened and eradication removed the footholds — now you have to communicate it. An investigation that never becomes a clear report doesn't drive decisions. The confirmed findings are handed to you in /root/case/findings.txt; your job is synthesis, not more digging.
Write /root/case/report.md with three things: an ATT&CK mapping (every stage tagged with its MITRE technique ID — note the persistence technique depends on the mechanism in the findings), an IOC summary (attacker/C2/exfil IPs, the web shell, the backdoor account), and a remediation section that names each concrete removal (the persistence path, the account, blocking the C2). Grading reads your report and checks all three. See /root/case/brief.txt.
- Map each intrusion stage to the correct MITRE ATT&CK technique ID
- Summarize the indicators of compromise for responders to hunt and block
- Write a remediation section that names each concrete removal/mitigation
- Produce a report that a responder could act on without re-investigating
Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.