ATT&CK-Mapped Threat Hunt
forensics · hard · +55 XP
Target
GET /api/lab/attack-hunt-101/events (50 process-exec events)
POST /api/lab/attack-hunt-101/submit body {technique_ids: [...], chain_pid}
Goal: one process tree shows mshta.exe → powershell.exe -enc .... Submit technique_ids containing both T1059.001 and T1218.005, plus the chain_pid of the mshta parent.
// AI hint · first is free · then 1 credit or 5 XP
// attack console
/api/lab/attack-hunt-101/
// reuse on the cli
// submit flag
// no solves yet
12 of 13 · forensics