ForenShield Lab · Attack Lab
One attack technique per case
Each case replays a real, documented attack technique. Hunt it in the logs, rebuild its flow with ATT&CK tactics, choose the right detection and the right response, then watch the attack unfold on the map.
- ≈ 25 min
- Advanced level
- No account
- Real cases, reconstructed
Real case, reconstructed logs. The attack and its techniques are real, documented by the cited sources. The company you defend, its machines, accounts, addresses and logs are reconstructed for the exercise. This demonstration performs no real analysis, reads nothing from your machine and sends nothing: it runs in your browser.
Simulation
Outline
What you will do
Take the alert
A SIEM rule fires: read the context, the entity and the rule.
Hunt in the SIEM
Queries, timeline, fields: find the events that prove each step, setting aside the decoys.
Rebuild the flow
Put the attack steps back in order and give each one its MITRE ATT&CK tactic.
Respond
Keep the most accurate detection rule, trigger the playbook actions, then replay the attack.
The real case
Kerberoasting: a service account’s password, cracked offline
A technique described by MITRE ATT&CK and by Microsoft, used by criminal groups such as FIN7. It needs no special rights, and almost everything happens outside your logs.
Read the real case and its sources (this reveals the solution)
Any domain account can request a Kerberos service ticket for an account that has an SPN. This ticket is encrypted with a key derived from the service account’s password: the attacker takes it away and cracks it offline. The most exposed accounts have a weak password or still accept RC4. Once the password is found, the attacker inherits the service account’s rights, often elevated.
- MITRE ATT&CK files the technique under T1558.003, in credential access. Among the examples cited: FIN7 with Invoke-Kerberoast, the Impacket tools (GetUserSPNs) and Rubeus.
- Microsoft explains that RC4 uses no salt and no iterated hash to derive a key from the password, which speeds up cracking. It announces that RC4 will be disabled by default in a future update to Windows 11 24H2 and Windows Server 2025.
- Its recommendations: managed service accounts (gMSA, a random 120-character password managed automatically), otherwise random passwords of at least 14 characters, AES rather than RC4 while changing the password afterwards, and an audit of SPN accounts.
- To detect it, MITRE and Microsoft point to 4769 ticket requests in RC4 (0x17) and a single user requesting many tickets in a short time.
What is reconstructed: Mutuelle Ardavène, its accounts, machines, addresses and logs are invented. The events use the real fields of Windows (4769, 4624, 4672, 5140, 4104) and Sysmon, simplified for the console, with a summary in technical notation. The initial takeover of the workstation and the offline cracking are not replayed: the first is not the topic, the second leaves no trace in the victim’s logs. No real analysis is performed.
Sources
- Steal or Forge Kerberos Tickets: Kerberoasting (T1558.003)MITRE ATT&CK, v20, rev. 2026
- Microsoft’s guidance to help mitigate KerberoastingMicrosoft Security Blog, 2024-10-11
- 4769(S, F): A Kerberos service ticket was requestedMicrosoft Learn, 2021-09-07
- Account Discovery: Domain Account (T1087.002)MITRE ATT&CK, v20, rev. 2026
Key takeaways
What you will learn
- Recognize a technique’s trace in real event fields
- Tell an attack apart from legitimate behavior that looks like it
- Place each step in the right MITRE ATT&CK v20 tactic
- Write a precise detection rule rather than a noisy one
- Respond without breaking production or forgetting an access
On real data
Then move on to the real tools
The simulation is for practice. For your own data, use the tools designed for that purpose.
Frequently asked questions
Before you start
Are the techniques real?
Yes: each case follows a technique described by MITRE ATT&CK, by vendors or by the agencies cited. The company, its machines and its logs are reconstructed for the exercise.
Is this a how-to for attacking?
No. Each case is played on the defense side: what the technique leaves in the logs, how to detect it and how to respond. No offensive tool is provided.
Do I need to know Active Directory?
No. The hints guide the search step by step, and the debrief explains each step. A seasoned analyst can do without them.
Will more techniques be added?
Yes: the lab grows case by case. Choose your technique in the list before opening the case.