Case 0003: Part 1 - Through the Looking Proxy: An Operator Inside the Network | Threat Hunting Labs

Investigate a Windows intrusion where a successful privileged network logon triggers a persistence command sequence including remote access tool installation, backdoor account creation, and registry-based account hiding. Trace through credential dumping into the first outbound tunnel.