Lion Cipher Lab
Reconstruct an intrusion end-to-end (the DFIR capstone)
- Digital Forensics & IR (DFIR)
- Advanced
- ~3–4 hours
- Free · no account required
Why it matters
Every DFIR lab before this one teaches ONE artifact in isolation — the registry, the event logs, memory, prefetch, the browser database. Real investigations are never one artifact. A single Run key tells you a mechanism but not when it was planted or by what; a single process-creation event tells you something ran but not why it was on the box. The entire craft is correlation: laying independent sources onto one timeline until a defensible story emerges, then writing that story down so a manager, a lawyer, or the next responder can act on it. This capstone is where the separate skills become…
What you'll learn
- Correlating evidence across independent artifact sources
- Building and reading a forensic super-timeline
- Answering the four investigator questions (initial access, execution, persistence, impact)
- Mapping observed activity to MITRE ATT&CK
- Writing a professional, evidence-backed incident report
Steps in this lab
- The mission: reconstruct, don't remember
- Snapshot first, and understand the safety model
- Trigger the simulated compromise
- Collect the evidence (triage)
- Parse each source with the Zimmerman tools
- Build the super-timeline with Plaso
- Correlate: turn the timeline into a story
- Answer the four investigator questions — with evidence
- Map the activity to MITRE ATT&CK
- Write the incident report
- Tear down — remove every artifact and delete the evidence