Investigate real-world, complex incidents to identify gaps in training, processes, procedures, and communication plans.

Work closely with experienced Mandiant incident responders who draw on years of intelligence-led investigative expertise to assess and provide real-time feedback and coaching.

Familiarize your response and intelligence teams with the latest attack scenarios and attacker TTPs relevant to your organization, as learned from Mandiant advanced persistent threat (APT) investigations.

Evaluate and improve the abilities of your incident response and intelligence teams as they respond to various attack scenarios and threat actors in real time.

Learn how to effectively research attacker TTPs and identify indicators of compromise from host-based and network-based artifacts.

This scenario emulates an insider threat with a valid user currently on a system. This user opens a reverse shell session on the initial access host and uses it to discover information about the entire network.

This scenario imitates an attacker gaining access to a host via a spear phishing attachment. It opens a bypass session on that host, gathers information, and deploys a beacon.

A domain user is compromised, allowing the threat to access the system and move laterally, conducting internal reconnaissance and establishing persistence. Once initial compromise is secured, the attacker deploys ransomware and runs malware on multiple mission-critical systems.

A threat actor gains access to a host and begins discovery before conducting a Kerberoast attack and further reconnaissance of the domain. Then, the actor compromises the domain controller, exfiltrates passwords, and disrupts normal business operations.