Lab 001 · Walkthrough

Walkthrough

This is how I'd work the intrusion, from no alert at all to a full timeline. Every question in the question set is answered along the way, tagged like Q001.

Before you start

Finish setup. If you loaded the lab from the Exchange or Codespaces, the fractal already opens on the dataset's time range. Otherwise set a custom range of Oct 27 to Nov 1, 2026. All times are UTC. Hover over any query to get an Open in Bifract button.

1. Q001 to Q002Hunting with baselines

   Use models to find what's new or unusual, and the first host.

2. Q003 to Q004Initial access

   The command pasted into the Run dialog, and what it downloaded.

3. Q005 to Q009The loader

   A signed program running under another name, and the payload it starts.

4. Q010 to Q013Hands on keyboard

   Discovery commands, a renamed remote support tool, and commands typed by a person.

5. Q014 to Q016Persistence

   A screenshot tool set to start at logon, loading a DLL it shouldn't.

6. Q017 to Q020Credential access

   A password tried against four accounts.

7. Q021 to Q025Lateral movement

   Admin shares and a remote service onto a second workstation.

8. Q026 to Q031Infrastructure and scope

   The attacker's domains, IPs and ports, and every host that called back.

9. Timeline and takeaways

   The intrusion on one page, the indicators, and detection ideas.

How to read a step

bifract_category="process_creation" parent_image=$"\\explorer.exe"
  | groupBy(computer_name, image) | sort(_count)

Queries are BQL: filters first, then a pipe into each transform. Under each query is a screenshot of what you should see. A purple box sums up what the step found:

Finding

What the step showed, and the answer to any question it covers.

An orange box marks something out of place:

Out of place

Something that doesn't fit the baseline.