An attack is not an event. It is a chain.
Follow a real intrusion end to end —from the phishing email to log wiping— and see, at each phase, what trace it leaves and which tool catches it. Everything links to the arsenal.
An email arrives with an attachment or a link. It looks like a known sender; the real path and the authentication tell another story.
The user opens the attachment. A macro launches powershell -enc <base64> — obfuscated code running in memory.
The script downloads the next stage (a download cradle) and starts beaconing to a C2 server. The machine is no longer yours.
To survive a reboot, the attacker installs a service or a scheduled task. PsExec, for instance, creates a temporary service.
It dumps LSASS memory to steal hashes and tickets. With admin credentials, the whole domain is within reach.
It hops from machine to machine with PsExec, WMI or RDP, using the stolen credentials until it reaches what it wants.
It steals the data, maybe encrypts, and clears the event logs to cover its tracks. Here you no longer prevent: you respond.
Every phase has its tool.
You have seen the whole chain. Now keep the arsenal at hand to cut it — at whichever phase, the sooner the better.
Explore the arsenal →