An attack is not an event. It is a chain.
Follow a real intrusion end to end —from the phishing email to log wiping— and see, at each phase, what trace it leaves and which tool catches it. Everything links to the arsenal.
Delivery — Phishing
ATT&CK · T1566An email arrives with an attachment or a link. It looks like a known sender; the real path and the authentication tell another story.
Execution — Macro → PowerShell
ATT&CK · T1059.001The user opens the attachment. A macro launches powershell -enc <base64> — obfuscated code running in memory.
Command & Control
ATT&CK · T1071The script downloads the next stage (a download cradle) and starts beaconing to a C2 server. The machine is no longer yours.
Persistence
ATT&CK · T1543.003To survive a reboot, the attacker installs a service or a scheduled task. PsExec, for instance, creates a temporary service.
Escalation — Credentials
ATT&CK · T1003.001It dumps LSASS memory to steal hashes and tickets. With admin credentials, the whole domain is within reach.
Lateral movement
ATT&CK · T1021It hops from machine to machine with PsExec, WMI or RDP, using the stolen credentials until it reaches what it wants.
Impact — Exfiltration and anti-forensics
ATT&CK · T1070.001It steals the data, maybe encrypts, and clears the event logs to cover its tracks. Here you no longer prevent: you respond.
Every phase has its tool.
You have seen the whole chain. Now keep the arsenal at hand to cut it — at whichever phase, the sooner the better.
Explore the arsenal →