You are the SOC analyst on duty at fictional NovaFin Technologies. At 10:14 IST, an employee reported a suspicious Microsoft 365 email. Microsoft Defender also generated an alert.
Investigate the available evidence, determine scope and impact, map relevant activity to MITRE ATT&CK, and recommend containment.
Employee reports a suspicious Microsoft 365 email.
Microsoft Defender generates a related alert.
Determine whether the activity is phishing only or a confirmed compromise.
Determine scope and impact, map relevant activity to MITRE ATT&CK, and recommend containment.
The original public lab page was not present in the current website repository, which is why this route was returning 404. This restored case page keeps the published case brief and investigation framing visible while the full sequential evidence experience is brought back into the source-controlled site.
