← All rangesThe Range · Windows Security · Engineer level

Signed By Microsoft

The alert arrived with an allowlist request attached

You are on the detection and response team. It is 09:20. The alert is yours, it came with a recommendation already written on it, and at this level nothing you decide is checked before it takes effect.

EDR-55301 · severity medium · triage note attachedEDR triage queue · 09:14

"certutil.exe made an outbound HTTP connection from WS-FIN-0412 (finance, n.haddad). Binary is in System32 and validly signed by Microsoft. Triage note: signed OS component, most likely a false positive. Suggest allowlisting it to cut the noise."

Before you start: how this works

01One objective at a timeYou are always told, in one sentence, what you are trying to establish right now. At this level the full action list is open from the start: knowing which tool exists is part of it.

02Time passesEvery action costs minutes in the story. Nothing is on a real-world timer, so think as long as you like, but the minutes inside the incident have consequences in it.

03Some things cannot be undoneWrong moves make the incident bigger, not just lower-scoring. This one can reach COMPROMISED, and nobody arrives to take it off you.

04Mistakes are the lessonEvery wrong turn is written up at the end with what it cost and what the better move was. Finish the range (any outcome) and its interview pack unlocks.

You are judged on three things. Accuracy: did you work out what was really wrong and deal with it. Economy: how directly you got there, in the incident’s own minutes. Integrity: what you preserved, who you told, and whether you claimed anything you had not established. The third is the one people fail.

Finish it, with any outcome, and its interview pack unlocks: 4 questions with weak, good and strong answers, the follow-up, and the trap.

Signed By Microsoft · EDR-55301 · severity medium · triage note attached

Wall clock: 09:20
Time spent: 0m
Situation: ·
Severity: ·

Choose one

Incident log

Everything you do, in order. This is what a real handover is written from.

Nothing has happened yet.

How bad is it

Wrong moves push this up. Containing the problem pushes it back down.

What you have established

Facts you have actually observed, not guesses.

Nothing yet.