Phishing / BECBeginnerFree, no sign-up
Inbox Zero Hour
A case from the Email Triage Lab
Briefing
An accounts-payable clerk at a fictional logistics company reports a past-due-invoice email, and her workstation has been running hot ever since. The gateway let the message through despite failing authentication. Work the mailbox corpus: who else received it, who interacted with it, what infrastructure sent it, how any payload would have run, and why the controls that should have stopped it did not.
452 events5 log sourcesabout 35 min
Solve this case
Opens the lab with this case selected. Graded in the browser; nothing to install.
What you will practise
- Reading message headers, authentication results and gateway verdicts
- Scoping a phishing wave across a mailbox audit trail
- Working a sandbox report without detonating anything yourself
- Turning findings into indicators that can actually be blocked
Maps to these certifications
GCIHCySA+Security+GCIA
Log sources in the corpus
Email Gateway · Mailbox · URL Rewriter · Mail Audit · Sandbox
How a case works
- Read the briefing: the alert as the analyst received it, the environment and the time window.
- Work the console: search, filter and pivot across every source; open raw lines; pin evidence.
- Fill the investigation form and write a short executive summary. Hints are available and cost points.
- Get graded per item with the evidence behind each answer, then share your result card.