Webshell Incident Response Lab
ShadowShell IR Lab
███████╗██╗  ██╗ █████╗ ██████╗  ██████╗ ██╗    ██╗
██╔════╝██║  ██║██╔══██╗██╔══██╗██╔═══██╗██║    ██║
███████╗███████║███████║██║  ██║██║   ██║██║ █╗ ██║
╚════██║██╔══██║██╔══██║██║  ██║██║   ██║██║███╗██║
███████║██║  ██║██║  ██║██████╔╝╚██████╔╝╚███╔███╔╝
╚══════╝╚═╝  ╚═╝╚═╝  ╚═╝╚═════╝  ╚═════╝  ╚══╝╚══╝
                      WEB LOGS • WEBSHELLS • CONTAINMENT
Choose the level to boot into. The selected stage is sent to the hidden attacker VM after startup.
You can also switch inside the defender VM with level easy, level medium, or level hard.
✓
Lab Complete
Incident Response Lab — Session Summary
Time Spent
00:00
minutes : seconds
QR Code SCAN ME
// Feedback
How was the lab? Your feedback helps improve future sessions.
→ Open Feedback Form
LINK: forms.cloud.microsoft/responsepage...
Investigation Guide
ShadowShell IR VM 10.0.0.10 — DEFENDER
Follow Stream