Day 2: Attack, detect, and investigate

Exercise 3: Persistence and privilege escalation alerts

In this exercise, you’ll trigger and investigate a persistence and privilege escalation alert.

---

Table of contents

• 1. Suspicious additions to sensitive groups
• 2. Investigate a persistence and privilege escalation alert