ATK — Attacker mission
Move through the host and then cover your tracks: clear logs, timestomp, wipe artifacts, and break the timeline so the defender can’t reconstruct what you did.
Digital Forensics Cyber Range Training
Every intrusion leaves a story in the artifacts — if you can read it before the attacker erases it.
DEF — Defender mission
Preserve volatile evidence, rebuild the attacker’s timeline from what’s left, attribute the actions, and prove what happened to a standard that would survive review.
AI — What the Coach reviews
Which artifacts you collected first, whether you spotted the anti-forensics, and how complete your reconstructed timeline is against ground truth.
MITRE ATT&CK techniques covered
- T1070.001 Indicator Removal: Clear Windows Event Logs
- T1070.006 Indicator Removal: Timestomp
- T1027 Obfuscated Files or Information
- T1485 Data Destruction
- T1562.001 Impair Defenses: Disable or Modify Tools
Technique IDs are indicative of the kill chains modelled in this domain; each match draws a unique path through them.
Why this matters
- NotPetya (2017) — a wiper disguised as ransomware that destroyed evidence as it spread.
- Olympic Destroyer (2018) — deliberately planted false flags to mislead forensic attribution.
- Routine log-clearing by intrusion sets to delay detection and frustrate response.
Attack. Defend. Repeat.