RR CYBERLAB
NEW HERE? Start with Windows → Malware Execution → Run Guided Scenario. Follow the highlighted step before opening detailed telemetry.You do not need to understand every panel first. The lab will show you what changed and why.
LABS1 · CyberBuilder Build & watch traffic2 · Endpoint Lab See host behaviour3 · AttackMap Investigate the incident4 · Cyber Range Red vs Blue missions
RR CYBERLAB • ENDPOINT LAB

See what the endpoint sees.

Don't start with a pile of logs. Start with a machine, choose one behaviour, watch the process and network changes, then learn why the evidence matters.

🧭 New here? Start with one simple question.

What changed on this machine? Pick an operating system, choose a scenario, then press Run Guided Scenario. The lab will highlight each event in order.

1 • Choose OSWindows / Linux / macOS
2 • Choose behaviourMalware / exploit / C2
3 • Watch evidenceProcess + files + network
4 • Explain itWhy is it suspicious?

🎯 Three ways to learn

Endpoint = inside the machine. Network = packets between machines. Full Environment = correlate everything like an analyst.

ENDPOINT + NETWORK VISUALIZER
Guided: malware execution on Windows
READY · choose a behavior, then run the simulation
01USER / ENTRYEVENT
👤
User activity

A document is opened by the user.

Starting point
02ENDPOINTOBSERVING
Windows Endpoint • WS-02310.20.15.17
🪟
Processes: normalFiles: normalNetwork: normalAuth: normal
User action→Process→Telemetry

A suspicious child process appears.

03FILE / STARTUPARTIFACT
📄
Changed file or setting

A new payload is created.

Persistence / file evidence
04NETWORK / CLOUDFLOW
🌐
External destinationFictional training endpoint

The process makes an outbound connection.

Network evidence
User eventEndpoint behaviorFile / persistenceNetwork / identity
LIVE INVESTIGATION TIMELINEREADY
ReadyPress Run Guided Scenario to watch the sequence.
WHAT CHANGES BY OPERATING SYSTEM?FOUNDATION
🪟 Windows

PowerShell, Event IDs, services, registry/startup and Windows authentication.

🐧 Linux

Processes, SSH authentication, systemd services, permissions, cron and sockets.

🍎 macOS

Processes, launch agents/daemons, authentication, application activity and network connections.

RR CyberLabs Endpoint Lab • All activity is simulated learning data. No real exploitation occurs.

Connect this lab to GRC

Use the fictional alerts, endpoint events and network evidence from this lab to practice describing a risk, choosing a safeguard, assigning an owner and recording evidence. SIEM, NDR and EDR signals help explain what happened; GRC makes the response measurable and accountable.

Privacy PolicyContact