SAL2
TryHackMe Security Analyst Level 2 (SAL2)
Threat Detection TriageEnglish
Exam overviewPractice session
An analyst reviewing Splunk logs notices a user account performed 47 failed logins followed by one successful login, then immediately ran 'net localgroup administrators' and 'whoami /all'. Which attack stage does this sequence most likely represent?
Loading your practice session…