Reconnaissance & footprinting
Learn what public-facing assets and DNS records can reveal. In this lab, the inventory is synthetic and already isolated.
RR CYBERLAB / ISOLATED TRAINING ENVIRONMENT
Investigate the signal.
Protect the network.
Eight fictional incidents. Four learning perspectives. A controlled terminal, evidence you can correlate, and decisions that teach the why behind the response.
LOCAL SIMULATION ONLYNO EXTERNAL TARGETSBEGINNER → INTERMEDIATE
LEARNING PATH
Build investigation skills, step by step
Original educational material inspired by common security practice. RR CyberLabs is independent and does not provide or imply official CEH certification.
Scanning & enumeration
Interpret fictional service and identity observations. Understand that a finding is a lead to validate, not proof of access.
Vulnerability assessment
Review a deliberately vulnerable demo application's evidence, rank risk, and suggest remediation before any exploit is attempted.
Investigate & defend
Correlate synthetic DNS, authentication, process-tree and network telemetry. Scope carefully, contain proportionately, then recover.
Continue learning: DNS investigation · MITRE ATT&CK foundations · Incident response · SOC learning path
MORE HANDS-ON LABS
Continue across the RR CyberLabs range
Move between network building, endpoint behavior, incident hunting, and a guided red-versus-blue range.
BEGINNER MISSION
Mission 01 · The Quiet Beacon
OFFLINE PRACTICE DATA
PLAY MODEFollow suggested evidence steps. Hints are available.GUIDED PATH / HINTS ON
Map the fictional environment and validate exposure safely.
OBJECTIVEFREE EXPLORE / NO HINTS
● ● ●rr-lab://simulated-terminal
SUGGESTED ACTIONS select to run
Virtual Linux commands only: All output is fictional lab data.
SYNTHETIC TELEMETRY
0 / 4Evidence board
Network view
isolated labRun a mission command to reveal simulated activity.
ANALYST CHECKPOINT
PHASE 1 / 4Make an evidence-based decision
Start by reviewing the mission objective and available commands.
Your decision rationale and defensive recommendation will appear here.
INCIDENT REPORT / TRAINING COPY
Case complete
Education only. Simulated commands operate on a fixed set of fictional evidence. They cannot execute shell commands, scan networks, attack real systems, or connect to external targets. MITRE ATT&CK references are candidate learning mappings and require evidence validation.
Current threat patterns in the missions
These short learning notes explain why the latest fictional cases were added. They summarize public defensive research; they are not attribution claims or proof that a particular technique was used in a case.
Identity and cloud access
Recent incident research describes social engineering around authentication resets and device-code flows, followed by unauthorized authentication-method changes, cloud discovery, and SaaS data access. In the lab, correlate the user report, method-change audit, device, and follow-on API events. A successful sign-in alone does not establish legitimacy or compromise.
Microsoft Security Research: passkey-themed social engineering (September 2026) · Microsoft Security Research: device-code phishing (April 2026)
Developer and software supply-chain controls
Dependency drift, compromised developer tools, altered pipeline configuration, and mismatched build provenance are useful blue-team scenarios because defenders can compare lockfiles, reviewer records, runner identity, signatures, and downstream artifact use. The lab never installs packages or runs build code.
Google Threat Intelligence: hardening code pipelines and CI/CD (September 2026) · Google Threat Intelligence: software supply-chain mitigation (July 2026)
SaaS tokens and mailbox persistence
Investigate token and app activity through ownership, permission scope, source context, API volume, and audit trails. A forwarding rule, consent grant, or object read is an indicator to validate; it does not prove that information left the organization.
Google Threat Intelligence: defending SaaS against social engineering and data theft (January 2026)
Sources reviewed October 2026. Scenarios use fictional identities, .test names, documentation-range addresses, and fixed browser data. No external activity is performed.
Connect this lab to GRC
Use the fictional alerts, endpoint events and network evidence from this lab to practice describing a risk, choosing a safeguard, assigning an owner and recording evidence. SIEM, NDR and EDR signals help explain what happened; GRC makes the response measurable and accountable.