COMING SOONBeginner
Account Takeover: Impossible-Travel Sign-In
A finance analyst's Microsoft Entra account is accessed without MFA from Moldova 18 minutes after their normal London sign-in. Impossible travel confirmed. The unauthorized session reads the inbox via Graph and adds an external recovery address. Work the Entra audit trail to identify the attacker IP, the compromised mailbox, and the persistence mechanism.
25m
6 tasks
25 points
FreeLaunches today
Jul 3, 2026
Create your free accountFriday, July 3, 2026 at 9:00 AM
Be ready the moment it drops — free forever.
Training Tools
CloudSIEM
What you'll investigate
6 objectives unlock when this operation goes live.
1Locate the unauthorized entry point
2Establish the travel gap
3Trace the mailbox access
4Find the persistence move
5Classify the initial access
6Classify the mailbox collection
Be first when it launches
Create your free account now. The moment this operation goes live on Jul 3, 2026, you can jump straight in — and you'll have the rest of the catalog to train on meanwhile.
Get Started FreeNo credit card required — free forever