Labs / Hashes and verification
Match the quarantine to the intel feed
The mail gateway quarantined five attachments. A threat-intel feed lists known-bad SHA-256 hashes. Hash the attachments and find the one that matches the feed.
Briefing
The mail gateway held five attachments sent to the finance team this morning. File names prove nothing; the content hash does.
The intel team’s feed is a CSV with one known-bad hash per line, plus the family name and the date it was first seen.
mail-ir · Hashes and verification
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.