Investigate the attack based on the activities of a real APT group
Study the most up-to-date techniques and tactics of threat actors to be prepared for real-life cyberattacks

This is an online training platform with a virtual IT infrastructure simulating a typical corporate environment, where cybersecurity professionals can practice and improve their skills 24/7 with mentor support.
Here, you can investigate a real-world attack scenario carried out by the APT group Charming Kitten
# Getting started
1.	If you don't have an account yet, [register on the Standoff 365 Platform](https://auth.standoff365.com/en-US/account/registration/).
2.	Read the [step-by-step instructions](https://help.standoff365.com/en-US/7170815371/portal) on how to set up a connection to Standoff Defend.
3.	Go to Workspace → [Access and resources](https://range.standoff365.com/en-US/battle/16/?section=report&tab=accessAndResources), and download a VPN config file.
❗️Each polygon has its own unique VPN configuration. For correct operation, it is necessary to download a separate configuration file for each polygon through this access page. If you try to use the configuration file of another polygon, the system will deny access.



🔍 To investigate the attack and complete the report, please review the [guidelines](https://help.standoff365.com/ru-RU/8820264715/portal).
If you don't have any experience with Positive Technologies products, read the following materials:
*	 [MaxPatrol SIEM Quick Start Guide](https://storage.ptsecurity.com/f/d974809c9b1545dfa4a0/)
*   [Official Positive Technologies documents](https://help.ptsecurity.com/en-US/projects)

Please note:
• To connect to MaxPatrol SIEM, select the **LDAP** tab in the authorization window.
• Don't forget to turn on VPN to complete tasks and work with security tools.

To display investigation data displays correctly, use the time filter — the required period is specified in each task.
Important: Event timestamps in MaxPatrol SIEM depend on your time zone. For example:
An event recorded in SIEM at 10:00 UTC+0 will appear as:
- 05:00 UTC-5 (New York)
- 11:00 UTC+1 (Berlin)
- 15:30 UTC+5:30 (New Delhi)
- 19:00 UTC+9 (Tokyo)
Adjust the filter according to your local time to avoid discrepancies

# Getting support
If you encounter technical difficulties or have any questions about the Standoff Cyberrange, write to our [Telegram bot](https://t.me/stf_def_support_bot).

defend

Attack by the APT group Charming Kitten

The company is a leading provider of integrated IT solutions that enable clients to effectively implement complex projects in the field of information technology, taking into account the specifics of their industry.