Investigate the attack based on the activities of a real APT group
Study the most up-to-date techniques and tactics of threat actors to be prepared for real-life cyberattacks

This is an online training platform with a virtual IT infrastructure simulating a typical corporate environment, where cybersecurity professionals can practice and improve their skills 24/7 with mentor support.
Here, you can investigate a real-world attack scenario carried out by the APT group Charming Kitten
# Getting started
1.	If you don't have an account yet, [register on the Standoff 365 Platform](https://auth.standoff365.com/en-US/account/registration/).
2.	Read the [step-by-step instructions](https://help.standoff365.com/en-US/7170815371/portal) on how to set up a connection to Standoff Defend.
3.	Go to Workspace → [Access and resources](https://range.standoff365.com/en-US/battle/16/?section=report&tab=accessAndResources), and download a VPN config file.
❗️Each polygon has its own unique VPN configuration. For correct operation, it is necessary to download a separate configuration file for each polygon through this access page. If you try to use the configuration file of another polygon, the system will deny access.



🔍 To investigate the attack and complete the report, please review the [guidelines](https://help.standoff365.com/ru-RU/8820264715/portal).
If you don't have any experience with Positive Technologies products, read the following materials:
*	 [MaxPatrol SIEM Quick Start Guide](https://storage.ptsecurity.com/f/d974809c9b1545dfa4a0/)
*   [Official Positive Technologies documents](https://help.ptsecurity.com/en-US/projects)

Please note:
• To connect to MaxPatrol SIEM, select the **LDAP** tab in the authorization window.
• Don't forget to turn on VPN to complete tasks and work with security tools.

To display investigation data displays correctly, use the time filter — the required period is specified in each task.
Important: Event timestamps in MaxPatrol SIEM depend on your time zone. For example:
An event recorded in SIEM at 10:00 UTC+0 will appear as:
- 05:00 UTC-5 (New York)
- 11:00 UTC+1 (Berlin)
- 15:30 UTC+5:30 (New Delhi)
- 19:00 UTC+9 (Tokyo)
Adjust the filter according to your local time to avoid discrepancies

# Getting support
If you encounter technical difficulties or have any questions about the Standoff Cyberrange, write to our [Telegram bot](https://t.me/stf_def_support_bot).

defend

Attack by the APT group Charming Kitten

Charming Kitten APT, an allegedly state-backed Middle Eastern hacking group, managed to reach the target device and conduct thorough reconnaissance. We detected suspicious activity during the C2 server communication phase. Find out what the attackers were able to steal.

Charming Kitten APT

The company is a leading provider of integrated IT solutions that enable clients to effectively implement complex projects in the field of information technology, taking into account the specifics of their industry.