kc7 / Security Analyst I / jojos-hospital
// kc7 · investigation flow

Jojo's Hospital: A Ransomware Investigation

platform KC7 difficulty Easy status in progress patterns banked 2

The brief. A renowned newspaper, The Valdorian Times 🗞️, publishes an unauthorized article accusing the leading political candidate of corruption! But was it a hack, an insider, or something else? You’ll investigate this incident by analyzing logs and tracing digital footprints.

01 ·

<Explain the move and why — the methodology is the takeaway.>

Employees

| take 10

<What the result showed, and the pivot it hands to the next step.>

02 ·

<Explain the move and why — the methodology is the takeaway.>

<your query here>

<What the result showed, and the pivot it hands to the next step.>

03 ·

<Explain the move and why — the methodology is the takeaway.>

<your query here>

<What the result showed, and the pivot it hands to the next step.>

04 ·

<Explain the move and why — the methodology is the takeaway.>

<your query here>

<What the result showed, and the pivot it hands to the next step.>

05 ·

<Explain the move and why — the methodology is the takeaway.>

<your query here>

<What the result showed, and the pivot it hands to the next step.>

06 ·

<Explain the move and why — the methodology is the takeaway.>

<your query here>

<What the result showed, and the pivot it hands to the next step.>

2 patterns banked from this lab view them in the KQL bank →