Cyber Detective Lab: Threat Hunting with KC7

Real security analysts don’t guess. They follow evidence. In this lab students play detective inside KC7, a cyber training game where a pretend company has been attacked. They search email, web and computer logs with real queries, follow clues from one log to the next, and figure out who got in, how they got in and what they took.

Level: Intermediate
Ages: 13 and up (under 13 with a parent’s permission)
Length: Self-paced. The first KC7 career path, Security Analyst I, takes about 21 hours across 7 modules.
Format: Played on kc7cyber.com, using this page as your lab guide and worksheet

About accounts: KC7 is run by the KC7 Foundation. Students sign in on kc7cyber.com to save their progress. KC7’s terms say users under 13 need a parent’s or guardian’s approval before creating an account, and teachers can set up accounts for their students.

Open KC7 and start the Security Analyst I path

Outcomes

• Explain the stages of an attack, from first contact to stolen data (the cyber kill chain)
• Search security logs with KQL (Kusto Query Language)
• Spot signs of compromise in email, web traffic, logins and running programs
• Pivot: use one clue (a domain, an IP address, a file name) to find the next one
• Write up findings the way a security analyst reports to their team

Lab steps

1. Open KC7, sign in, and choose Security Analyst I under Career Paths.
2. Read the module’s story so you know which company you are protecting and what you are looking for.
3. Explore each table with take 10 before writing bigger queries. Learn what columns each table has.
4. Answer the module questions. Write every query you use and every clue you find in the worksheet below.
5. When you find a suspicious domain, IP address or file, pivot: search for it in the other tables.
6. Finish with a short report: what happened, when, which accounts and computers were affected, and how to stop it next time.

KQL starter kit

Table names differ a little from module to module. These examples use common ones like Employees, Email and OutboundNetworkEvents. Check the table list in your module.

// Peek at 10 rows to learn what a table looks like
Employees
| take 10

// How many rows are in a table?
Email
| count

// Filter rows: emails whose subject mentions "invoice"
Email
| where subject has "invoice"

// Show only the columns you care about
Email
| where subject has "invoice"
| project timestamp, sender, recipient, subject

// Count unique values: how many different senders?
Email
| distinct sender
| count

// Group and count: which senders sent the most email?
Email
| summarize email_count = count() by sender
| sort by email_count desc

// Pivot: who visited a suspicious domain you found?
OutboundNetworkEvents
| where url has "suspicious-domain.example"
| project timestamp, src_ip, url

Analyst worksheet

1. What company are you protecting, and how many employees does it have? (Write the query you used.)
2. What was the first suspicious event you found? Which table was it in, and why did it look wrong?
3. List every suspicious domain, IP address, email sender and file name you found.
4. Which employees or computers were affected? How do you know?
5. Put the attack in order: how did the attacker get in, what did they do next, and what did they take?
6. Name two defenses that would have stopped or caught this attack sooner.

Where this fits

• Before this lab: Cybersecurity Foundations (Grades 9–12) and Cyber Defense
• After this lab: CompTIA Security+ Preparation, OSINT Investigations and the Cyber Defenders class

Questions? Email support

Back to the Learning Hub