Investigate the attack based on the activities of a real APT group
Study the most up-to-date techniques and tactics of threat actors to be prepared for real-life cyberattacks

This is an online training platform with a virtual IT infrastructure simulating a typical corporate environment, where cybersecurity professionals can practice and improve their skills 24/7 with mentor support.
Here, you can investigate a real-world attack scenario carried out by the APT group Charming Kitten
# Getting started
1.	If you don't have an account yet, [register on the Standoff 365 Platform](https://auth.standoff365.com/en-US/account/registration/).
2.	Read the [step-by-step instructions](https://help.standoff365.com/en-US/7170815371/portal) on how to set up a connection to Standoff Defend.
3.	Go to Workspace → [Access and resources](https://range.standoff365.com/en-US/battle/16/?section=report&tab=accessAndResources), and download a VPN config file.
❗️Each polygon has its own unique VPN configuration. For correct operation, it is necessary to download a separate configuration file for each polygon through this access page. If you try to use the configuration file of another polygon, the system will deny access.



🔍 To investigate the attack and complete the report, please review the [guidelines](https://help.standoff365.com/ru-RU/8820264715/portal).
If you don't have any experience with Positive Technologies products, read the following materials:
*	 [MaxPatrol SIEM Quick Start Guide](https://storage.ptsecurity.com/f/d974809c9b1545dfa4a0/)
*   [Official Positive Technologies documents](https://help.ptsecurity.com/en-US/projects)

Please note:
• To connect to MaxPatrol SIEM, select the **LDAP** tab in the authorization window.
• Don't forget to turn on VPN to complete tasks and work with security tools.

To display investigation data displays correctly, use the time filter — the required period is specified in each task.
Important: Event timestamps in MaxPatrol SIEM depend on your time zone. For example:
An event recorded in SIEM at 10:00 UTC+0 will appear as:
- 05:00 UTC-5 (New York)
- 11:00 UTC+1 (Berlin)
- 15:30 UTC+5:30 (New Delhi)
- 19:00 UTC+9 (Tokyo)
Adjust the filter according to your local time to avoid discrepancies

# Getting support
If you encounter technical difficulties or have any questions about the Standoff Cyberrange, write to our [Telegram bot](https://t.me/stf_def_support_bot).

defend

Attack by the APT group Charming Kitten

An online simulator that offers a collection of real-life cases from the Standoff Cyberbattle

Standoff Cyberbones is an online simulator that offers a collection of real-life cases from the Standoff Cyberbattle.
You can investigate incidents at your own pace to better understand how to detect and respond to cyberthreats and apply this experience later at work.


# Getting started
1.	If you don't have an account yet, [register on the Standoff 365 Platform](https://auth.standoff365.com/en-US/account/registration/).
2.	Read the [step-by-step instructions](https://help.standoff365.com/en-US/8731134731/portal) on how to set up a connection to Standoff Cyberbones.
3.	Go to Workspace → [Access and resources](https://range.standoff365.com/battle/16/?section=report&tab=accessAndResources), and download a VPN config file.
❗️Each polygon has its own unique VPN configuration. For correct operation, it is necessary to download a separate configuration file for each polygon through this access page. If you try to use the configuration file of another polygon, the system will deny access.


# Completing tasks
You can find answers to all tasks in Positive Technologies security tools, which store logs and artifacts from the Standoff Cyberbattle.
If you don't have any experience with Positive Technologies products, read the following materials:
*	 [MaxPatrol SIEM Quick Start Guide](https://storage.ptsecurity.com/d/7629f49778f14d969b18/files/?p=%2FMP-SIEM.pdf)
*	 [PT NAD Quick Start Guide](https://storage.ptsecurity.com/d/7629f49778f14d969b18/files/?p=%2FPT-NAD.pdf)
*   [PT AF Quick Start Guide](https://storage.ptsecurity.com/d/7629f49778f14d969b18/files/?p=%2FPT_AF_3_.pdf/)
*   [Official Positive Technologies documents](https://help.ptsecurity.com/en-US/projects)

Please note:
• To connect to MaxPatrol SIEM, select the **LDAP** tab in the authorization window.
• For authorization in PT AF, use the **SSO** tab.
• The security tools contain logs and artifacts from the Standoff Cyberbattle that took place in November 2022. To display the data, use filters by period.
• Don't forget to turn on VPN to complete tasks and work with security tools.

# Getting support
If you encounter technical difficulties or have any questions about the Standoff Cyberbones, write to our [Telegram bot](https://t.me/stf_def_support_bot).

cyberbones

Standoff Cyberbones (free version)

Submit answers to the tasks below. The number of attempts is unlimited.

Trigger your first ever critical events and master your skills to become a top hacker

hackbase

Online cyberrange for beginners

Earn points by finding vulnerabilities in systems. Points are awarded separately for each system, and you can report only one vulnerability of each type per system.

Hack infrastructures and mix different attack vectors to establish yourself in the community and get to the top of the leaderboard

State F's leading companies from various industries are holding open house days at their facilities.
 
Take the chance to cause critical events from past Standoff cyberbattles, enhance your skills, and ultimately improve the security of State F. Each cyberrange segment features unique risk scenarios of varying complexity.

Hack infrastructures and mix different attack vectors to establish yourself in the community and get to the top of the leaderboard.

To access the cyberrange, set up a VPN connection following the instructions provided in the ["Access and resources"](https://range.standoff365.com/battle/5?section=report&tab=accessAndResources)