👁️ The Foothold
You have initial access on an engagement and need to reach Domain Admin. Trade stealth against speed — go loud and the SOC catches you, go quiet and you might just ghost them.
Whose job is this?
This incident lands on these classes' desks. Their guides carry the certifications, tools and labs that make the calls you just made feel routine.
- Penetration TesterveteranRogue → Penetration Tester
- Malware Analyst / Reverse EngineerveteranMonk → Malware Analyst
Not sure which one is you? Roll a character.