Incident Response Investigation - CIRCUS 2026 National Finals

Investigated a simulated ransomware attack affecting an amusement park's enterprise IT and operational technology systems during the Collegiate Incident Response Competition. Analyzed Windows Event Logs, PowerShell logs, filesystem timelines, and memory artifacts using Volatility to reconstruct attacker activity across six hosts.

Correlated authentication events, scheduled tasks, and service creation to trace credential compromise, privilege escalation, lateral movement involving Impacket/PsExec, and ransomware deployment. Identified compromised accounts, affected systems, and indicators of compromise, and linked the attack timeline to disruptions in the park's ride-control systems.

Produced a forensic investigation report with containment, recovery, and hardening recommendations, then presented and defended our findings in person before a panel of judges at the national finals. Our team placed third nationally.