Account & Privilege Change Detection

Identify suspicious local account or sudoers changes on a synthetic host and plan containment.

This room unlocks when you enrol in a linked course or have a matching Learn plan. No separate lab checkout — practice stays inside the track.