# From a Phishing Alert to DNS Exfiltration: TryHackMe SOC Simulator — Phishing Unfolding

> **Spoiler warning:** This write-up contains the full investigation, the reconstructed attack chain, and the final flag. All activity…