In this video walkthrough, we covered a threat hunting challenge that involved hunting Windows event logs exported from a compromised machine due to recent phishing email. The hunt started with finding the initial attachment that was downloaded using Outlook and later on extracted. The extracted files contained a payment invoice in PDF that when opened spawned a powershell process that downloaded a reverse shell and connected to the attacker C2 server where further commands were launched to enumerate the system and finally to exfilterate data from a file server using Nslookup tool.
****
Receive Cyber Security Field, Certifications Notes and Special Training Videos
/ @motasemhamdan
******
Writeup
motasem-notes....
TryHackMe Hunt Me I: Payment Collectors
tryhackme.com/...
********
Google Profile
maps.app.goo.g...
LinkedIn
[1]: / motasem-hamdan-7673289b
[2]: / motasem-eldad-ha-bb424...
Instagram
/ motasem.hamdan.official
Twitter
/ manmotasem
Facebook
/ motasemhamdantty
Негізгі бет Threat Hunting Case Study | The Strange Invoice | TryHackMe Hunt Me 1: Payment Collectors
No video
Пікірлер: 1