Categoría: DFIR

Cyberdefenders – Reveal Blue Team Lab writeup

rokitoh Deja un comentario

Instructions:

  • Uncompress the lab (pass: cyberdefenders.org)

Scenario:

As a cybersecurity analyst for a leading financial institution, an alert from your SIEM solution has flagged unusual activity on an internal workstation. Given the sensitive financial data at risk, immediate action is required to prevent potential breaches.

Your task is to delve into the provided memory dump from the compromised system. You need to identify basic Indicators of Compromise (IOCs) and determine the extent of the intrusion. Investigate the malicious commands or files executed in the environment, and report your findings in detail to aid in remediation and enhance future defenses.

Tools:

Leer más

Cyberdefenders – Ramnit Blue Team Lab writeup

rokitoh Deja un comentario

Instructions:

  • Uncompress the lab (pass: cyberdefenders.org)

Scenario:

Our intrusion detection system has alerted us to suspicious behavior on a workstation, pointing to a likely malware intrusion. A memory dump of this system has been taken for analysis. Your task is to analyze this dump, trace the malware’s actions, and report key findings. This analysis is critical in understanding the breach and preventing further compromise.

Tools:

  • Volatility 3
Leer más

Cyberdefenders – RedLine Blue Team Lab writeup

rokitoh Deja un comentario

Scenario:

As a member of the Security Blue team, your assignment is to analyze a memory dump using Redline and Volatility tools. Your goal is to trace the steps taken by the attacker on the compromised machine and determine how they managed to bypass the Network Intrusion Detection System «NIDS». Your investigation will involve identifying the specific malware family employed in the attack, along with its characteristics. Additionally, your task is to identify and mitigate any traces or footprints left by the attacker.

Tools:

Leer más