Summary
Member-only story This room is designed to learn how to implement DFIR techniques to explore the Windows incident surface. Task 1 — Introduction In the everchanging cybersecurity landscape, one can not rely solely on a reactive approach of detection and responding to attacks. Instead, it is always a good idea to hunt for suspicious activity and analyze the results. To avoid going down rabbit holes and wasting precious time, this has to be done tactfully. The goal isn’t exhaustive analysis, rather efficient triage and actionable discovery. In this room, we will identify some of the artefacts that can give us a good ROI on such hunts. Task2 — Reliability of the System Tools Attackers can modify the environment variables to hijack the execution flow (ATT&CK ID: T1574.007). Before starting a live investigation, it is important to check for any signs of execution flow hijack. We will explore a few of these artefacts in this task. Powershell Pofiles A PowerShell profile is a script that executes every time PowerShell is executed. We can say that a PowerShell profile is to PowerShell, what a startup program is to Windows. Therefore, before even executing PowerShell, we should look for traces of compromise in the PowerShell profile. Q1. What tool did the adversary use to delete the logs? Here, we will simply go to the powershell directory for analyzing the powershell profiles.