DFIR - Infection with Cobalt Strike

In this DFIR exercise on Lets Defend, we are supplied an PCAP file to analyze and 11 questions to answer! Per the description, "We got network traffic from password stealer. You should do root cause analysis." https://packettotal.com/app/analysis?id=3f528a55175df8f7003e49ba7fc780a8&name=conn https://www.virustotal.com/gui/file/0b22278ddb598d63f07eb983bcf307e0852cd3005c5bc15d4a4f26455562c8ec/detection https://www.virustotal.com/gui/file/94e60de577c84625da69f785ffe7e24c889bfa6923dc7b017c21e8a313e4e8e1/detection https://inquest.net/blog/2021/04/16/unearthing-hancitor-infrastructure https://www.huntress.com/blog/cobalt-strike-analysis-of-obfuscated-malware

Видео DFIR - Infection with Cobalt Strike автора CentOS Magician