Course curriculum

    1. Introduction

    2. Download Cyber Triage

    3. Download Case Files

    4. Installing Cyber Triage & Loading the Case File

    5. Issues / Problems

    1. What file is used to download and run malware on RAGINGBULL?

    2. What is the IP that the dropper was downloaded from?

    3. What file contained the dropper?

    4. Which user downloaded the file?

    1. What program was used to access the SAM on RAGINGBULL?

    2. What programs were used to map the network?

    3. How was Windows Defender disabled?

    4. What was the zip file on RAGINGBULL the TA had their tools in?

    5. What account was used to connect to TATSU?

    6. What accounts were compromised\used by the threat actor?

    7. What account was used for an interactive remote logon on the domain controller?

    8. What host was the Richmond account used from to access the domain controller?

    9. What hosts was psexec used against?

    1. What is the name of the C2 implant?

    2. What user installed it?

    3. What persistance method is used?

    1. What was the folder used for aggregation on RAGINGBULL?

    2. When was supersecret-productplans.docx copied to the threat actors aggregation folder?

    3. What tool was used for exfiltration on REYNHOLM-DC01?

    4. What is the name of the file that was copied off REYNHOLM-DC01 by the threat actor?

    5. What folders are most likely to have been inside the file exfiltrated from REYNHOLM-DC01?

    6. What accounts were unsuccessfully used to try and access the fileserver, during the incident??

    7. What account was the threat actor able to use to download files from the fileserver to REYNHOLM-DC01?

    1. What system would you want to look at next?

About this course

  • Free
  • 31 lessons
  • 1 hour of video content