Post-Incident Activity (TryHackMe)
Link to the challenge on TryHackMe: Post-Incident Activity Introduction Post-Incident Activity closes out the Nexus Financial BEC investigation series, shifting from "what happened during the incident
#dfir
Posts tagged #dfir
Response and Recovery (TryHackMe)
Link to the challenge on TryHackMe: Response and Recovery Introduction Response and Recovery picks up where Detection and Analysis left off: the investigation into the compromised l.chen@nexusfinancia
AI Forensics (TryHackMe)
Introduction The world of Digital Forensics is full of pieces needing to be connected, often under a time constraint. This can be a challenging task, but one that many forensics analysts have accompli
Have a Break (TryHackMe)
Investigation is a TryHackMe challenge inspired by a real cargo theft incident, set in a fictional ECTA (European Cargo Threat Assessment) framework. The scenario involves a missing refrigerated truck
Shadow Trace
It’s the graveyard shift, and you’re the lone analyst in the SOC when an urgent call comes in: a user’s machine dropped a suspicious binary named windows-update.exe. At first glance, it masquerades as a routine updater, but alerts from the EDR and od...
DFIR: An Introduction (TryHackMe)
In this article, I will write a write-up for DFIR: An Introduction that covers the need for DFIR, Basic concepts of DFIR, DFIR Tools like KAPE, Autopsy and Redline, and the Incident Response Process. The need for DFIR What is DFIR? As already mention...
