Background — DFIR folks utilized Browsing History in lots of investigations and Hunting activities, we always look for such data in traditional Browsers like Chrome, Firefox, IE, etc. Today I have a different data source for such data, that can be utilized to collect Browsing history. Story while trying to build a python…

Protection will eventually fail. We need visibility, Monitoring, and Detection!!! — In October 2022, I attended the “SEC530: Defensible Security Architecture and Engineering” and We were having a great discussion about how to architect for visibility, detection, and Response. You may have heard that “Protection will eventually fail” and because it will inevitably happen we need to have visibility around it.

SPOILER ALERT: THIS IS A POSSIBLE SOLUTION TO THE CHALLENGE Scenario You belong to a company specializing in hosting web applications through KVM-based Virtual Machines. Over the weekend, one VM went down, and the site administrators fear this might be the result of malicious activity. …

SPOILER ALERT — A possible Solution to the Challenge Scenario Here is the challenge A Linux server was possibly compromised and a forensic analysis is required in order to understand what really happened. Hard disk dumps and memory snapshots of the machine are provided in order to solve the challenge. victoria-v8.sda1.img…

SPOILER ALERT: THIS IS A POSSIBLE SOLUTION Scenario You have been called to analyze a compromised Linux web server. Figure out how the threat actor gained access, what modifications were applied to the system, and what persistent techniques were utilized. (e.g. backdoors, users, sessions, etc). We are given an E01 Disk…

SPOILER ALERT: POSSIBLE SOLUTION Scenario: After Karen started working for ‘TAAUSAI,’ she began to do some illegal activities inside the company. ‘TAAUSAI’ hired you to kick off an investigation on this case. You acquired a disk image and found that Karen uses Linux OS on her machine. …

SPOILER ALERT: THIS IS A POSSIBLE SOLUTION Scenario The enterprise EDR alerted for possible exfiltration attempts originating from a developer RedHat Linux machine. A fellow SOC member captured a disk image for the suspected machine and sent it for you to analyze and identify the attacker’s footprints. https://cyberdefenders.org/blueteam-ctf-challenges/77 Artifacts Details E01 Image SHA1…

SPOILER ALERT: THIS IS A SOLUTION TO THE CHALLENGE — My objective is to show how I solved the challenge and not the answers themselves. Intro Will be diving into Linux and Application forensics like Firefox, discord, and Minecraft. In this challenge I have used the following tools. Autopsy Command-Line Tools (ewfmount, mmls, mount) Arsenal Image Mounter Scripting with Python Challenge Questions What…

SPOILER ALERT: THIS IS A SOLUTION TO THE CHALLENGE — Objectives I’m writing this walkthrough to share how JQ could help investigate this especially after finishing the challenge i checked the write-ups and non of them used JQ capabilities. Scenario Welcome, Defender! As an incident responder, We’re granting you access to the AWS account called “Security” as an IAM user. This account…