Category: Threat Hunting

Cyber Corp Case 2 Writeup - Part 3

CyberCorp Case 2 part 3 — certutil download, LSASS dumping, WMI lateral movement to a domain controller, and tracking the second reverse shell C2 address.

threat-hunting cyberdefenders

Cyber Corp Case 2 Writeup - Part 2

CyberCorp Case 2 part 2 — decoding a base64 gzipped registry payload, tracing PID spoofing in PowerShell, and identifying the reverse shell C2 IP.

threat-hunting cyberdefenders

Cyber Corp Case 2 Writeup - Part 1

CyberCorp Case 2 threat hunting walkthrough — tracking WMI persistence, a malicious Word document, and a hidden iexproxy.dll download technique in Kibana.

threat-hunting cyberdefenders