cyberdefenders | AccidentalRebel.com

Cyber Corp Case 2 Writeup - Part 3

Sat 06 November 2021 • Threat Hunting

CyberCorp Case 2 part 3 — certutil download, LSASS dumping, WMI lateral movement to a domain controller, and tracking the second reverse shell C2 address.

Cyber Corp Case 2 Writeup - Part 2

Wed 03 November 2021 • Threat Hunting

CyberCorp Case 2 part 2 — decoding a base64 gzipped registry payload, tracing PID spoofing in PowerShell, and identifying the reverse shell C2 IP.

Cyber Corp Case 2 Writeup - Part 1

Sat 30 October 2021 • Threat Hunting

CyberCorp Case 2 threat hunting walkthrough — tracking WMI persistence, a malicious Word document, and a hidden iexproxy.dll download technique in Kibana.