Post IR Investigation - MoveIT Exploit - HTB Sherlocks - I Like To
00:00 - Introduction
01:10 - Going over the questions
03:50 - Examing the forensic acquisition files
07:10 - Dumping the SAM Database to get hashes of the local accounts
12:25 - Running MFTECmd to convert the MFT (Master File Table) Dump to a JSON and CSV
15:35 - Analyzing the IIS Access Log
22:30 - Showing the files the attacker accessed in the Access Log
27:00 - Grabbing the Moveit metasploit script since the useragent hinted at metasploit being ran
36:10 - Using Chainsaw to convert the Security event log to JSON and hunt for suspicious events
42:30 - Analyzing the MFT JSON Output to discover when a file was written to disk
52:10 - Looking at the Powershell Console History to get what commands were ran
55:27 - Analyzing the Moveit MYSQL Dump file by copying it into a MySQL Server
1:02:30 - Going over the chainsaw hunt on security event log
1:11:40 - Looking at and using some jq-fu to show specific data
1:21:50 - Looking at the strings from the memory d
5 views
611
174
2 months ago 02:13:38 1
Секретная операция Анадырь. Карибский кризис. Часть 2. RuRoomREC
2 months ago 00:24:25 1
Спидран НА ПРИМЕРЕ Undertale Геноцид | Разбор спидрана
2 months ago 00:14:05 1
I Went to EVERY Persona 3 Location IN REAL LIFE
2 months ago 00:03:44 1
SQWOZ BAB - ОЗЕРО В ЛЕСУ (Премьера клипа 2024)
2 months ago 00:38:36 1
Dla kogo pracuje Donald Trump?
2 months ago 00:02:32 1
JDFLAG - NE MOЯ STORИ+ТЕ БЕПИZDA (VИDEOKLИП 1024)🔺
2 months ago 00:02:47 1
【Undertale】Stronger Than You Response (ver. Frisk) - Animation
2 months ago 00:08:21 1
I Am Cyrus - Epic Iranian Music
2 months ago 00:04:33 1
Michael Hedges - Aerial Boundaries
2 months ago 00:02:08 1
YNG Martyr - 50k (Official Music Video)
3 months ago 00:08:01 52
Психея — . (Wой Wаленький Wир) / Фестиваль “Смысл“ / 28 июня 2024 / Нижний Новгород / Multicam
3 months ago 00:49:37 1
Ирина Нельсон (REFLEX) и Тюрин про Non Stop, ПОШЛУЮ МОЛЛИ, Алёну Торганову и MTV 00х (Интервью 2023)
3 months ago 00:04:00 1
Многоточие - Дыши [lyrics- RU/LT]
3 months ago 00:10:52 1
ANSIEDADE Como fazer a personagem do DIVERTIDA MENTE 2
3 months ago 08:40:00 1
IrEK-10 - La 10-a Irana Esperanto-Kongreso - 30-a de Aprilo
3 months ago 00:16:43 1
Визит Путина в КНДР; правые в правительстве ЮАР; антиваксерство от Пентагона
3 months ago 00:16:23 1
The Ultimate Metal Single Cut Guitar?! || Solar Demo/Review
3 months ago 02:08:27 1
Prochain Arrêt - A Chillsynth MIX
3 months ago 01:03:14 1
Григорий Юдин — Политическая теология плебисцитаризма
3 months ago 00:03:50 1
Haunt Me - La Noche Eterna | Post-Punk
3 months ago 00:06:32 1
Спокойная Ночь (ЦСКА 2021) - Полный Разбор
3 months ago 00:08:09 1
라키가 대만에서 청춘 드라마 찍고 온 썰 풉니다 I R-LOG
4 months ago 00:21:31 1
Greatest Hits Playlist 2024 - Best of
4 months ago 01:14:23 1
Post-NESARA: Jeremy Whaley and Dr. Scott Discuss IRS deletion & Biz Changes in America