CorporateSecrets is a blue team lab that falls under the Endpoint Forensics category and will cover the following subjects: FTK Imager, Registry Explorer, RegRipper, HxD, DB Browser for SQLite, HindSight, Event Log Explorer, MFTDump, Execution, Stealth, Credential Access, Discovery, Collection.
Evaluate a Windows disk image by correlating registry, event log, browser, and MFT artifacts to reconstruct evidence of corporate secret exfiltration.
Categories: Endpoint Forensics.
MITRE ATT&CK Tactics: Execution, Stealth, Credential Access, Discovery, Collection.
Tools: FTK Imager, Registry Explorer, RegRipper, HxD, DB Browser for SQLite, HindSight, Event Log Explorer, MFTDump.
Difficulty: medium.