HawkEye is a blue team lab that falls under the Network Forensics category and will cover the following subjects: Wireshark, Brim, Apackets, MaxMind Geo IP, VirusTotal, Initial Access, Execution, Stealth, Credential Access, Discovery, Collection, Command and Control, Exfiltration.
Reconstruct a HawkEye Keylogger data exfiltration incident by analyzing network traffic with Wireshark and CyberChef, identifying IoCs and stolen credentials.
Categories: Network Forensics.
MITRE ATT&CK Tactics: Initial Access, Execution, Stealth, Credential Access, Discovery, Collection, Command and Control, Exfiltration.
Tools: Wireshark, Brim, Apackets, MaxMind Geo IP, VirusTotal.
Difficulty: medium.