Blue Team Labs

Investigate a disk image to uncover a UAC bypass and process hollowing and trace the attack back to a compromised software repository.

Correlate memory, registry, and filesystem artifacts using Volatility 3, MemProcFS, and Timeline Explorer to reconstruct a multi-stage attack timeline and map attacker TTPs to MITRE ATT&CK.