AfricanFalls

AfricanFalls is a blue team lab that falls under the Endpoint Forensics category and will cover the following subjects: FTK Imager, Autopsy, rifiuti2, Browsing History View, WinPrefetchView, ShellBagsExplorer, mimikatz, Metdata Extractor, Online Hash Crack, NTLM Hash, Collection.

Learning Objectives

Reconstruct a suspect's digital activities and intent by analyzing browser history, system artifacts, deleted files, and credentials from a disk image using various forensic tools.

Categories: Endpoint Forensics.

MITRE ATT&CK Tactics: Collection.

Tools: FTK Imager, Autopsy, rifiuti2, Browsing History View, WinPrefetchView, ShellBagsExplorer, mimikatz, Metdata Extractor, Online Hash Crack, NTLM Hash.

Difficulty: medium.