Famous Chollima

Famous Chollima is a blue team lab that falls under the Endpoint Forensics category and will cover the following subjects: Eric Zimmerman Tools, Event Log Explorer, FTK Imager, Registry Explorer, MFTECmd, Timeline Explorer, Persistence, Privilege Escalation, Stealth, Discovery, Collection, Exfiltration.

Learning Objectives

Synthesize forensic artifacts and Python source code from a disk image to reconstruct a credential theft attack, identifying persistence methods and C2 communications.

Categories: Endpoint Forensics.

MITRE ATT&CK Tactics: Persistence, Privilege Escalation, Stealth, Discovery, Collection, Exfiltration.

Tools: Eric Zimmerman Tools, Event Log Explorer, FTK Imager, Registry Explorer, MFTECmd, Timeline Explorer.

Difficulty: medium.