ClickFix - VodkaStealer

ClickFix - VodkaStealer is a blue team lab that falls under the Threat Hunting category and will cover the following subjects: Splunk, FTK Imager, Registry Explorer, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Impact.

Learning Objectives

Synthesize forensic artifacts from event logs and disk images to reconstruct a multi-stage attack chain, detailing initial access, privilege escalation, lateral movement, and data exfiltration.

Categories: Threat Hunting.

MITRE ATT&CK Tactics: Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Impact.

Tools: Splunk, FTK Imager, Registry Explorer.

Difficulty: medium.