Crossed Signals

Crossed Signals is a blue team lab that falls under the Endpoint Forensics category and will cover the following subjects: RegRipper, DB Browser for SQLCipher, DB Browser for SQLite, VirusTotal, mimikatz, MFTECmd, Timeline Explorer, JLECmd, hayabusa, Initial Access, Persistence, Privilege Escalation, Stealth, Discovery, Collection, Command and Control.

Learning Objectives

A routine security audit. A trusted messaging app. By the time the victim realized something was wrong, the damage was already done. Can you trace what happened?

Categories: Endpoint Forensics.

MITRE ATT&CK Tactics: Initial Access, Persistence, Privilege Escalation, Stealth, Discovery, Collection, Command and Control.

Tools: RegRipper, DB Browser for SQLCipher, DB Browser for SQLite, VirusTotal, mimikatz, MFTECmd, Timeline Explorer, JLECmd, hayabusa.

Difficulty: medium.