DeadDrop - Hollow

DeadDrop - Hollow is a blue team lab that falls under the Threat Hunting category and will cover the following subjects: Eric Zimmerman Tools, HindSight, Sysinternals Suite, RegRipper, hayabusa, Registry Explorer, MFTECmd, Timeline Explorer, EvtxECmd, MemProcFS, AmcacheParser, PECmd, Splunk, DB Browser for SQLite, Initial Access, Execution, Persistence, Privilege Escalation, Stealth, Defense Impairment, Credential Access, Lateral Movement, Command and Control, Exfiltration.

Learning Objectives

Investigate a hybrid cloud + on-prem intrusion using Splunk, triage disk and memory images across three hosts: trace a phished finance workstation through DLL side-loading, Kerberoasting and in-memory shellcode, follow lateral movement over WinRM to a Domain-Controller-impersonating AD CS certificate, and uncover a covert Microsoft Graph calendar dead-drop C2 that leaves no network signature.

Categories: Threat Hunting.

MITRE ATT&CK Tactics: Initial Access, Execution, Persistence, Privilege Escalation, Stealth, Defense Impairment, Credential Access, Lateral Movement, Command and Control, Exfiltration.

Tools: Eric Zimmerman Tools, HindSight, Sysinternals Suite, RegRipper, hayabusa, Registry Explorer, MFTECmd, Timeline Explorer, EvtxECmd, MemProcFS, AmcacheParser, PECmd, Splunk, DB Browser for SQLite.

Difficulty: hard.