Famous Chollima

Famous Chollima is a blue team lab that falls under the Endpoint Forensics category and will cover the following subjects: Eric Zimmerman Tools, Event Log Explorer, FTK Imager, Registry Explorer, MFTECmd, Timeline Explorer, Persistence, Privilege Escalation, Defense Evasion, Discovery, Collection, Exfiltration.

Learning Objectives

Synthesize forensic artifacts and Python source code from a disk image to reconstruct a credential theft attack, identifying persistence methods and C2 communications.

Categories: Endpoint Forensics.

MITRE ATT&CK Tactics: Persistence, Privilege Escalation, Defense Evasion, Discovery, Collection, Exfiltration.

Tools: Eric Zimmerman Tools, Event Log Explorer, FTK Imager, Registry Explorer, MFTECmd, Timeline Explorer.

Difficulty: medium.