GhostDetect

GhostDetect is a blue team lab that falls under the Malware Analysis category and will cover the following subjects: CyberChef, Wireshark, ProcMon, Strings, VS Code, LECmd, Initial Access, Execution, Impact.

Learning Objectives

Investigate a multi-stage phishing attack by analyzing LNK files, de-obfuscating scripts, identifying C2, decrypting payloads, and attributing the TTPs to the UAC-0057 APT group.

Categories: Malware Analysis.

MITRE ATT&CK Tactics: Initial Access, Execution, Impact.

Tools: CyberChef, Wireshark, Strings, VS Code, LECmd, ProcMon.

Difficulty: hard.