Job Trap - OilRig

Job Trap - OilRig is a blue team lab that falls under the Endpoint Forensics category and will cover the following subjects: CyberChef, DB Browser for SQLite, Windows Event Viewer, olevba, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Collection.

Learning Objectives

Analyze PowerShell and Sysmon logs to investigate macro-based malware, identify persistence via scheduled tasks, and extract C2 indicators and keylogger behavior using FTK Imager and olevba.

Categories: Endpoint Forensics.

MITRE ATT&CK Tactics: Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Collection.

Tools: CyberChef, DB Browser for SQLite, Windows Event Viewer, olevba.

Difficulty: medium.