MiniFast - UNC1549

MiniFast - UNC1549 is a blue team lab that falls under the Network Forensics category and will cover the following subjects: tshark, CyberChef, FLOSS/Strings, Wireshark, Resource Development, Initial Access, Stealth, Discovery, Collection, Command and Control, Exfiltration, Impact.

Learning Objectives

An aviation contractor's developer installed a database tool from the top search result. Reconstruct the full intrusion from a single capture, from the lure domain through the implant's tasking to the second stage pulled down in cleartext.

Categories: Network Forensics.

MITRE ATT&CK Tactics: Resource Development, Initial Access, Stealth, Discovery, Collection, Command and Control, Exfiltration, Impact.

Tools: tshark, CyberChef, FLOSS/Strings, Wireshark.

Difficulty: medium.