Operation QUICSILVER is a blue team lab that falls under the Malware Analysis, Threat Intel categories and will cover the following subjects: Ghidra, Eric Zimmerman Tools, LECmd, PowerShell, Autopsy, Exiftool, HxD, VsCode, Google Search, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Stealth, Defense Impairment, Discovery, Collection, Command and Control, Exfiltration.
Investigate a targeted espionage intrusion from delivery through to command-and-control: unpack a disguised container, rebuild the payload hidden inside it, reverse the Go implant it drops, and turn the operator's leftovers into attribution.
Categories: Malware Analysis, Threat Intel.
MITRE ATT&CK Tactics: Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Stealth, Defense Impairment, Discovery, Collection, Command and Control, Exfiltration.
Tools: Ghidra, Eric Zimmerman Tools, LECmd, PowerShell, Autopsy, Exiftool, HxD, VsCode, Google Search.
Difficulty: medium.