Phantom Installer

Phantom Installer is a blue team lab that falls under the Endpoint Forensics category and will cover the following subjects: DB Browser for SQLite, FTK Imager, VirusTotal, MFTECmd, Timeline Explorer, PECmd, dnSpy, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Stealth, Defense Impairment, Impact.

Learning Objectives

One installer looked just like the rest. By the time the damage was done, there was almost nothing left to investigate. Almost.

Categories: Endpoint Forensics.

MITRE ATT&CK Tactics: Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Stealth, Defense Impairment, Impact.

Tools: DB Browser for SQLite, FTK Imager, VirusTotal, MFTECmd, Timeline Explorer, PECmd, dnSpy.

Difficulty: easy.