RevengeHotels APT

RevengeHotels APT is a blue team lab that falls under the Endpoint Forensics category and will cover the following subjects: CyberChef, dnSpy, DB Browser for SQLite, Windows Event Viewer, Initial Access, Execution, Persistence, Privilege Escalation, Stealth, Defense Impairment, Credential Access, Collection, Command and Control, Exfiltration, Impact.

Learning Objectives

Reconstruct multi-stage APT attack chain by correlating email, browser, Sysmon logs, and registry artifacts to identify persistence mechanisms and data exfiltration techniques.

Categories: Endpoint Forensics.

MITRE ATT&CK Tactics: Initial Access, Execution, Persistence, Privilege Escalation, Stealth, Defense Impairment, Credential Access, Collection, Command and Control, Exfiltration, Impact.

Tools: CyberChef, dnSpy, DB Browser for SQLite, Windows Event Viewer.

Difficulty: easy.