Rhadamanthys

Rhadamanthys is a blue team lab that falls under the Endpoint Forensics category and will cover the following subjects: Event Log Explorer, CyberChef, Timeline Explorer, Eric Zimmerman Tools, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Command and Control.

Learning Objectives

Hunt mail caches, MFT records, and Prefetch to unmask the initial dropper and rebuild the attack timeline.

Categories: Endpoint Forensics.

MITRE ATT&CK Tactics: Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Command and Control.

Tools: Event Log Explorer, CyberChef, Timeline Explorer, Eric Zimmerman Tools.

Difficulty: medium.