SpottedInTheWild

SpottedInTheWild is a blue team lab that falls under the Endpoint Forensics category and will cover the following subjects: Arsenal Image Mounter, SQLite Viewer, Eric Zimmerman Tools, NTFS Log Tracker, Registry Explorer, Event Log Explorer, Strings, CyberChef.

Learning Objectives

Reconstruct an attack timeline by analyzing disk images, event logs, and malicious scripts to identify initial access, persistence, and data exfiltration techniques.

Categories: Endpoint Forensics.

Tools: Arsenal Image Mounter, SQLite Viewer, Eric Zimmerman Tools, NTFS Log Tracker, Registry Explorer, Event Log Explorer, Strings, CyberChef.

Difficulty: hard.