TOCTOU - OilRig Lab

Correlate memory, registry, and filesystem artifacts using Volatility 3, MemProcFS, and Timeline Explorer to reconstruct a multi-stage attack timeline and map attacker TTPs to MITRE ATT&CK.

Category:

Endpoint Forensics

Tactics:

Execution Persistence Privilege Escalation Stealth

Tools:

MemProcFS Volatility 3 Strings VirusTotal Timeline Explorer

hard

Walkthrough Available

3hrs

Sign in to Download Lab Files

Unlock Your Full Learning Experience with CyberRange Labs

Sign up to track your progress, unlock exclusive labs, and showcase your achievements—begin your journey now!