Voldemort - APT41

Voldemort - APT41 is a blue team lab that falls under the Threat Hunting category and will cover the following subjects: Splunk, Strings, Web Cache View, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Discovery, Exfiltration.

Learning Objectives

Synthesize disparate forensic artifacts across email, network, and host logs to reconstruct a multi-stage phishing, malware, and C2 attack, attributing it to a known campaign.

Categories: Threat Hunting.

MITRE ATT&CK Tactics: Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Discovery, Exfiltration.

Tools: Splunk, Strings, Web Cache View.

Difficulty: hard.