DeepDive

DeepDive is a blue team lab that falls under the Endpoint Forensics category and will cover the following subjects: Volatility 2, Execution, Privilege Escalation, Stealth.

Learning Objectives

Analyze a memory dump with Volatility to uncover hidden Emotet malware, investigate its code injection, and reconstruct kernel-level evasion tactics like DKOM.

Categories: Endpoint Forensics.

MITRE ATT&CK Tactics: Execution, Privilege Escalation, Stealth.

Tools: Volatility 2.

Difficulty: hard.