Free
Challenge: Back to the Cereal
This challenge will have you analyze a $MFT Windows artifact to identify unauthorized activity. The goal is to see from a blue teamer's point of view the actions an unauthorized user may take on a victim's system when an attacker wants to hide their activity.
1
H
0
M
Time
beginner
difficulty
1
ceu/cpe
Course Content
The Importance of Timestomp Activity
Investigate
Course Description
Blue Team POV: System Analysis
> In this challenge, you will analyze a compromised system $MFT file related to attacks targeting NTFS timestamps. This challenge aims to showcase the importance of the $MFT file in a forensics investigation and the importance of timestamps to distinguish abnormal vs. normal activity.
Who is this for:
>Early career to mid practitioners. This challenge may be difficult for individuals new to cybersecurity, but the difficulty rating on this challenge is relatively low. We encourage using any internet resources and community/colleague assistance in completing the challenge.Are write-ups permitted?
>Yes, write-ups are permitted; please do not post answers directly. All write-ups should include a link to Cybrary and the Cybrary Course.What resources are available to help solve this challenge?:
>Online search, community, colleagues, or fellow practitioners.Instructed by
Instructor
Marc Balingit
Marc has led, managed, and performed global incident response investigations focused on large-scale data breaches, system compromises, data exfiltration, ransomware, and malware outbreaks. He has worn many hats throughout his Incident Response career, including proactive and reactive services. Outside Blue Teaming, Marc is passionate about Vulnerability Research and Malware Analysis. He is a Technical SME at Cybrary, focusing on Threat Actors and Blue Teaming for course content.
Provider
Certificate of Completion
