Gaining a foothold is only the beginning. Once an attacker has access to a target system, they must pivot to the execution phase, where they attempt to run their tools while blending in with legitimate system traffic. Whether they use common utilities, exploit trusted binaries, or execute their own uploaded tools, the goal is to remain undetectable. In this room, we will examine the forensic trail left by malicious executables.

Learning Objectives

• Examine why attackers use malicious executables
• Identify key indicators of malicious executable activity
• Identify malicious executable execution within event logs
• Evaluate forensic artifacts to detect the use of malicious executables
• Explore containment, prevention, and mitigation strategies

Prerequisites

Some familiarity with Windows Event Logs and Sysmon is recommended for this walkthrough. A solid understanding of Windows forensic techniques and artifacts will also be beneficial.

• Check out Windows Event Logs for an overview of important event IDs
• Go over Sysmon to learn about event IDs and key fields related to process execution
• Cover Expediting Registry Analysis to learn about Windows registry acquisition and analysis

Machine Access

Click the Start Machine button below. The machine will start in Split-Screen mode. Once you gain access, all necessary tools and files will be available on the machine's desktop.

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting the Lab Machine, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.

Lab machine

Status:Off

Start Lab Machine

If you prefer to connect using your own VPN-connected machine, please use the credentials below to RDP in: