Browser LabLD-DFIR-LAB-001Medium
Browser LabLD-DFIR-LAB-001Medium30 min
The Vanished Executable
A suspicious tool was reported on Wadi Logistics workstation WD-OPS-04, but the file is no longer on disk. You have a Prefetch parse, an Amcache excerpt and the account's browser/shell history. Establish what ran, when, its identity, and where it came from — and claim only what each artifact supports.
What you will be able to do
- Prove execution of a deleted binary from its artifacts.
- Recover the binary's identity (hash) after deletion.
- Establish provenance from history artifacts.
Windows SecurityLog AnalysisIOC AnalysisT1204 — User ExecutionT1567.002 — Exfiltration to Cloud Storage
Sign in to start this lab.
Sign in