Throughout the Initial Access and Execution module, we've followed an attacker's path from the front door to full execution. Each technique, logging in with valid credentials, dropping malicious executables, executing PowerShell, and living off the land with trusted binaries, was built to blend in, evade detection, and buy the attacker time. Signature and behavior-based scanners let us catch these techniques as they happen. In this room, we introduce live detection, using LOKI and THOR to scan a system in real time, catching malicious files, suspicious processes, and live connections while an attacker is still active and without interrupting critical services.

Learning Objectives

• Explore live detection and how it differs from offline or dead-box forensics
• Understand signature-based scanning fundamentals using YARA rules
• Use LOKI to scan a live system and investigate suspicious files and processes
• Use THOR Lite to investigate executables, scripts, running processes, and persistence artifacts
• Compare LOKI and THOR to determine which tool best fits your engagement

Prerequisites

Some familiarity with the execution methods covered previously in the module will prove to be useful during the walkthrough:

• Check out Investigating Executables Evidence for the forensic trail malicious executables leave behind