Logless Hunt

In this room, as a DFIR team member, you were tasked with supporting a medium-sized company in its efforts to investigate and recover from a cyberattack in which threat actors cleared Windows Security logs and hoped to remain undetected.

The room is intended for DFIR team members and SOC L2/L3 analysts who want to be better prepared during scenarios in which a cyberattack does not leave any obvious traces but still must be investigated using built-in tools and artifacts.

Learning Objectives

• Get acquainted with different Windows logs, some even more helpful than Security logs
• Investigate a realistic attack scenario, from web exploitation up to credential access

Prerequisites

Before moving on, it is recommended to be familiar with Windows OS, its logging capabilities and common attack techniques. Great rooms to start with:

• Log Analysis Module
• Windows Event Logs