Adventures in Underland: Hacker Tricks to Stay Under the...
summary
Provides step‑by‑step post‑compromise forensic workflows: capture memory first then disk, scan for RWX memory regions and hidden processes via ActiveProcessLinks, and use Volatility plus iweta4 to recover fragmented Windows Event Log entries. Shows an SMB relay → Meterpreter escalation and how exporting a domain certificate combined with setracker2‑style tools can decrypt user master keys to recover KeePass and other secret blobs, with tools and reproducible commands provided.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 4:10Post-attack analysis rules
- 9:33Extracting data from memory
- 22:20Relay attack detection
- 30:23Network connections and Prefetch files
- 37:06File metadata manipulation
- 41:01User private data protection
- 45:16KeePass access with domain key
- 50:39Summary and downloadable tools
related talks
32mExplore Adventures in the Underland: Forensic Techniques against Hackers
53mForensics Skillset: Techniques for Extraction and Analysis of the Evidence
54mAdventures in the Underland: The CQForensic Toolkit as a Unique Weapon Against Hackers
51mHacker’s Perspective on Your Infrastructure: Lessons from the Field
38mClose Encounters of the Advanced Persistent Kind: Leveraging Rootkits for Post-Exploitation
01h 06mHow hacking works
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
40mHacker’s Paradise: Top 10 Biggest Threats When Working From Home