Explore Adventures in the Underland: Forensic Techniques against Hackers
summary
Claims that live memory dumps yield recoverable evidence including in-memory evtx logs and that a custom reverse shell can be traced to system through Prefetch and disk artefacts. Uses Volatility to enumerate svchost handles, CQEVTX Recovery to repair 17 evtx records (six months of reverse engineering), smbrelayx.py plus a CQShell104a.exe payload delivered via SMB relay and Metasploit, and PowerForensics/Invoke-ForensicDD to carve deleted executables and confirm signatures.
AI-written summary · about
chapters (4)
- 0:00Start
- 4:26Extract Files from the Memory Dump
- 13:13Symbol Attack
- 31:28Write a Good Incident Response Plan
related talks
53mForensics Skillset: Techniques for Extraction and Analysis of the Evidence
52mAdventures in Underland: Hacker Tricks to Stay Under the...
54mAdventures in the Underland: The CQForensic Toolkit as a Unique Weapon Against Hackers
53mForensic Investigations of Web Exploitations
01h 00mIntroduction to memory exploitation
47mCunning With CNG: Soliciting Secrets From Schannel
01h 06mHow hacking works
01h 03mInvestigating Malware Using Memory Forensics - A Practical Approach