Introduction

What?

TryHackMe challenges.

Why?

Practicing.

How?

• A Windows server

• Organisation X desktop

• Standard Collector Analysis (Redline)

• IOC Search Collector (Redline)

• IOC Search Collector Analysis (Redline)

• Endpoint investigation (Redline)

• Leaking private company data (again) (Autopsy)

• Windows 10 disk image (Autopsy)

• Acceptable Use Policy violation (KAPE)

• BOB! THIS ISN’T A HORSE! (Volatility)

• That Kind of Hurt my Feelings (Volatility)

• Hunt for a nightmare (Volatility)

• Android malware analysis (Pithus and jadx)

• iOS forensics (SQLiteDB)