Memory Liar
A critical workstation on the financial management subnet was suspected of being compromised by an advanced persistent threat (APT). Our tier-1 triage team collected a physical memory capture and ran an automated process audit.
The automated audit reported everything clean: all running processes appear ordinary, can you retrieve the flag?
Writeups
Official
No official writeup linked.
Community
No community writeups yet. Solved it? Share how.
Log in to add a community writeup.