SOC_as_a_Service
Forensics
No technique tags yet.
Recently, our SOC experienced unusual inbound and outbound connections. We suspect that one of our analysts might have made a significant mistake. After conducting an investigation, we discovered that an analyst received an email. He told us he started investigating the email as a normal day and a normal ticket, but after it, some malicious activity occurred. Could you assist us in investigating what went wrong and identify our analyst's mistake?
Flag format: PWNSEC{SHA1HashOfMaliciousFileDelievered_MitreidForDeliveryOfTheMaliciousFile_MitreForPersistence_C2ip_C2port}
Ex: PWNSEC{HASH_T1337.002_T1337.003_0.0.0.0_5555}
CMDJO_QAIS
Writeups
Official
No official writeup linked.
Community
No community writeups yet. Solved it? Share how.
Log in to add a community writeup.