DFIR_1_Malvent

forensics dfir slsanna

We have been notified of an attack in one of our machines. This is a real forensics investigation and you have to analyse the given evtx files and answer to the related questions. At the end you will get the flag when you answer everything correct.

Dfir 1 - Question 4: you have to find all the numbers separated by a comma related to insecure credential management (e.g., 1000, 2355, etc)

NOTE: This is a real malware. Do not execute nothing. Pay attention and be careful. Srdnlen denies every damage on your infrastructure.