Incident Response Training, Live Forensics of Compromised Website
With the continuation of my Incident Response Training Series, today I will be covering a Live Forensics for a Compromised Website running on Linux. So, this Episode is another Video for my Linux Forensics Series as well.
Also, I am giving away a couple of VIP Coupons for Let's Defend Lab and Blue Team Lab Online. So watch the episode to participate and grab your chance!!
This incident started when a eCommerce Website www.ella.com (Name changed) has been compromised and taken down by the hackers! The business was completely down as the website was the Web Portal for the company's shopping site. So, in this episode I will share you each and every step that I performed to find out what/how/when. This is a Live Incident Response and Forensics episode where we will go deeper in Linux. In this Episode,
👉 I will show you what got changed in the server to make the actual website unreachable and flashing a bizarre Message
👉 I will decode the full obfuscated code and identify the IOCs
👉 Analyze logs to identify how the attacker get into the server
👉 Will run a Self Made Tool (Power Forensics) to capture volatile data from the server. I will make the tool open-source once I complete the full project! So stay tuned for next Episodes
👉 Analyse the volatile data to identify more traces of Attacker
So it's a full detailed analysis of real SOC Incident and has in depth analysis. If you want to become a SOC analyst, want to work on real cyber incidents, if you are a absolute beginner or a experienced professional; each one of you should have something in this episode, in terms of learning and also get a opportunity to earn the Forensics Certification Examination voucher!! So, watch the full episode and ROCK in SOC!!
Tools I have used in this Episode-
👉 CyberChef
👉 Volatility Memory Forensics
👉 Power Forensics
👉 SIFT Workstation
👉 ClamAV
Related Episodes-
🔗 Linux Forensics Intro- • Linux Memory Capture and Analysis - V...
🔗 Similar Sev0 Incident- • Incident Response Training, Full Anal...
🔗 Learning Yara- • How to Create Yara || Learn from Scra...
🔗 Intro to Memory Forensics- • Introduction to Memory Forensics & GI...
🔗 Detailed Memory Forensics- • The Next Big Event You Need to Prepar...
🔗 Malware Analysis Lab Creation- • Creation of Malware Analysis and Digi...
🔗 Malware Analysis for beginners- • Malware Analysis Bootcamp - Introduct...
WATCH BELOW Playlists as well, if you want to make your career in DFIR and Security Operations!!
-------------------------------------------------------------------------------------------------------------------------
INCIDENT RESPONSE TRAINING Full Course 👉 • BlackPerl DFIR || INCIDENT RESPONSE ...
DFIR Free Tools and Techniques 👉 • BlackPerl DFIR || DFIR Tools and Tech...
Windows and Memory Forensics 👉 • BlackPerl DFIR || Windows and Memory ...
Malware Analysis 👉 • BlackPerl DFIR || Malware Analysis Se...
SIEM Tutorial 👉 • BlackPerl DFIR || Learn SIEM with me ...
Threat Hunt & Threat Intelligence 👉 • BlackPerl DFIR || Threat Hunt & Threa...
⌚
Timelines
-------------------------------------------------------------------------------------------------------------------------
0:00 ⏩ Pretty sketchy stuff!
2:04 ⏩ Background
5:06 ⏩ What has happened
6:47 ⏩ Login to host and Start Analysis
15:55 ⏩ Decode the Malicious Code
28:40 ⏩ Analyze Access Logs
44:14 ⏩ Run Power Forensics
50:51 ⏩ Analyze Volatile Data
1:04:55 ⏩ Run ClamScan
1:06:54 ⏩ Recap Analysis
1:10:11 ⏩ Report from ClamScan
1:14:16 ⏩ Let's Summarize
📞📲
FOLLOW ME EVERYWHERE-
-------------------------------------------------------------------------------------------------------------------------
✔ LinkedIn: / blackperl
✔ You can reach out to me personally in LinkedIn as well- https://bit.ly/38ze4L5
✔ Twitter: @blackperl_dfir
✔ Git: https://github.com/archanchoudhury
✔ Insta: (blackperl_dfir) / blackperl_dfir
✔ Can be reached via [email protected]
SUPPORT BLACKPERL
-------------------------------------------------------------------------------------------------------------------------
╔═╦╗╔╦╗╔═╦═╦╦╦╦╗╔═╗
║╚╣║║║╚╣╚╣╔╣╔╣║╚╣═╣
╠╗║╚╝║║╠╗║╚╣║║║║║═╣
╚═╩══╩═╩═╩═╩╝╚╩═╩═╝
➡️ SUBSCRIBE, Share, Like, Comment
☕ Buy me a Coffee 👉 https://www.buymeacoffee.com/BlackPerl
📧 Sponsorship Inquiries: [email protected]
-------------------------------------------------------------------------------------------------------------------------
🙏 Thanks for watching!! Be CyberAware!! 🤞
En esta página del sitio puede ver el video en línea Incident Response Training, Live Forensics of Compromised Website de Duración hora minuto segunda en buena calidad , que subió el usuario BlackPerl 17 septiembre 2021, comparta el enlace con amigos y conocidos, en youtube este video ya ha sido visto 2,273 veces y le gustó 103 a los espectadores. Disfruta viendo!
