Hi everyone,
I am a newbie here in the digital forensic world. Recently during my internship, I was thrown with a case to investigate by myself and I do not have any help or any guidance from my team. I actually did a lot of googling and the results were overwhelming and I still do not know how I should approach the case.
Hope you seniors can point me in some directions where I can get some good quality reading material or even guidances for me to do some self learning.
Â
Really appreciate the help here.
You might start by describing what questions you are supposed to find answers to.
You might start by describing what questions you are supposed to find answers to.
Yep, different types of investigations require different approaches. You wouldn't investigate IP theft the same ways as child abuse imagery.
You need to be more specific regarding your case.
Â
Thanks for the feedback. I am suppose to examine the windows event log (i.e the powershell evt and the security evt) The investigation was more on gathering information on lateral movement onto other system.
Hi - having a lot of data can be overwhelming, thats okay. It's overwhelming for all of us.
Find a place to put all the raw or normalized data (excel?) and sort it by time. Ofcourse you have a time frame you are working with right?
Add say MAX 60 mins before and MAX 60 mins after (MAX, It could be 15m or 60m or more, do as you feel is right by your own case and knowledge of the estate)
What are you and your teams end goal here? Knowing this you can then break you work up accordingly.
For lateral movement?
Sort all the evt logs, highlight colour code whats normal, whats bad, whats weird and start piecing together recon, entry point, delivery, exploit, lateral movement.
Would https://attack.mitre.org/tactics/TA0008/ help?
Hope my ramblings help a little.
Â
Thank you so much so your help. To me right now, every advice, every tips or tricks helps. I will take a look at the link as well.
😀
