Sony IR Internship Capstone - Cyber Attack Simulation & Forensics (Forensics)

This article was my first Capstone Project when I was an Incident Response Intern at Sony in the summer of 2023. The first part was about documenting the methods used to simulate two types of cyber-attacks (Phishing, metasploit reverse shell), and the second part was a full stage forensics and investigation.

Comments

Post a Comment

Popular posts from this blog

PCAP analysis report - Nitroba University

Image
Introduction/objectives/Background Case Background Lily Tuckrige is teaching chemistry CHEM109 this summer at NSU and she has been receiving harassing email at her personal email address: lilytuckrige@yahoo.com. She suspects that they are being sent by a student in her class CHEM109. About this case, I received a packet capture files called "nitroba.pcap" containing the network traffic packets recorded from Nitroba student dormitories by a network sniffer and a slide called "slides.pdf". According to the document "slides.pdf" that I have received, the following information was provided: The email address used by victim Lily Tuckrige was “lilytuckrige@yahoo.com”, and she received the harassing emails at this address. The first harassing email was sent on Sun, 13 Jul 2008 17:21:01 -0700 from the email address “ nobody@nitroba.com ” with IP address “140.247.62.34”. The IP address points to a nitroba dorm room that shared by three women Alice, Barbara, and Can
Read more

Mason TCTF - Writeup (Update in progress)

Image
Welcome file Mason TCTF is an cyber security CTF (Capture the Flag) deployed by Mason Competitive Cyber (MasonCC), an cyber security group at George Mason University. The challenges include Threat Detection, Linux/Scripting, Protocol Hopping, Digital Forensics, Cryptography, Password Cracking, Steganography, Recon, and Web with difficulty ranging from simple to moderately complex. It is an good CTF for learning various aspects of cyber security knowledge. This write-up will document my thinking and process of solving the problem according to the category of the challenge. (Update in progress) The Office “The Office” category is an incident response scenario about ransomware. The solver needs to analyze the “LiveResponseData” dataset to get the flags of the 4 problems. #1 ASAP as Possible (150) Read the scenario, and then look at the forensic data to answer the questions. What was the name of the file that ran the ransomware? Remember to enter the flag in
Read more