University CTF 2024: Let's Sherlock! An introduction to Blue Team Training

The video walks through "Op Tinsel Trace 3," a defensive cybersecurity challenge that simulates real-world incident response by analyzing a Windows 10 memory dump to uncover malicious activities 0:14-0:23. Participants use volatility to identify suspicious files and processes, ultimately tracing a link file that executes a PowerShell script to search for and run VBS files, leading to a remote command execution via a base64-encoded URL 1:30-1:45.

Key Takeaways:
• Sherlock challenges mirror real-world defensive investigations by posing forensic questions similar to incident reports 0:14-0:23.
• The challenge begins with a Windows 10 memory dump analyzed using volatility to identify files and running processes 0:54-1:08.
• A suspicious file, "present for santa.zip," is found on the desktop and extracted from memory 1:09-1:18.
• The link file "click for present.link" executes PowerShell with a base64-encoded command to recursively search for and run VBS files in user directories 1:30-1:45.
• The VBS script obfuscates its payload and eventually calls powershell.exe with a URL derived from a string extraction function using a custom pattern 2:05-2:28.

This hands-on investigation highlights core defensive techniques such as memory analysis, file extraction, and understanding attacker behavior through obfuscation and lateral movement.

Sources:

• 0:14-0:23 Overview of Sherlock challenges and their purpose in defensive investigations.
• 0:54-1:08 Memory dump analysis using volatility