Incident Response Walkthrough: Solving BFT Sherlock on HTB Labs | Learn with HTB (Episode #5)

This video demonstrates how to use Hack The Box's Sherlocks for digital forensics training, specifically focusing on MFT (Master File Table) analysis to track malicious activity 0:08.

Key Takeaways:
• Sherlocks are realistic blue team exercises that require using a virtual machine environment for safety when handling potentially malicious artifacts 1:27
• The presenter walks through the "bft" Sherlock exercise, converting an MFT file to CSV using mft2cmd for analysis 4:03
• Timeline Explorer is used to visualize and filter the forensic data to answer specific investigation questions 7:12
• The investigation includes identifying a malicious zip file, extracting download URLs from Zone identifiers, and locating the full path of the malicious batch file 8:21
• Advanced techniques like calculating hex offsets and examining resident MFT files reveal command and control server information 22:12

The tutorial demonstrates practical forensic analysis workflows that cybersecurity professionals can apply in real-world incident response scenarios 28:09.

Sources:

• 0:08 Introduction to Sherlocks and MFT forensics
• 1:27 Warning about using a virtual machine
• 4:03 Converting MFT to CSV using mft2cmd
• 7:12 Using Timeline Explorer for analysis
• 8:21 Finding the malicious zip file
• 22:12 C