CYBER 5W

🕵🏻 No Prefetch? No Problem.
Learn how to trace malware or suspicious program execution even when traditional evidence like Prefetch files is missing. This case study walks you through advanced artifact correlation to build a timeline of attacker activity.

💣 Hunting Wipers: Uncovering sdelete and Beyond
Not all deletions are innocent. Dive into a case study where a threat actor uses sdelete to wipe their tracks and how forensic traces in NTFS, registry, and logs still tell the story.

🗑️ Deleted Doesn't Mean Gone.
Explore how deleted files, shortcuts, and shellbags can be recovered and interpreted to reconstruct user activity and attacker behavior in a compromised system.

🧪 Suspicious Installer or Admin Mistake?
Investigate a case where legitimate software was used as a LOLBin. You'll learn how to differentiate between administrator behavior and post-exploitation tactics.

📎 Malicious LNK Files: A Shortcut to Trouble
Learn how attackers use Windows shortcut files (.lnk) to execute malware silently. In this case study, you’ll recover and analyze LNK files to trace back user activity and uncover hidden execution paths.

👻 GhostTask Investigations: The Scheduled Jobs That Disappear
Uncover the mystery of Scheduled Tasks that leave minimal forensic traces. You’ll learn how attackers abuse Task Scheduler and how to recover or reconstruct their activity, even when tasks are deleted.

🔌 Execution from USB Devices: Following the Plug-in Trail
Explore a scenario where malware was launched from a removable device. You’ll trace USB insertions, mounted paths, and execution history using SetupAPI logs, registry entries, and forensic images.

🧹 Detecting Anti-Forensics: Timestomping and Log Tampering
Attackers may alter timestamps and clear logs to evade detection. This case study shows how to detect timestomping and use alternate forensic artifacts like $MFT, $LogFile, and $UsnJrnl to reconstruct the truth.