Step into the role of a digital forensics investigator in this advanced workshop. In this real-world simulation, you’ll analyze a system compromised through a phishing attack, where the threat actor may have used TeamViewer and other methods to maintain persistent access.
This workshop challenges you to investigate the attacker’s initial access, trace signs of persistence, and examine system logs, services, and remote access tools. Participants will work through structured Windows tasks, with optional Linux-based exploration for those who have extra time.
Designed for intermediate to advanced learners, this lab emphasizes real investigative workflows, including mounting evidence, extracting key artifacts, and piecing together attacker activity through logs and behavior patterns.
Purchasing this workshop provides 5 hours of access to a pre-configured virtual machine and forensic dataset to reinforce hands-on skills.
-
Format: Self-paced online workshop with structured modules and hands-on labs.
-
Interactive Labs: Simulate real-world internal breach scenarios to investigate evidence and system logs.
-
Virtual Lab Access: 5 hours of lab time included to practice investigative workflows in a controlled environment.
-
Technical Requirements: A computer with internet access; no special hardware required since the lab is online and preconfigured.
-
-
-
Lessons Learned (Reflection)
-
- Verify and mount forensic evidence in a controlled lab environment
- Analyze system compromise resulting from a phishing attack
- Identify and evaluate signs of persistence mechanisms (e.g., TeamViewer, registry keys, ghost tasks)
- Extract and examine key artifacts from the system, including: System logs / Remote desktop and service usage / Installed programs and suspicious processes
- Reflect on the investigation process and articulate lessons learned
- (Optionally) Extend their analysis to Linux systems for additional challenge and exposure