Investigation with Splunk Walkthrough
Today we are investigating another TryHackMe Defensive Security challenge where we are provided with Windows event logs that have already been ingested into Splunk.
Tagged “Forensics”
6 entries tagged “Forensics”. Browse all tags
All entries
radare2
The radare2 quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Load and analyze a binary, list functions, strings, and imports, disassemble main, read control flow in graph mode, patch a jump, debug under breakpoints, diff two builds, and script it with r2pipe.
Stegseek
The Stegseek quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Brute-force a Steghide passphrase against rockyou, extract the hidden payload, confirm a carrier with seed mode, batch many files, and identify what you recovered before opening it.
Exiftool
The exiftool quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Dump every tag, pull GPS as decimal, surface hidden CTF fields, extract the embedded thumbnail, strip metadata before publishing, shift wrong timestamps, and batch a folder to CSV.
Binwalk
The Binwalk quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Map firmware with a signature scan, extract nested layers recursively, carve a byte range with dd, read entropy for compression vs encryption, filter to just the filesystem, and identify a raw blob's CPU architecture.
Steghide
The Steghide quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Inspect a carrier for a payload, try the empty passphrase, extract with a known one, crack an unknown passphrase with stegseek, embed your own data, and pick the right tool when the format is not JPEG or WAV.