cyber crisis simulations

15 Topics

FIN7 Threat Hunting with Splunk: Ep.3 – Execution Logs
I am pulling my hair with this last question Rebuild the PowerShell script from the previous question using the three parts found in the PowerShell operational logs. What is the MD5 hash of this file? (The file should not contain any trailing white space or return characters) I ran index=* (EventCode=4104) | search "stager.ps1" AND "scriptblock" | table _raw and added the script content of files (1 of 3) (2 of 3) (3 of 3) to a new file. I removed the spaces and made sure they are glued together. I pasted the file in cyber chef with md5 selected and I keep getting the wrong hash. See a sample of the beginning and end of the 3 files This is just a sample below. I really don't know what else to do with this. $EncodedCompressedFile = @' 7b1pk+LKcjD83RH3P5y4cT/Y0ddusfXAfcMRT5U2JJCgBBJIDn8AAQIklmmgBfz6N7O00sCcnuuxH9vPUcRMo1qycqvMrFItfxmsgu3keHqf//avv/2fP//pH/5NiiJts9+9H//xz+H8fTuPatV/mUXRn//p u3rgE9+I/KPY62u+qTQuvp0Xqu3KPkEovj/867/++Z/+9A9/+oe/jFZbY7757V9/w1+96fpvf3NW78fTJCJRtPP/UfjrvxmT4/Lf//Y3Y3L+x79ML8f54V+6821wXP5VOFcEQfgn+FuDv/CnLnCY/za4HI7zzb9Yp+1xtZn/i7Y9zt93+8H8/WPlQ3Vj8n5YTiKAKe72lxToX4W/prj89aaVHEuOm/g+nxznwyX8mQFuRR38ja3//w== '@ $Decoded = [System.Convert]::FromBase64String($EncodedCompressedFile) $MemStream = New-Object System.IO.MemoryStream $MemStream.Write($Decoded, 0, $Decoded.Length) $MemStream.Seek(0,0) | Out-Null $CompressedStream = New-Object System.IO.Compression.DeflateStream($MemStream, [System.IO.Compression.CompressionMode]::Decompress) $StreamReader = New-Object System.IO.StreamReader($CompressedStream) $Output = $StreamReader.readtoend() $Output | IEX
Solved
retornet
14 days ago Place Help & Support Forum
51Views
0likes
1Comment
Introduction to Elastic: Ep.9 - ES|QL
I’m stuck on question 18 i need this to complete the lab. The question says ‘Perform a final query using all of the techniques used in the previous questions. What is the average speed per hour for ALL trips that start in the borough of “Brooklyn” and end in the borough of “Manhattan”? Provide your answer to at least three decimal places. any ideas?
M_Waters-221
3 months ago Place Help & Support Forum
50Views
1like
1Comment
Measuring Cyber Resilience: What's the Key Metric?
Is cyber resilience just about fast incident response, or does true resilience go beyond that? Do you prioritize response time, employee awareness, or strategic recovery? What’s your go-to metric for measuring real cyber resilience?
YasserSalama
5 months ago Place Help & Support Forum
34Views
1like
1Comment
Can I get a Master Events List template?
Do you provide this MEL table to clients (a blank one which clients can use)?
Solved
TillyCorless
8 months ago Place Help & Support Forum
72Views
0likes
1Comment
How do you balance scenario complexity against driving clear, actionable steps from an exercise?
Crisis simulations are often very complex. How do you balance this with achieving actionable rectification steps?
Solved
TillyCorless
8 months ago Place Help & Support Forum
29Views
0likes
1Comment
Could we use live actors as part of the injects for Crisis Sim?
My organisation is planning a crisis sim. Could we use live actors as part of the injects?
Solved
TillyCorless
8 months ago Place Help & Support Forum
53Views
0likes
1Comment
What are the different crisis sim modes available?
What modes can I run a crisis sim exercise in? Do I need to choose the mode before I start to design the scenario?
Solved
TillyCorless
8 months ago Place Help & Support Forum
53Views
0likes
1Comment
How do I upload a crisis sim to Immersive Labs?
We created a custom crisis sim for our Division. How do we upload it to Immersive Labs?
Solved
TillyCorless
8 months ago Place Help & Support Forum
43Views
0likes
1Comment
Have you ever encountered an engagement for an organization that outsources almost everything? How do you avoid the response "We will reach out to <<>>"?
When organisations heavily rely on outsourcing, how do you avoid "we will reach out to [the vendor]" as an answer for multiple simulation injects?
Solved
TillyCorless
8 months ago Place Help & Support Forum
34Views
0likes
1Comment
Suggestions for running crisis sim exercises with your teams
Any suggestions for running crisis sim exercises with individuals that may not be the most excited to play along with the sim that has been created?
Solved
TillyCorless
8 months ago Place Help & Support Forum
39Views
0likes
1Comment