← Back
Casework
Two investigations. One reconstructs an intrusion from the evidence it left behind. The other takes malware apart to find out what it does before it does it.
Kill chain reconstruction
Capstone forensic investigation of a simulated ransomware attack on a municipal network. Six disk images, seven memory captures, 12.7M packets, and 90,000+ log entries. Each stage below reconstructs part of the attack and shows the evidence that established it.
MUNICIPAL RANSOMWARE — CASE RECONSTRUCTION
DWELL TIME: 4 DAYS · TIME-TO-DC: 1H 44M
Evidence
Malware lab
Twelve public malware samples analyzed in an isolated FlareVM environment. Each sample went through static triage followed by dynamic detonation to determine its family, indicators of compromise, and command-and-control behavior. Select a sample to view its full triage record.
flarevm@win10-x64-malware:~/samples