Analyzing Event Logs and MFT Dump with Chainsaw - HTB Sherlocks - CrownJewel-1

Name: Analyzing Event Logs and MFT Dump with Chainsaw - HTB Sherlocks - CrownJewel-1
Uploaded: 2024-10-23T10:00:52Z
Channel: IppSec
Description: Download Chainsaw: https://github.com/WithSecureLabs/chainsaw00:00 - Introduction, going over the scenario talking about dumping NTDS and why its incred...

IppSec · Beginner ·🧠 Large Language Models ·1y ago

Download Chainsaw: https://github.com/WithSecureLabs/chainsaw00:00 - Introduction, going over the scenario talking about dumping NTDS and why its incredibly bad when an attacker does this 03:00 - Running chainsaw with the hunt operator, not getting much information 06:55 - Looking at what types of events were captured and using ChatGPT to give us event names for each ID 15:20 - Question 1: Looking at Event ID 7036 to see when Volume Shadow Copy Service entered a running state 19:00 - Showing how you could cheese the question by grepping for the word shadow 20:40 - Question 2: Looking at Event …

Watch on YouTube ↗ (saves to browser)

Chapters (10)

3:00 Running chainsaw with the hunt operator, not getting much information

6:55 Looking at what types of events were captured and using ChatGPT to give us eve

15:20 Question 1: Looking at Event ID 7036 to see when Volume Shadow Copy Service en

19:00 Showing how you could cheese the question by grepping for the word shadow

20:40 Question 2: Looking at Event ID 4799 to see what groups VSSVC.EXE Enumerated

25:10 Question 3: Getting the PID of VSSVC.EXE from the above log (event 4799)

25:40 Question 4: Getting the GUID of the Volume Shadow Copy

33:38 Question 5: Dumping the MFT Dump with Chainsaw and searching for ntds.dit to s

36:35 Question 6: Getting the timestamp the NTDS.DIT file was dumped

37:00 Question 7: Searching the folder the NTDS.DIT was dumped to in order to find t

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →