How to catch corporate spies | SMB Packets Decryption | TryHackMe Block

Опубликовано: 15 Август 2024
на канале: Motasem Hamdan | Cyber Security & Tech

606

In this video walkthrough, we covered a corporate espionage scenario where two two previous employees used their non-deactivated accounts to login into the company network and access the SMB shares to retrieve intellectual property. The SOC team pulled network packet captures & memory dump of the lsass process to investigate and prove evidence of logging in from these two accounts. Wireshark was used to analyze the packet capture, decrypt the SMB3 packets and retrieve session keys. This was part of TryHackMe Block room.
#cybersecurity
#courses
#hacker
#tryhackme
****
Receive Cyber Security Field, Certifications Notes and Special Training Videos
   / @motasemhamdan
******
Writeup
https://motasem-notes.net/corporate-e...
TryHackMe Block
https://tryhackme.com/r/room/blockroom
********
Google Profile
https://maps.app.goo.gl/eLotQQb7Dm6ai...
LinkedIn
[1]:   / motasem-hamdan-7673289b
[2]:   / motasem-eldad-ha-bb42481b2
Instagram
  / motasem.hamdan.official
Twitter
  / manmotasem
Facebook
  / motasemhamdantty