Windows Machine Hacked With CVE-2024-49138 | Letsdefend SOC335 | SOC Training скачать в хорошем качестве

Windows Machine Hacked With CVE-2024-49138 | Letsdefend SOC335 | SOC Training

In this video walkthrough , we investigate a Windows machine that was compromised using a privilege escalation vulnerability (CVE-2024-49138). The attacker successfully exploited this weakness to gain full control over the system. We used letsdefend platform to identify IOCs and perform SOC analysis. **** Receive Cyber Security Field, Certifications Notes and Special Training Videos https://buymeacoffee.com/notescatalog... Writeup https://motasem-notes.net/windows-mac... ****** Store https://buymeacoffee.com/notescatalog... Patreon   / motasemhamdan   Instagram   / mastermindstudynotes   Google Profile https://maps.app.goo.gl/eLotQQb7Dm6ai... LinkedIn [1]:   / motasem-hamdan-7673289b   [2]:   / motasem-eldad-ha-bb42481b2   Instagram   / mastermindstudynotes   Twitter   / manmotasem   Facebook   / motasemhamdantty   *** 00:00 Introduction to the Investigation 00:03 Overview of the Exploit 00:07 CVE 2024-49138 Alert 00:18 Researching the CVE 00:28 Understanding Privilege Escalation 00:34 Examining the Alert Details 00:42 Identifying the Suspicious Process 01:00 Spotting a Process Name Typo 01:17 Confirming Malicious Activity 01:50 Investigating the Parent Process 02:03 Determining a True Positive Alert 02:16 Checking Trigger Reasons 02:52 Reviewing Device Actions 03:07 Investigating the IP Address 03:20 Searching Logs for Malicious Traffic 03:49 Analyzing RDP Connection Attempts 04:53 Failed and Successful Login Attempts 05:58 How the Attacker Gained Access 06:50 Execution of PowerShell Commands 07:08 Downloading and Extracting Malicious Files 08:31 Fake Service Host Executable 09:00 Confirming Payload Execution 10:02 Checking Network Connections for C2 10:40 Reviewing Outgoing Traffic 11:06 Submitting Hash for Threat Intelligence 12:02 Sandbox Analysis of the Malware witn Any.Run 13:32 VirusTotal Report on the File 14:09 Checking Logs for C2 Address Access 15:26 Identifying Indicators of Compromise 16:34 Closing the Investigation 16:45 Conclusion and Wrap-Up