“ANN'S AURORA” - SANS Computer Forensics

More documents

Recommendations

Info

LEENDERT PIETER VAN DRIMMELEN: STREAM_TS.PY • Automatically displays TCP connection established/ closed times • Accepts tshark filters <strong>Forensics</strong>Contest.com Contest #6: “Ann’s Aurora” © 2010 Lake Missoula Group, LLC
LEENDERT PIETER VAN DRIMMELEN: PEXTRACT.C • Extracts PE files from packet captures or incoming traffic • Accepts BPF filters • Also tries to find executables that are XOR obfuscated <strong>Forensics</strong>Contest.com Contest #6: “Ann’s Aurora” © 2010 Lake Missoula Group, LLC
Page 1 and 2: SANS FORENSIC CHALLENGE: “ANN’S
Page 3 and 4: CONTEST #6: “ANN’S AURORA” :
Page 5 and 6: THE CONTEST • You are the investi
Page 7 and 8: SOLVING THE CRIME Q: What was the f
Page 9 and 10: SOLVING THE CRIME Vick's computer m
Page 11 and 12: SOLVING THE CRIME Q: When was the T
Page 13 and 14: SOLVING THE CRIME In packet 17, the
Page 15 and 16: SOLVING THE CRIME • There is some
Page 17 and 18: SOLVING THE CRIME • There is some
Page 19 and 20: SOLVING THE CRIME Subsequently, the
Page 21 and 22: SOLVING THE CRIME Q: When was the T
Page 23 and 24: BEHIND THE CURTAIN: EXPLOIT DESCRIP
Page 25 and 26: THE ATTACK (2) • The attacker los
Page 27 and 28: ISSUES WITH THE ATTACK • Victim i
Page 29 and 30: WINNER & FINALISTS • Winner! - We
Page 31 and 32: WESLEY MCGREW: PCAPLINE Example r
Page 33 and 34: • Drill down WESLEY MCGREW: • V
Page 35 and 36: ERIK HJELMVIK: NETWORK MINER .92
Page 37: ERIK HJELMVIK: NETWORK MINER .92
Page 41 and 42: ERIC KOLLMANN: CONTEST6.PL • Get
Page 43 and 44: CONGRATULATIONS, AND THANKS! • On

“ANN'S AURORA” - SANS Computer Forensics

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?