TRICK OR THREAT 2024 Walkthrough: Ozarks | SecOps

Описание: Welcome to Halloween BTLO Replay, a spine-chilling video series guiding you through retired BTLO labs from our Trick or Threat event. Join us… if you dare!

This week’s investigation is Ozarks, a medium security operations lab.

Difficulty: Medium

The Ozarks scenario:

Ozark Inc., known for its security expertise, has been hired to protect the Haunted Festival's digital infrastructure. The festival has become an interconnected experience where attendees use mobile apps for ticketing, access virtual haunted house simulations, and interact with digital attractions. As the festival approaches, Ozark's SOC analysts begin noticing unusual activity, suggesting that the event has been compromised by a group of sophisticated attackers. The threat actors are exploiting the digital infrastructure, attempting to disrupt the festival and steal sensitive information. We know that Ruth, who is part of the Domain Admin group, was targeted. The success of the festival now depends on their ability to identify the attackers' tactics, techniques, and procedures (TTPs) and neutralize the threat before the festival is ruined.

0:00 – Introduction
2:38 – Question 1
10:34 – Question 2
12:36 – Question 3
13:10 – Question 4
16:24 – Question 5
18:07 – Question 6
18:49 – Question 7
21:50 – Question 8
24:48 – Question 9
26:32 – Question 10
32:02 – Question 11
39:18 – Question 12
40:52 – Summary

--
Powered by global blue team training provider, Security Blue Team, BTLO is a gamified platform for defenders to sharpen their skills during engaging security investigation and challenge scenarios.

The BTLO Replay series takes viewers through walkthroughs of retired labs. Visit the BTLO website to take on these challenges for yourself and discover new labs launching regularly.

SUBSCRIBE:    / @secblueteam  
WEBSITE: https://blueteamlabs.online
DISCORD:   / discord  
TWITTER:   / bluelabsonline  
LINKEDIN:   / blue-team-labs-online