04 · Evidence of Execution
Phishing Forensics: MotW, ISO, LNK and Initial Access
Trace a phishing attack from email to first execution: Outlook temp files, Zone.Identifier, ISO and LNK MotW bypass, macros, OneNote, LOLBins and a timeline.
04 · Evidence of Execution
Trace a phishing attack from email to first execution: Outlook temp files, Zone.Identifier, ISO and LNK MotW bypass, macros, OneNote, LOLBins and a timeline.