forensicsmedium

:( (sad_face)

scarlet

Task: Forensics challenge with a Windows Event Log (.evtx) file containing hidden flag data related to BSOD/EternalBlue events. Solution: Parsed the EVTX file, extracted Binary fields from BugCheck events (EventID 1001/41), and applied double Base64 decoding to reconstruct the three flag parts.

$ ls tags/ techniques/
base64evtxwindows_event_logdouble_encodingbsodeternalblue
evtx_parsingbase64_double_decodeevent_log_analysisbinary_data_extraction
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]