Stockpile Breach

0xl4ugh

Task: Analyze a Windows triage image to reconstruct a malware attack timeline and answer 11 incident response questions. Solution: Parse Sysmon EVTX logs to identify the malware download source (Zone.Identifier ADS), execution timeline, C2 communication (Sliver framework at 3.121.219.28:8888), persistence via registry Run key, and file artifacts.