Sunday, January 20, 2019

Daily Blog #603: Sunday Funday 1/20/19

Hello Reader,
            Last week's challenge brought out some great research and new tools. I hope that this streak of great responses continues through 2019! Let's switch focus back to the Syscache hive for this weeks challenge.


The Prize:
$100 Amazon Giftcard

The Rules:

  1. You must post your answer before Friday 1/25/19 7PM CST (GMT -5)
  2. The most complete answer wins
  3. You are allowed to edit your answer after posting
  4. If two answers are too similar for one to win, the one with the earlier posting time wins
  5. Be specific and be thoughtful
  6. Anonymous entries are allowed, please email them to dcowen@g-cpartners.com. Please state in your email if you would like to be anonymous or not if you win.
  7. In order for an anonymous winner to receive a prize they must give their name to me, but i will not release it in a blog post


The Challenge:
On a Server 2008 R2 system make 4 copies of mimikatz (your choice of versions) 64 bit and 32 bit versions. Run them from 4 locations (of your choice) and determine what criteria determines when and if the executable gets logged in the Syscache hive and what dates are associated with the registry keys. 

No comments:

Post a Comment