THM Room: Incident handling with Splunk

Introduction

What?

Incident handling.

Why?

Stop/defend/prevent against the attack in a better way.

How?

• I am really not batman

• Reconnaissance phase

• Exploitation phase

• Installation phase

• Action on objectives

• Command and control phase

• Weaponisation phase

• Delivery phase