This Company Got Hacked... but HOW?

jh.live/pwyc || Jump into Pay What You Can training at whatever cost makes sense for you! jh.live/pwyc
This lab exercise: jh.live/logs-ir
Free Cybersecurity Education and Ethical Hacking
🔥KZbin ALGORITHM ➡ Like, Comment, & Subscribe!
🙏SUPPORT THE CHANNEL ➡ jh.live/patreon
🤝 SPONSOR THE CHANNEL ➡ jh.live/sponsor
🌎FOLLOW ME EVERYWHERE ➡ jh.live/discord ↔ jh.live/twitter ↔ jh.live/linkedin ↔ jh.live/instagram ↔ jh.live/tiktok
💥 SEND ME MALWARE ➡ jh.live/malware

[@GuyThompsonFWTX]

First off, thanks for showing this John. You were actually one of the first people I started watching in my IT career years ago when you were focused primarily on Python videos. Like you, I have since grown in my career and am now working in DFIR and also enrolled in SANS Incident Response Graduate Certificate program. I perform individual host-based forensics, large-scale multi-host multi-server ransomware compromise investigations, and everything in between. I've considered starting a KZbin channel focused on DFIR and showing beginning to end investigations (acquiring evidence from physical machines, imaging, various log analysis, network analysis, host-based forensics, investigation methodologies, reporting, etc.). If this is something your audience would like, I would love a 'Like' and will begin putting together a series for viewers.

[@rune004]

I would love to watch this if you ever get the time to make it 😊

[@phillipwithrow3754]

I would be first in line to watch as I am just completing a four year degree in cybersecurity itself, getting the real world practice out there is invaluable.

[@txlv]

ain't readin allat

[@squidthon4031]

John, you’re way too good for this community! Every day I watch your videos and try to grasp everything you teach but it’s difficult to keep up with the plethora of information you are giving out 😂😂 we really do appreciate all your hard work, thanks for all the opportunities you’ve given us to grow and learn!

[@ting3695]

Just finished my first week of my first job in cyber as a Security Analyst. Thank you for everything you do John, thanks to you, this knowledge is readily available in a digestible way.

[@JaviSerna]

Thanks for sharing and let us learn . Very well explained and clear.

[@TalkingSasquach]

I'm just over here taking notes on how to KZbin. Love your channel!

[@node-]

awesome to see some incident response videos hoping to see some more of these

[@grady.debonair]

Excellent video as always! Loving the blue team content on the channel!

[@anubisjishin]

Is amazing, thanks for sharing. What I don't understand is that you need to have Wireshark all the time monitoring the traffic to get that info? Or how you make those pcaps in a real environment?

[@charlesmarseille123]

@johnhammond my man! thats the right energy and natural tone (so rare nowadays with all the hypee youtubers)!! have you ever played with polarizing filters for the reflections in your glasses? you would be amazed!

[@Daniel-jb3rt]

Thanks John. We need more of this or malware analysis videos

[@Unrealdruiddd]

Don't know if you have heard but Toronto Public Library was hacked so bad that even their printers/scanners can't be used. It seems like entire back end was destroyed/deleted.

[@DecentralizedPlanet]

Seriously? Do you have source I could check out by any chance

[@CyberWithSarfraz]

It was a really amazing video, we need more of these.

[@Error_Mode1219]

big fan here from Ethiopia keep up the content🥰

[@user-lw7oj1wo1x]

Here From Nepal!😊

[@werth7113]

Here from Poland

[@PrinceJohn84]

The number of environments I come across where literally no security baselining has been carried out is simply staggering.

[@xeonzero1]

Thank you so much. This is great.

[@Angelinajolieshorts]

I love your teaching methods 😍😍

[@milentiusgaming]

this win11 taskbar is a perfect example of why it was put on the left in the first place :P

[@nayottientong4850]

thank, awesome!

[@parker4878]

Great video, well made and dictated!

[@RandomGeometryDashStuff]

05:59 why does office macro have capability to do stuff outside document like spawn process, read and write files?

[@Angelinajolieshorts]

Big fan of you boss❤❤

[@husamxxx-fv8pi]

Hello John Hammond, I want to ask you if the Windows copies on the Windowstan website are safe or if they contain viruses.

[@BurkenProductions]

Well not many companies do pcap to workstations. Too much data.

[@gabe_plane]

so where is the link to poisoning the well? i dont see it via browser

[@CZghost]

Nmap is among the stuff? Might give it a shot.

[@50PullUps]

Pause to shift gears 15:33

[@kevinapana-korley5442]

There's no link to the lab in the description currently.

[@_JohnHammond]

Sorry, fixed! jh.live/logs-ir

[@davidsussens4478]

As noted by a couple of commenters below, there does not seem to be a link to the labs in the description...

[@davidsussens4478]

Thanks for adding the link.

[@BenGillam]

Is it normal for a network to be capturing wireshark during normal use? Or is this supposed to have been run per hack but before cleanup?

[@chuckhayes8320]

Decent firewalls do this (but only for traffic hitting the gateway). LAN traffic would be more difficult to capture. You can set up a monitoring port on a network switch so you can monitor all traffic going to and from selected ports on that switch, but quickly bandwidth gets eaten up by the amount of data so you'd need quite a chunky NIC. 48x1Gb for client machines, and then 1x50Gb for your server, sort of thing. Dark trace takes this further with more advanced machine learning software for threat detection.

[@BenGillam]

@@chuckhayes8320 thanks that was kind of my thinking that’s a lot of data to be capturing seems something only big orgs would have budget for?

[@user-lf5tu6oc6h]

Do you have courses?

[@glass8289]

Hello John, Thanks for the video. There is no link in description.

[@_JohnHammond]

Apologies, I've added it now.

[@glass8289]

@@_JohnHammond That's quick. Really appreciate for sharing your knowledge. Thank you very much.

[@frighteningcat]

15:33 poor John forgot to cut it out

[@mthia]

17:27 too

[@dano612s]

why not open the CSV in excel or something?

[@mav3783]

Hi John why did you use a vm for this ?

[@brantray6774]

How often are the logs actually available and not wiped?

[@MrPyrox69]

That is why you have them on a Syslog Server that is not connected to the Domain...

[@tecsmith_info]

*Nostalgia intensifies*

[@Mezzosd]

why don't you make a video about Sysmon???

[@siamahmed8287]

Where can I find more Incident Response labs? Free labs

[@adrianocaporro639]

What are the differences between Antisyphon training vs try hack me? Would they complement each other?

[@user-ayush818]

Of course, only if you're really interested in cyber security

[@adrianocaporro639]

Definitely am ;), But if someone would chose one in between these two, which one would be best?

[@bubatz9815]

can you make a tutorial how to get on onion center the search engine?? please

[@imahsansyed]

Hey, I know that its hard to reply for comments but I have a question I have my google ID and password but I couldn't sign in into my account I have no 2fa enabled, no recovery phone or email in my account When I try to login it says, to login from device I logged in earlier (not available),sign in from same network(which isn't also available) What to do

[@Safvanviber-xm3pn]

Love from india ❤

[@gabe_plane]

yeah no link in description

[@davidsussens4478]

I thought I was the only one, but yeah, no link. Thought I might have fallen on my head...

[@_JohnHammond]

Sorry, added now! jh.live/logs-ir

[@albaniaiptv8335]

how gta 6 got hacked , can you explain ?

[@NotTheRealRyan]

The day will come when someone asks the AI to fix our security problems, and it eliminates all the humans....

[@dakoderii4221]

There is a lot of data on the web from the WEF and UN, along with their brainwashed useful idiots, that states humans are a plague on the Earth. The first group the AI will wipe out is white people since that's all you hear about on MSM. White people has also been redefined to mean anyone who disagrees with the agenda. It will also see that men are bad and oppressing women but humans don't know what a women is, yet they know that men can be women too. The AI will be confused by our own stupidity. Ironically, it might be what keeps us from getting exterminated. 🤔

[@BearMeat4Dinner]

They got it hacked cause someone had there head stuck up there hanus holes…

[@RhinecnthusAssasi]

Make An rev eng of an ITP crypto scam app please. :-)

[@abd-animation-22]

I don't understand anything here

[@patslee1394]

👍

[@ramnarayan9882]

hi

[@dvn8ter]

⭐️⭐️⭐️⭐️⭐️

[@thebeastsclips]

I wonder which company got hacked😂

[@physx_naraka]

its obviously in the video.

[@dakoderii4221]

According to the WEF, hacking now consists of "misinformation". If you post a comment saying "men can NOT get pregnant", you have just "hacked" something and are now an international, cyber criminal terrorist. It's in their new 16 page report. They say it's for your "safety".

[@bober1019]

wtf is this click bait. be transparent in your title: this is not real

[@just_silent3990]

comment

[@tsgetty]

DISH, duh. Lulz

[@Seadragxn]

First, 22 seconds ago?

[@margarita8442]

script kiddie stuff

[@DJG37S]

Lmao!!!! Well played on the word.exe. The word.exe for famous because there was a known counter strike player name forsaken who got caught cheating using word.exe.

[@000TheRebel000]

HACKERATO LEDGER