CyCTF 2025 Quals — DFIR Write-up
A DFIR write-up from CyCTF 2025 Quals covering Windows artefacts, persistence, and execution traces.
This is the mirrored entry for the Medium article.
Read the canonical version on Medium.
The write-up covers one of the DFIR challenges from CyCTF 2025 Quals.
It centers on Windows artefacts such as Prefetch and scheduled-task evidence, then follows the chain of execution into the persistence mechanism used in the image.
This post is licensed under CC BY 4.0 by the author.